Privacy Policy

1. Who We Are

Gemilang Forge is an AI integration advisory practice registered and operating in Malaysia. Our principal place of business is Jalan Tunku Abdul Rahman 142, 50100 Kuala Lumpur. For data protection matters, we are the data controller of the personal information you provide to us.

2. What Personal Data We Collect

We may collect the following categories of personal data:

• Identity data: name, job title, company name
• Contact data: email address, phone number, business address
• Enquiry data: the content of messages submitted through our contact form
• Technical data: IP address, browser type, pages visited, time on site (collected via cookies and analytics tools)
• Engagement data: notes and communications arising from a client engagement (held under separate confidentiality agreement)

We do not collect sensitive personal data (such as health information, race, religion, or financial account details) unless this arises in a specific engagement context and is governed by a separate written agreement.

3. How We Collect Your Data

• Directly from you, when you complete our contact form or communicate with us by email or phone
• Automatically, through cookies and analytics tools when you use our website
• During the course of an engagement, through conversations and documentation review

4. Legal Basis for Processing

Under the PDPA, we process personal data on the following bases:

• Consent: when you submit our contact form or agree to cookies
• Contractual necessity: when processing is required to deliver a service you have engaged us for
• Legitimate interest: for basic site analytics and improvement of our services, where this does not override your rights
• Legal obligation: when required to comply with applicable Malaysian law

5. How We Use Your Data

• To respond to enquiries submitted through our contact form (typically within one working day)
• To deliver, administer, and support engagement services
• To send service-related communications (not marketing, unless you have opted in)
• To maintain records required for legal and contractual purposes
• To improve our website based on anonymous usage data

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

6. Data Sharing

We do not sell personal data. We may share data with the following categories of parties:

• Service providers: hosting providers, analytics services, and communication tools that support our operations — all bound by data processing agreements
• Professional advisors: where required for legal or compliance purposes
• Regulators: where disclosure is required by Malaysian law or court order

Engagement-related client data is never shared with third parties without explicit written consent.

7. Data Retention

• Contact form enquiries: retained for 12 months from last contact, then deleted
• Client engagement records: retained for 5 years following engagement close, as required for professional and legal compliance
• Website analytics data: retained in aggregated or anonymised form only

8. Cookies

We use cookies to understand how our website is used and to improve the experience. For full details, see our Cookie Policy. You may manage cookie preferences at any time via the cookie settings on this site.

9. Data Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include:

• Encrypted transmission for all data submitted through our website
• Access controls limiting who within our team can access client data
• Signed confidentiality agreements covering all engagement data

In the event of a data breach that affects your rights, we will notify you and the relevant authority in accordance with applicable obligations.

10. Your Rights Under the PDPA

Under Malaysia's Personal Data Protection Act 2010, you have the right to:

• Access personal data we hold about you
• Correct inaccurate or incomplete personal data
• Withdraw consent for processing at any time (where processing is based on consent)
• Request deletion of your data where we have no legal basis to retain it
• Lodge a complaint with the Department of Personal Data Protection (JPDP) Malaysia if you believe your rights have been infringed

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days.

11. Children's Privacy

Our services are directed at businesses and professionals. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have received data from a minor, please contact us immediately.

12. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policies of any third-party sites you visit.

13. Changes to This Policy

We may update this policy from time to time. When material changes are made, we will update the "Last Updated" date at the top of this page. Continued use of our website after changes are posted constitutes acceptance of the revised policy.

14. Contact

For questions about this policy or to exercise your data rights, contact our data protection point of contact:

• Email: [email protected]
• Address: Gemilang Forge, Jalan Tunku Abdul Rahman 142, 50100 Kuala Lumpur, Malaysia