Privacy Policy

1. Our Commitment to Privacy

Meranti Porch takes your privacy seriously. As a citizen assistance centre, we handle personal information only to the extent needed to deliver the service you have requested. We do not sell, rent, or trade personal data with third parties for marketing purposes.

This policy is written in plain language because we believe you have a right to understand how your information is handled without needing to be a lawyer to read it. If anything is unclear, please contact us at [email protected].

2. What Data We Collect

We collect only what is necessary for the service you engage with:

• Contact form submissions: Name, email address, phone number (optional), and message content.
• In-person visits: We may take brief session notes with your verbal consent. We do not photocopy or retain copies of documents you bring to a session unless you explicitly ask us to.
• Workshop and toolkit engagements: Organisation name, contact person name, email, and phone number for scheduling and follow-up purposes.
• Website usage data: Standard server logs including IP address, browser type, pages viewed, and visit timestamps. Collected automatically when you visit our website.
• Cookies: See our Cookie Policy for details.

Legal basis: We process personal data on the basis of your consent (where you have submitted a form or agreed to cookies), performance of a service agreement, or our legitimate interest in operating a safe and functional website and service delivery process. We operate in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA).

3. How We Use Your Data

• Responding to enquiries submitted through our contact form.
• Scheduling and delivering the service you have booked (drop-in passes, workshop series, toolkit engagements).
• Sending post-session follow-up messages as part of the drop-in pass service.
• Sending payment confirmations and receipts.
• Improving our services based on anonymised feedback data.
• Complying with legal obligations under Malaysian law.

We do not use your data for unsolicited marketing communications unless you have specifically opted in. We do not share personal data with third-party advertisers.

4. How We Protect Your Data

We take reasonable technical and organisational measures to keep your data secure, including:

• HTTPS encryption for all data transmitted through our website.
• Restricted access to personal data — only team members who need it for service delivery can access it.
• Session notes and contact records are stored securely and not accessible to unauthorised parties.

Data retention: Contact form data and session notes are retained for up to 12 months and then deleted unless there is an ongoing service relationship. Payment records are retained for 7 years as required under Malaysian financial record-keeping rules.

5. Cookies

Our website uses cookies to maintain basic functionality (session management) and, with your consent, analytics. We do not use cookies for advertising. See our Cookie Policy for full details and preference controls.

6. Third-Party Services

We may use the following third-party services in connection with our website and operations:

• Google Analytics (if enabled): Anonymised website traffic analysis. No personally identifiable data is sent to Google Analytics.
• Payment processing: Payments via FPX or DuitNow are processed through our banking partner. We do not store card or payment credentials.
• Email service provider: Used to send booking confirmations and follow-up messages. Email addresses are not used for any other purpose.

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and recommend you read their policies separately.

7. Your Rights

Under Malaysia's Personal Data Protection Act 2010, you have the following rights regarding your personal data:

• Right of access: You may request a copy of the personal data we hold about you.
• Right of correction: You may request that inaccurate data be corrected.
• Right to withdraw consent: Where we rely on your consent to process data, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to limit processing: You may ask us to restrict how we use your data in certain circumstances.

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days. If you have a concern about how your data has been handled, you may contact the Department of Personal Data Protection Malaysia (PDPD).

8. Children's Privacy

Our services are intended for adults aged 18 and above. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has provided us with personal information, please contact us and we will delete it promptly.

9. Changes to This Policy

We may update this policy from time to time. The "Last Updated" date at the top of the page will reflect any changes. Where changes are material, we will post a notice on our website. Continued use of our website or services after a policy update constitutes acceptance of the revised terms.

10. Contact for Data Enquiries

For any questions, corrections, or requests relating to your personal data: