Privacy Policy

1. Who We Are

The data controller for personal data collected through this website is:

• Business name: Rivermark
• Address: Level 18, Vista Kiara, 5 Jalan Kiara II, Mont Kiara, 50480 Kuala Lumpur, Malaysia
• Email: privacy@{{DOMAIN}}
• Phone: +60 11 2641 8307

2. What Personal Data We Collect

We collect only the personal data necessary to respond to enquiries and deliver our services. This includes:

• Name and contact details (email address, telephone number) submitted via the contact form on this website
• Organisation name and role, where provided
• Message content submitted through the contact form
• Technical data collected automatically when you visit this website (IP address, browser type, pages visited, time on site) via analytics cookies, where consent has been given

We do not collect sensitive personal data (e.g. race, health information, political opinions) and do not process payment information on this website.

3. How We Collect Personal Data

• Directly from you — when you complete and submit the contact form on this website
• Automatically — through cookies and analytics tools, only where you have consented to their use

4. Legal Basis for Processing

Under the PDPA 2010, we process personal data on the following bases:

• Your consent — for marketing communications and analytics cookies
• Legitimate interests — to respond to enquiries submitted through the contact form
• Performance of a contract — to deliver facilitation and advisory services where an engagement has been agreed

5. How We Use Your Personal Data

• To respond to your enquiry and communicate with you about potential engagements
• To deliver agreed services (facilitation, retreat planning, off-site programming)
• To improve this website, based on anonymised analytics data
• To send service-related communications relevant to an active engagement
• To comply with applicable legal obligations

We do not sell, rent, or trade personal data to third parties for marketing purposes.

6. Data Retention

• Enquiry data (contact form submissions not leading to an engagement) is retained for up to 12 months.
• Engagement-related data is retained for up to 3 years from the close of the engagement, for contractual and record-keeping purposes.
• Analytics data is retained in aggregated, anonymised form.

7. Sharing with Third Parties

We may share personal data with trusted service providers who assist us in operating this website or delivering services, including:

• Website hosting and infrastructure providers
• Analytics service providers (e.g. Google Analytics), where you have consented to analytics cookies

All third-party processors are required to handle personal data in accordance with applicable data protection law. We do not share personal data with advertising networks.

8. Data Protection Measures

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include:

• HTTPS encryption for all data transmitted through this website
• Access controls limiting who within Rivermark can access personal data
• Secure disposal of data when retention periods have passed

In the event of a personal data breach that is likely to affect your rights or interests, we will notify you and the relevant supervisory authority as required by law.

9. Cookies

This website uses cookies. Essential cookies are necessary for the website to function and cannot be disabled. Optional cookies (analytics, marketing, preference) require your consent. You can manage your cookie preferences at any time on our Cookie Policy page.

10. Your Rights Under the PDPA 2010

Under the Personal Data Protection Act 2010 (Malaysia), you have the following rights in relation to your personal data:

• Right of access — to request a copy of the personal data we hold about you
• Right of correction — to request correction of inaccurate or incomplete personal data
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time
• Right to limit processing — to request that we stop using your personal data for direct marketing purposes

To exercise any of these rights, contact us at privacy@{{DOMAIN}}. We will respond within 21 days.

If you believe your rights have been infringed, you may lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP).

11. Third-Party Links

This website may contain links to external websites. We are not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policies of any third-party sites you visit.

12. Children's Privacy

Our services are directed at businesses and their employees. We do not knowingly collect personal data from individuals under 18 years of age. If you believe a minor has submitted personal data to us, please contact us at privacy@{{DOMAIN}} and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top. Material changes will be communicated via a notice on this website. Continued use of the website following the update constitutes acceptance of the revised policy.

14. Contact for Privacy Matters