Privacy Policy

1. Data We Collect

We collect only the personal data necessary to manage bookings, respond to enquiries, and deliver our organising and cataloging services. Specifically, we may collect:

• Name — to address you correctly and reference your household in session notes.
• Email address — to confirm bookings, send session summaries, and respond to enquiries.
• Phone number (if provided) — to coordinate session scheduling and follow up on queries.
• Home address — for in-home sessions, used solely to arrange the team's visit.
• Session notes — written summaries of each session, held securely and shared only with you.
• Website usage data — collected via cookies and analytics tools, with your consent. See our Cookie Policy for details.

We do not collect financial payment information directly. Payments are handled by third-party payment processors under their own privacy policies.

Legal basis for processing: Consent (website enquiries); Performance of a contract (service delivery); Legitimate interests (session management and follow-up notes).

2. How We Use Your Data

• To respond to enquiries submitted through our website contact form.
• To schedule and confirm in-home sessions and follow-up visits.
• To produce and deliver session summary notes and catalog documents.
• To send the three-month follow-up note included in the Legacy Cataloging Project.
• To manage Annual Maintenance Subscription visits across the year.
• To comply with applicable laws, including the PDPA and any related regulations.

We do not sell your personal data to third parties. We do not use your data for direct marketing without your explicit consent. We will never contact you with promotional messages unless you have specifically opted in.

3. Data Sharing

We share personal data only in the following limited circumstances:

• Team members: Staff assigned to your household's sessions are provided with your name, contact details, and session notes relevant to the work. All team members are bound by confidentiality agreements.
• Service providers: We use third-party tools for email communication and website analytics. These providers process data on our behalf under data processing agreements and do not use your data for their own purposes.
• Legal requirements: We may disclose personal data if required by Malaysian law or a valid order from a competent authority.

4. Data Retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected:

• Enquiry data — retained for 12 months from the date of the enquiry, then deleted.
• Service data (name, contact, session notes) — retained for 3 years from the completion of the last service, to support follow-up notes and subscription management.
• Financial records — retained for 7 years in accordance with Malaysian tax and accounting requirements.

When data is no longer needed, it is deleted securely from all systems.

5. Data Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include:

• Access to client data is restricted to team members who need it for service delivery.
• Digital records are stored on password-protected, encrypted systems.
• Physical session notes are stored in locked storage and disposed of securely when no longer needed.
• In the event of a data breach, we will notify affected individuals and the relevant authorities as required under the PDPA.

6. Cookies

Our website uses cookies to remember your preferences and understand how visitors use the site. Essential cookies are necessary for the site to function. Analytics and preference cookies are used only with your consent. You can manage your cookie preferences at any time via our Cookie Policy page.

7. Your Rights Under PDPA 2010

Under Malaysia's Personal Data Protection Act 2010, you have the following rights in relation to your personal data held by Threadkin:

• Right of access — you may request a copy of the personal data we hold about you.
• Right of correction — you may request that inaccurate or incomplete data be corrected.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to prevent processing for direct marketing — you may instruct us not to use your data for marketing purposes.
• Right to lodge a complaint — you may raise a concern with the Department of Personal Data Protection (JPDP) Malaysia if you believe your rights have not been upheld.

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days.

8. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies independently. This policy applies only to data collected through our own website and service delivery.

9. Children's Privacy

Our services are directed at adults (18 years and over) acting on behalf of their household. We do not knowingly collect personal data from individuals under 18. If you believe a minor has submitted personal data to us, contact us at [email protected] and we will remove it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, the revised version will be published on this page with an updated effective date. Where changes are significant, we will notify active clients by email. Continued use of our services after an update constitutes acceptance of the revised policy.