Privacy Policy

Who we are

A3M Concept Sdn Bhd (registration no. 201901011262 / 1320590-P), 15781 Jalan Camar 10, Bandar Putra, 81000 Kulai, Johor, Malaysia. For privacy matters, emaila3mcsb@gmail.com.

What we collect

• Enquiry form: your name, company, email, optional phone, project location, your message, and branch-specific project details; your consent choices.
• Booking: whatever the third-party scheduler collects (name, email, timeslot) — only if you choose to load and use it.
• Technical: aggregate, non-identifying usage statistics (page, referring site) via Cloudflare Web Analytics; short-lived server logs used only for security and abuse prevention.

Why we use it (and our legal basis)

• To respond to your enquiry and take steps toward a possible contract.
• To keep the site secure and prevent abuse (our legitimate interests).
• For analytics and any marketing updates (only with your consent).
• To meet legal obligations.

What we don't do

We don't sell personal data, use it for automated decisions with legal effect, or collect sensitive personal data through this site.

Who we share it with

Service providers acting on our instructions: Cloudflare (hosting, security, analytics), Resend (enquiry email delivery), Supabase (secure enquiry storage), and a third-party booking scheduler if you choose to use it. Each only receives what it needs.

Where it's stored

Our providers process data in the European Union, the United Kingdom, the United States, and Singapore. Where data leaves Malaysia, we rely on each provider's contractual data-protection commitments as the transfer safeguard under the PDPA.

How long we keep it

Enquiry data: for as long as needed to respond and to meet our legal and record-keeping obligations, then deleted or anonymised. Server logs: about 30 days. Consent records: as long as needed to evidence compliance.

Your rights

Under the PDPA you can ask to access or correct your data, withdraw consent, limit processing, or request portability, and you may complain to the Personal Data Protection Commissioner. Contact us and we'll respond within the statutory timeframe.

Security

Data is encrypted in transit, access is restricted, and we collect only what we need. See our security practices summary for more.

Children

This site is not directed at children and we do not knowingly collect their data.

Changes

We'll update the date above when this policy changes and, for material changes, prompt you again for consent where required.