Last updated: 10 July 2025
Privacy Policy
Sirih Labs ("we", "us") is committed to handling personal information carefully and in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA). This policy explains what information we collect, why we collect it, and how we use and protect it.
This policy applies to information collected through our website at sirihlab.cyou and through our service engagements. If you have questions, contact us at [email protected].
1. What personal data we collect
We collect personal data in the following ways:
Through our contact form
- Full name (required)
- Email address (required)
- Phone number (optional)
- Message content (optional)
Through service engagements
When you engage us for a service, we may collect additional information necessary to carry out that service — for example, details about your business's data practices for a PDPA Readiness Review, or internal documents you provide for a Knowledge Base Assistant. We handle this information only as necessary and retain it only for the duration of the engagement unless you ask us to keep it.
Through website cookies
Our website uses cookies to understand how it is used. See our Cookie Policy for details.
2. Legal basis for processing
We process personal data on the following bases under PDPA Malaysia:
- Consent: Where you have provided information through our contact form or cookie preferences.
- Contract performance: Where processing is necessary to carry out a service you have engaged us for.
- Legitimate interest: Where we have a reasonable business interest that does not override your privacy rights — for example, keeping records of past engagements for quality assurance.
3. How we use your data
- To respond to enquiries submitted through our contact form
- To deliver services you have engaged us for
- To send engagement-related communications — summaries, progress notes, invoices
- To understand how our website is used (analytics cookies, if consented)
- To comply with applicable law
We do not use your personal information for unsolicited marketing. If you receive a follow-up from us, it will be in direct response to an enquiry or engagement.
4. Data retention
- Contact form submissions: Retained for up to 12 months from the date of submission, or until the enquiry is resolved, whichever comes first.
- Service engagement records: Retained for 3 years from the end of the engagement for quality assurance and financial record purposes.
- Client documents (Knowledge Base Assistant): Copies held during the engagement and deleted within 14 days of the engagement closing, unless you request otherwise.
5. Data protection measures
We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss or disclosure. These include:
- Access controls limiting who can view client information
- Secure handling of documents provided for service engagements
- Deletion of client documents within 14 days of engagement close (unless agreed otherwise)
No transmission method over the internet is completely secure. We cannot guarantee absolute security, but we will notify you without undue delay if a breach affecting your data occurs.
6. Third-party sharing
We do not sell personal data. We may share limited information with:
- Analytics providers (e.g. website analytics), if you have consented to analytics cookies
- Service delivery partners involved in a specific engagement — only with your knowledge and only to the extent necessary
- Legal authorities where required by law
We do not use AI-powered tools that process your personal data without first explaining that in the relevant engagement scope document.
7. Your rights
Under PDPA Malaysia, you have the right to:
- Access personal data we hold about you
- Correct inaccurate personal data
- Withdraw consent for processing based on consent (this will not affect past processing)
- Object to processing in certain circumstances
- Request that data be deleted, subject to our legal obligations
To exercise these rights, write to us at [email protected]. We will respond within 21 days.
If you are not satisfied with our response, you may contact the Department of Personal Data Protection Malaysia (PDPD).
8. Cookies
We use cookies to understand how visitors use our website. For a full explanation of the cookies we use and how to manage them, see our Cookie Policy.
9. External links
Our website may link to external websites. We are not responsible for the privacy practices of those sites and this policy does not apply to them.
10. Children
Our services are directed at businesses and their owners and staff. We do not knowingly collect personal data from individuals under 18. If you believe a minor has submitted data through our website, contact us at [email protected] and we will remove it.
11. Policy changes
We may update this policy from time to time. When we do, we will update the "last updated" date at the top of this page. Continued use of our website or services after changes are posted constitutes acceptance of the updated policy.
12. Contact
Data controller: Sirih Labs
Address: 19 Jalan Hang Kasturi, 75200 Melaka, Malaysia
Email: [email protected]