Legal

Privacy Policy

Last updated: 10 July 2025

Cairnstone ("we", "us", "our") is committed to handling personal information responsibly. This policy explains what personal data we collect, why we collect it, how we use it, and what rights you have in relation to it. It applies to information collected through this website and through the delivery of our services in Malaysia.

1. Who We Are

Cairnstone is a records management practice based in Alor Setar, Kedah, Malaysia. We provide document location registers, educational workshops and records compilation services for private households and community organisations. Our office address is 3 Jalan Sultan Badlishah, 05000 Alor Setar, Kedah, Malaysia.

For data-related enquiries, contact us at: [email protected]

2. Data We Collect

Information you give us

• Name and contact details (telephone number, email address) when you submit an enquiry form or contact us by phone or email.
• Information about your family's situation that you choose to share during an initial enquiry or in the course of a service session.

Information collected automatically

• Website usage data through analytics cookies (pages visited, time on site, general location by region), subject to your cookie preferences.
• Technical data such as browser type and device type, collected for website operation and security purposes.

What we do not collect

Cairnstone does not copy, retain or store any documents belonging to household members during service sessions. The content of household documents is not recorded by us at any stage.

3. Legal Basis for Processing

We process personal data under the Malaysian Personal Data Protection Act 2010 (PDPA). Our legal bases are:

• Consent — for marketing communications and non-essential cookies, where you have opted in.
• Contractual necessity — to respond to enquiries and deliver the services you have requested.
• Legitimate interests — to operate and improve this website, and to maintain records necessary for the normal running of the practice.

4. How We Use Your Data

• To respond to your enquiry and arrange a service session.
• To communicate with you in the course of delivering a service.
• To maintain session records and correspondence for as long as the work requires.
• To understand how this website is used and to improve it.
• To comply with legal obligations, including record-keeping under Malaysian law.

We do not use your data for automated decision-making or profiling.

5. Data Retention

• Enquiry data where no service is engaged: deleted within 90 days of last contact.
• Service session notes and correspondence: retained for two years after sign-off, then securely deleted.
• Financial records: retained for seven years as required under Malaysian tax legislation.
• Website analytics data: retained for 26 months in aggregated form.

6. Sharing Your Data

We do not sell personal data. We may share data with:

• Service providers — web hosting, email and analytics providers acting on our instructions under written agreements.
• Legal or regulatory bodies — where disclosure is required by Malaysian law or a court order.

We do not transfer personal data outside Malaysia except where a service provider's infrastructure requires it, in which case appropriate safeguards are in place.

7. Data Protection Measures

• Website connections use HTTPS encryption.
• Access to contact records is limited to staff who need it to deliver or administer a service.
• Physical session notes are stored in a locked cabinet and destroyed by cross-cut shredding after the retention period.
• In the event of a data breach affecting your personal information, we will notify you and the relevant authority as required under the PDPA.

8. Cookies

This website uses cookies for basic operation and, with your consent, for analytics. Essential cookies cannot be disabled as they are necessary for the website to function. You can manage optional cookie preferences at any time. For full details, see our Cookie Policy.

9. Your Rights

Under the Personal Data Protection Act 2010 and related regulations, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Withdraw consent for any processing based on consent, without affecting prior processing.
• Request deletion of your data where we have no continuing legal basis to retain it.
• Object to processing carried out on the basis of legitimate interests.
• Lodge a complaint with the Personal Data Protection Commissioner of Malaysia if you believe your data has been handled improperly.

To exercise any of these rights, contact us at [email protected]. We aim to respond within 21 days.

10. Third-Party Links

This website may contain links to external websites. We are not responsible for the privacy practices of those sites and recommend that you read their privacy policies before providing any personal information.

11. Children

Our services are directed at adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If you believe a minor has submitted personal information to us, please contact us so we can delete it.

12. Changes to This Policy

We may update this policy from time to time. The date at the top of this page will reflect the most recent revision. Where changes are material, we will notify active clients by email. Continued use of the website after a policy update constitutes acceptance of the revised terms.

13. Contact

For any questions about this policy or about how we handle your data:

• Email: [email protected]
• Post: Cairnstone, 3 Jalan Sultan Badlishah, 05000 Alor Setar, Kedah, Malaysia
• Telephone: +60 4 733 5192