Privacy Policy

Heirloom Path ("we", "us", "our") is a family heritage cataloguing and household records curation service based at 33 Persiaran Stonor, 50450 Kuala Lumpur, Malaysia. We provide organisational and curatorial programmes — we do not interpret, draft, or process legal documents of any kind.

This Privacy Policy governs the collection, use, and safekeeping of personal data you share with us when you visit our website, complete an enquiry form, or participate in any of our programmes. By using our website or services, you acknowledge the practices described here.

For questions about this policy, reach us at [email protected] or by telephone at +60 3 2674 8513.

We collect only the data necessary to respond to your enquiries and deliver our programmes.

Information You Provide

• Contact details: your full name, email address, and telephone number submitted through our enquiry form.
• Correspondence: messages, notes, or questions you send us by email or telephone.
• Programme materials: family information, photographs, and documents that a household voluntarily shares during a session. This data is used solely for the purpose of completing the requested programme and is not stored beyond the programme's conclusion without explicit written consent.

Information Collected Automatically

• Usage data: pages visited, time on page, browser type, and general geographic region (country or city level).
• Device information: operating system, screen resolution, and referral source.
• Cookies: small text files placed on your device as described in Section 5.

Legal Basis for Processing

• Consent: you provide contact details voluntarily.
• Contractual necessity: fulfilment of programme sessions you have engaged us for.
• Legitimate interest: improving our website, responding to enquiries, and maintaining business records.

Retention Periods

Enquiry records are retained for up to 24 months after last contact. Programme session records are retained for the duration of the programme plus 12 months for administrative purposes, after which they are securely deleted unless you request otherwise in writing.

We use personal data strictly for the following purposes:

• Responding to enquiries: contacting you to discuss your interest in our programmes.
• Programme delivery: scheduling and facilitating the sessions you have engaged us for.
• Service communications: sending session confirmations, reminders, or follow-up notes related to your programme.
• Website improvement: analysing aggregated, anonymised usage patterns to improve our content and navigation.
• Legal compliance: meeting obligations under Malaysian law, including the PDPA 2010.

We do not sell, rent, or share your personal data with third parties for marketing purposes. We do not send unsolicited marketing communications without your prior consent.

Analytics Partners

We may use third-party analytics services (such as Google Analytics) to understand aggregate website usage. These services receive anonymised data and are governed by their own privacy policies. We do not pass identifiable personal data to analytics providers.

We take the security of your personal data seriously and apply reasonable technical and organisational safeguards.

• Encryption in transit: our website uses HTTPS. Data submitted through our contact form is transmitted over an encrypted connection.
• Access controls: personal data is accessible only to authorised Heirloom Path personnel who need it to fulfil your programme.
• Physical security: printed materials produced as part of a programme are handled with care and returned to the household at the programme's conclusion.
• Breach notification: in the event of a data breach affecting your personal information, we will notify you and the relevant Malaysian authority (Personal Data Protection Commissioner) within the timeframes required by law.
• Periodic review: we review our data handling practices at least annually.

No method of digital transmission or electronic storage is entirely without risk. While we apply sound practices, we cannot warrant absolute security.

Our website uses cookies — small text files stored in your browser — to support basic functionality and understand aggregate usage patterns.

You can manage cookie preferences at any time on our Cookie Policy page. Disabling non-essential cookies will not affect your ability to browse or contact us.

Under the Personal Data Protection Act 2010 (Malaysia) and applicable principles, you have the following rights regarding your personal data:

• Right to access: request a copy of the personal data we hold about you.
• Right to rectification: ask us to correct inaccurate or incomplete data.
• Right to erasure: request deletion of personal data we hold, subject to any legal retention obligations.
• Right to object: object to processing of your data for purposes beyond service delivery.
• Right to withdraw consent: where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: contact the Personal Data Protection Commissioner Malaysia if you believe your rights have been infringed.

To exercise any of these rights, write to us at [email protected]. We will respond within 21 days.

Our website may contain links to external sites for reference purposes. We are not responsible for the privacy practices of those sites. We encourage you to read the privacy policies of any external site you visit from a link on our pages.

Our website and programmes are intended for adults aged 18 and above. We do not knowingly collect personal data from individuals under 18. If you believe a minor has submitted personal data to us, please contact us at [email protected] and we will delete it promptly.

Family history programmes are organised at the household level by an adult representative; any family information shared as part of a session is handled under the consent and responsibility of that adult representative.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. Continued use of our website or services after any revision constitutes acceptance of the updated policy.

For material changes that affect how we handle personal data you have already provided, we will make reasonable efforts to notify you directly by email.

For all privacy-related queries, corrections, or requests:

If you are not satisfied with our response, you may contact the Personal Data Protection Commissioner Malaysia via the Ministry of Communications and Digital website.