Privacy Policy

1. Introduction

Sundara ("we", "us", "our") is committed to handling personal information responsibly. This policy explains what data we collect, how we use it, and the rights you have as a data subject. It applies to visitors to our website and to clients who engage our services.

Our data controller contact is [email protected]. Our registered address is Jalan P. Ramlee 17, 50250 Kuala Lumpur, Malaysia.

2. Data We Collect

We collect the following types of personal data:

• Contact information: Name, email address, phone number — provided when you fill in our enquiry form or contact us directly.
• Business information: Company name, role, and situational context — shared when discussing or undertaking an engagement.
• Interview and document content: Notes from interviews and company documents shared during engagements, covered by separate NDA.
• Technical data: IP address, browser type, pages visited — collected automatically via server logs and analytics tools.
• Cookie data: Usage preferences and consent status stored in your browser. See our Cookie Policy.

3. How and Why We Use Your Data

We process personal data on the following legal bases:

• Consent: For marketing communications, if you have opted in. You may withdraw at any time.
• Contract performance: To deliver advisory services you have engaged us for.
• Legitimate interests: To respond to enquiries, maintain records, improve our website, and manage our practice operations.
• Legal obligation: Where required by Malaysian law, including the Personal Data Protection Act 2010 (PDPA).

Specifically, we use your data to respond to enquiries, deliver engagement scope as agreed, maintain client records, send service-related communications, and improve our website experience.

We retain contact data for up to 3 years after your last interaction with us. Engagement materials are retained for 5 years unless you request earlier deletion.

4. Data Protection Measures

We store personal data on encrypted systems with access restricted to those directly working on your engagement. We do not use shared file systems for client documents. All laptops are password-protected and encrypted. Client data is deleted or returned to you at the end of an engagement unless retention is required by law.

In the event of a data breach affecting your personal data, we will notify you and the relevant authority as required under applicable law, promptly and without undue delay.

5. Cookies

Our website uses cookies to function correctly and to understand how it is used. For full details of the cookies we use and your options for managing them, please read our Cookie Policy.

6. Third-Party Data Sharing

We do not sell your personal data. We may share data with:

• Analytics providers (e.g. Google Analytics) — for website usage analysis under anonymisation and data processing agreements.
• Email service providers — for sending responses to enquiries.
• Legal and regulatory authorities — where required by Malaysian law.

We do not share client engagement data with third parties. Any third-party service provider processing personal data on our behalf is required to handle it in accordance with applicable data protection law.

7. Your Rights Under the PDPA (Malaysia)

Under the Personal Data Protection Act 2010 and applicable data protection principles, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request erasure of your data where we have no legal basis to retain it
• Withdraw consent for any processing based on consent
• Object to processing based on legitimate interests
• Lodge a complaint with the Department of Personal Data Protection Malaysia

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

8. Links to External Sites

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites and recommend reading their respective privacy policies before submitting personal data.

9. Children's Privacy

Our services are directed at businesses and business professionals. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, contact us and we will delete it promptly.

10. Changes to This Policy

We may update this policy as our practices evolve or as required by law. Changes will be reflected by an updated "Last Updated" date at the top of this page. Continued use of our website after a material change constitutes acceptance of the revised policy.

11. Contact

For any questions about this policy or to exercise your data rights:

• Email: [email protected]
• Address: Jalan P. Ramlee 17, 50250 Kuala Lumpur, Malaysia
• Phone: +60 3 2148 2967