Privacy Policy

1. Who we are

Bunga Harbour is the data controller for personal data collected through this website and during in-person sessions at our Kelana Jaya centre. If you have questions about this policy or how we handle your data, contact us at [email protected].

We are committed to handling personal data with care and transparency. We collect only what we need, retain it only as long as necessary, and do not sell or share it commercially.

2. Personal data we collect

We collect personal data through the following channels:

• Contact form on our website: name (required), email address (required), phone number (optional), and the message or enquiry you submit.
• In-person sessions: documents you bring to a session, along with any notes produced during the session with your participation. No documents are retained without your explicit written consent.
• Telephone enquiries: name and contact number you provide when calling us.
• Website cookies and analytics: anonymised browsing data as described in our Cookie Policy.

Legal basis for processing: Consent (for contact forms and optional communications); legitimate interest (for managing appointments and delivering services you have requested); and contractual necessity (for carrying out a booked and paid service).

Retention periods: Contact form submissions are retained for up to 12 months. Appointment records are retained for 24 months for business continuity purposes. Session notes, if retained with your consent, are held for the duration you agreed. You may request deletion at any time.

3. How we use your personal data

• Responding to your enquiry and confirming or managing your appointment.
• Delivering the service you have booked, including preparing session materials relevant to your situation.
• Sending the one follow-up call included in the Family Enrolment Assistance service.
• Sending you administrative communications (e.g. appointment reminders or schedule changes).
• Improving our services based on aggregated, anonymised feedback patterns.

We do not use your personal data for direct marketing without your separate consent, and we do not share it with third parties for their marketing purposes.

Third-party services we use: Our website may use analytics tools (such as Google Analytics, if enabled) that collect anonymised browsing data. We do not pass identifiable personal data to these services.

4. How we protect your data

• Our website uses HTTPS encryption for all data transmitted through the contact form.
• Digital records are stored on password-protected systems accessible only to Bunga Harbour staff directly involved in service delivery.
• Physical session notes, where produced and retained, are kept in locked storage at our Kelana Jaya premises.
• In the event of a data breach affecting your personal data, we will notify you and the relevant Malaysian authority as required under the PDPA within a reasonable timeframe.

5. Cookies

Our website uses cookies to function correctly and, where you consent, to collect anonymised usage data. You can manage your cookie preferences at any time. For full details, see our Cookie Policy.

6. Your rights under the PDPA (Malaysia)

Under Malaysia's Personal Data Protection Act 2010, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Withdraw consent for processing at any time, where consent is the legal basis. Withdrawal does not affect the legality of processing that occurred before withdrawal.
• Request deletion of your personal data, subject to any legal retention obligations.
• Object to processing where we rely on legitimate interest as our legal basis.
• Lodge a complaint with the Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi, JPDP) if you believe your data is being handled unlawfully.

To exercise any of these rights, email us at [email protected] with your request. We will respond within 21 days.

7. Links to other websites

Our website may contain links to external sites, such as government portals or school administration pages. We are not responsible for the privacy practices of these third parties and recommend you review their policies before submitting personal data to them.

8. Children's privacy

Our services are directed at adults (18 years and above). Where a service involves a minor — for example, enrolment assistance for a child — the parent or guardian submits information on the child's behalf and is responsible for providing consent. We do not knowingly collect personal data directly from children under 18.

9. Updates to this policy

We may update this policy from time to time to reflect changes in our services or applicable law. When we do, we will update the "Last updated" date at the top of this page. Continued use of our website or services after an update constitutes your acknowledgement of the revised policy. For significant changes, we will notify visitors by a notice on our website.