Privacy Policy

1. Introduction

Penna Vale ("we", "our", "us") is an advisory practice based at Level 5, Menara Zurich, 12 Jalan Dewan Bahasa, 50460 Kuala Lumpur, Malaysia. We provide procurement and vendor management advisory services to organisations across Malaysia.

This Privacy Policy applies to information collected through our website at pennay.blog and through our normal business activities. By using our website or enquiring about our services, you acknowledge that you have read and understood this policy.

Our data handling practices are guided by Malaysia's Personal Data Protection Act 2010 (PDPA) and its associated regulations.

2. Data We Collect

We collect personal information in the following ways:

• Contact enquiries: When you fill in the contact form on our website, we collect your name, email address, phone number (if provided), and the message you send.
• Email correspondence: When you communicate with us by email, we retain those messages as part of our records.
• Service delivery: During an advisory engagement, we may collect additional business information such as your organisation name, role, and relevant procurement data you share with us for the purpose of delivering the service.
• Website analytics: We use standard web analytics tools to understand how visitors use our website. This may include anonymised data such as pages visited, browser type, and time spent on site.
• Cookies: Our website uses cookies. Please see Section 5 below for details.

We do not collect sensitive personal data (such as health or financial account information) through our website.

Retention: Contact enquiry data is held for up to 24 months. Engagement-related data is held for up to 5 years, in line with standard business record-keeping practice.

3. How We Use Your Data

We use the information we collect for the following purposes:

• Responding to enquiries and service requests
• Delivering the advisory services you have engaged us for
• Sending administrative communications related to your engagement
• Improving our website and understanding how it is used
• Keeping business records as required under Malaysian law
• Contacting you about services that may be relevant to you, if you have given consent

We do not sell your personal data to third parties. We do not use your data for automated decision-making.

Legal basis for processing: Processing is carried out on the basis of your consent (for contact enquiries and marketing), performance of a contract (for advisory engagements), and our legitimate interests in maintaining business records and improving our services.

Third-party processors: We may use reputable third-party service providers (such as email and analytics platforms) to help us operate our business. These providers are bound by appropriate data processing agreements and may only process your data on our instructions.

4. How We Protect Your Data

We take reasonable and appropriate steps to safeguard the personal information we hold:

• Data shared with us via our website is transmitted over encrypted (HTTPS) connections.
• Access to personal data within our organisation is limited to those who need it to carry out their work.
• We review our data practices periodically and update them where necessary.
• In the event of a data breach that affects your rights or interests, we will notify you and the relevant authority as required under Malaysian law.

No method of data transmission or storage is completely without risk. While we do our best to protect your information, we cannot give an absolute assurance of security.

5. Cookies

Our website uses cookies — small text files stored on your device — to help the site function and to understand how it is being used. We use the following types of cookies:

• Essential cookies: Required for basic site functions. These cannot be turned off.
• Analytics cookies: Help us understand which pages are visited and how visitors move through the site. These are collected in aggregated, non-identifying form.
• Marketing cookies: May be used to show relevant content or measure the effectiveness of our online presence.

You can manage your cookie preferences at any time by visiting our Cookie Policy page, which includes a preferences panel. You may also manage cookies through your browser settings.

6. Your Rights

Under the Personal Data Protection Act 2010 (Malaysia), you have the following rights in relation to the personal data we hold about you:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to correction: You may ask us to correct inaccurate or incomplete data.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time. This will not affect processing carried out before withdrawal.
• Right to limit processing: In certain circumstances, you may ask us to restrict how we use your data.
• Right to make a complaint: If you are not satisfied with how we handle your data, you may contact the Department of Personal Data Protection Malaysia (JPDP) at www.pdp.gov.my.

To exercise any of these rights, please write to us at [email protected]. We will respond within 21 days of receipt.

7. Third-Party Links

Our website may contain links to external websites. We have no control over the content or data practices of those sites and are not responsible for their privacy policies. We encourage you to review the privacy policy of any external site you visit.

8. Children

Our services are intended for business professionals and organisations. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has submitted personal information to us, please contact us at [email protected] and we will remove it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically. Continued use of our website after any changes constitutes acceptance of the updated policy.

10. Contact Us About Privacy

If you have questions about this policy or about how we handle your personal data, please contact us:

• Email: [email protected]
• Post: Penna Vale, Level 5, Menara Zurich, 12 Jalan Dewan Bahasa, 50460 Kuala Lumpur, Malaysia
• Phone: +60 3-2143 7860