Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

All references to "we", "us", or "our" in this Policy refer to Calderstone Pennant.

2. Personal Data We Collect

We may collect the following categories of personal data:

2.1 Information you provide directly

• Full name and preferred form of address
• Email address and telephone number
• Message or enquiry content submitted via our contact form
• Programme preferences or questions you choose to share

2.2 Information collected automatically

• Browser type, operating system, and device identifiers
• IP address and approximate geographic location
• Pages visited, referral source, and session duration
• Cookie identifiers (see Section 8)

We do not collect sensitive personal data (as defined in the PDPA 2010) unless you voluntarily provide it in your correspondence, in which case we treat it with additional care and use it only to respond to your enquiry.

3. Purposes of Processing

We use your personal data for the following purposes:

• Responding to enquiries you submit through our contact form or by telephone
• Providing programme information and materials to enrolled participants
• Administering enrolment, invoicing, and attendance records
• Sending service-related communications relevant to your programme participation
• Improving our website and educational materials through aggregated analytics
• Complying with legal and regulatory obligations applicable in Malaysia

We will only send promotional or marketing communications if you have explicitly indicated your consent to receive them. You may withdraw this consent at any time by contacting us.

4. Legal Basis for Processing

Under the Personal Data Protection Act 2010 (Act 709), we process personal data on the following grounds:

• Consent — where you have given clear consent, for example by submitting our contact form or accepting cookie categories
• Contractual necessity — to fulfil our obligations to enrolled participants
• Legitimate interests — for website analytics and service improvement, where those interests do not override your rights
• Legal obligation — where processing is necessary to comply with applicable Malaysian law

5. Disclosure of Personal Data

We do not sell, rent, or trade your personal data to third parties. We may share your data in the following limited circumstances:

• Service providers — third-party processors who assist with email delivery, analytics, or payment processing, bound by data processing agreements and restricted from using your data for their own purposes
• Legal requirements — if disclosure is required by Malaysian law, court order, or lawful authority
• Business transfers — in the event of a merger, acquisition, or reorganisation, subject to equivalent data protection commitments

Where third-party processors are engaged, we take reasonable steps to ensure they maintain appropriate technical and organisational measures to protect your data.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by law.

• Enquiry records: up to 12 months from the date of enquiry, unless a programme enrolment follows
• Participant records: up to 7 years following programme completion, for accounting and legal compliance purposes
• Analytics data: aggregated and anonymised within 26 months

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised.

7. Security Measures

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or disclosure. These include:

• HTTPS encryption for all web-based data transmission
• Access controls limiting data to staff with a legitimate need
• Periodic review of security procedures and third-party processors

No method of electronic transmission or storage is entirely without risk. If you have reason to believe your interaction with us is no longer secure, please notify us promptly at the contact details in Section 13.

8. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies. A detailed explanation of the cookies we use, their purposes, and your choices is provided in our Cookie Policy.

When you first visit our website, you will be presented with a cookie consent notice. You may accept all categories, accept essential cookies only, or customise your preferences. You may update your preferences at any time by clearing your browser's local storage or contacting us.

9. Your Rights Under the PDPA 2010

Under the Personal Data Protection Act 2010, you have the following rights in relation to your personal data:

• Right of access — to request a copy of the personal data we hold about you
• Right of correction — to request correction of inaccurate or incomplete data
• Right to withdraw consent — to withdraw consent for processing at any time, without affecting the lawfulness of prior processing
• Right to limit processing — to request that we limit our processing of your data in certain circumstances

To exercise any of these rights, please contact us in writing at the address or email in Section 13. We will respond within 21 days of receiving a valid request. We may ask you to verify your identity before processing the request.

There is no fee for submitting a data access or correction request. If a request is manifestly unfounded or excessive, we reserve the right to charge a reasonable fee or decline.

10. Children

Our programmes and website are intended for adults. We do not knowingly collect personal data from persons under the age of 18. If you believe a minor has submitted personal data to us, please contact us and we will take steps to delete it promptly.

11. Third-Party Links

Our website may contain links to external websites or resources not operated by Calderstone Pennant. This Privacy Policy applies only to our own website and services. We encourage you to review the privacy notices of any third-party sites you visit, as we have no responsibility for their practices.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or operational needs. The revised version will be published on this page with an updated revision date. Where changes are material, we will take reasonable steps to notify you.

Continued use of our website or services after the effective date of a revised Policy constitutes acceptance of the updated terms.

13. Contact Us

For any queries, requests, or complaints relating to this Privacy Policy or our handling of your personal data, please contact us:

If you are not satisfied with our response, you may also lodge a complaint with the Personal Data Protection Commissioner of Malaysia through the Department of Personal Data Protection (www.pdp.gov.my).