Privacy Policy

Kithcraft ("we", "us", "our") is a facilitated conversation studio based in Kuching, Sarawak, Malaysia. We are committed to handling personal information with care, transparency, and respect for your rights under Malaysian data protection law, including the Personal Data Protection Act 2010 (PDPA).

This Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have in relation to it. It applies to information collected through our website at kithcrafteep.biz and through our workshop enquiry and booking process.

Questions about this Policy may be directed to [email protected].

We collect only the information needed to respond to enquiries and manage workshop bookings. This includes:

• Full name and email address (required for enquiry and booking)
• Phone number (optional, if provided in an enquiry form)
• Details of the workshop or service you are enquiring about
• Any additional information you choose to include in your message

We also collect anonymised website usage data through analytics tools (see Section 5). We do not collect sensitive personal data, financial details, or information about minors through our website.

Legal basis for processing: Your enquiry and the initiation of a booking constitutes a request for information or services, which provides the lawful basis for processing under the PDPA. Where we process data for analytics, we do so on the basis of legitimate interest or, where required, consent.

Retention: Enquiry correspondence is retained for up to 24 months after last contact. Booking records are retained for up to seven years for administrative purposes. Data no longer required is securely deleted.

We use the personal data you provide to:

• Respond to your enquiry
• Arrange and confirm workshop bookings
• Send follow-up materials where these are part of your workshop package (e.g. a follow-up note one month after a series)
• Dispatch monthly mailed prompts for Membership households
• Manage rescheduling or cancellation requests

We do not use your personal data for unsolicited marketing. If you wish to receive occasional updates about new workshops or public sessions, you may opt in when making an enquiry. You may withdraw this at any time by contacting [email protected].

We do not sell personal data to third parties. We do not share your information with advertisers, data brokers, or any party whose purpose is marketing to you on our behalf.

We share personal data only in the following circumstances:

• Service providers: We use a small number of third-party services for website hosting, email delivery, and analytics. These providers operate under data processing terms and are not permitted to use your data for their own purposes.
• Legal requirement: We may disclose personal data if required to do so by Malaysian law or in response to a lawful request from a public authority.
• Business continuity: In the event of a change in the business, participant data would be transferred to the successor entity under the same privacy obligations.

No data is transferred outside Malaysia except where a service provider's infrastructure requires it, in which case appropriate safeguards are in place.

Our website uses cookies to support its basic functions and to understand how it is used. Essential cookies are required for the site to work. Analytics cookies, if accepted, help us understand page visits and improve the site. Marketing cookies are optional and used only with your consent.

You can manage your cookie preferences at any time through our Cookie Policy page, which includes functional toggle controls. Rejecting non-essential cookies will not affect your ability to use our website or make an enquiry.

We take reasonable and appropriate measures to protect personal data from unauthorised access, loss, or disclosure. These include:

• Use of encrypted connections (HTTPS) for all website communications
• Restricted internal access to enquiry and booking records
• Use of reputable hosting and email service providers with appropriate security standards
• Regular review of data handling practices

In the event of a data breach that affects your personal information, we will notify you and the relevant authority in accordance with our obligations under the PDPA.

Under the Malaysian Personal Data Protection Act 2010, you have the following rights in relation to your personal data:

• Right to access: You may request a copy of the personal data we hold about you.
• Right to correct: You may request correction of inaccurate or incomplete data.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to object: You may object to processing based on legitimate interest where you have grounds to do so.
• Right to request erasure: Subject to our legal retention obligations, you may request deletion of data we hold about you.

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days. If you are not satisfied with our response, you may refer the matter to the Department of Personal Data Protection Malaysia (JPDP).

Data controller: Kithcraft

Address: Block B-12, Jalan Padungan, 93100 Kuching, Sarawak, Malaysia

Email: [email protected]

Phone: +60 82-415 873