Privacy Policy

1. Introduction

Merantau ("we", "us", "our") is committed to handling personal data responsibly and in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA). This Privacy Policy explains what personal data we collect, how we use it, and your rights in relation to it.

This policy applies to personal data collected through our website at merant.pro and through our advisory programme engagements. If you have any questions about this policy, you can reach us at [email protected].

2. Data We Collect

We collect personal data in the following ways:

• Contact form submissions: name, email address, phone number (optional), and message content
• Engagement-related communications: business contact details provided during advisory programmes
• Website analytics: page views, device type, approximate location, and interaction data — via analytics cookies where consent has been given

We do not collect sensitive personal data such as identity documents, financial account details, or biometric data through our website.

3. How We Use Your Data

Personal data submitted through our website is used to:

• Respond to enquiries and provide information about our programmes
• Coordinate engagement scheduling, site visits, and programme delivery
• Send relevant programme-related communications
• Improve our website based on aggregated analytics data

We do not use personal data for unsolicited marketing communications. We do not sell, rent, or share personal data with third parties for marketing purposes.

4. Legal Basis for Processing

We process personal data under the following bases:

• Consent: where you have submitted a contact form or agreed to analytics cookies
• Legitimate interest: responding to business enquiries and delivering advisory services
• Contractual necessity: where a programme agreement exists between Merantau and your organisation

5. Data Retention

Contact form enquiries are retained for up to 24 months from the date of submission. Engagement-related correspondence and documents are retained for up to 5 years following the close of an engagement, in accordance with standard business record-keeping requirements under Malaysian law. Analytics data is retained in aggregate form only and does not link to individual users.

6. Data Protection Measures

We take reasonable technical and organisational measures to protect personal data, including:

• Encrypted transmission of form data over HTTPS
• Access to personal data limited to staff directly involved in client engagement
• No storage of personal data on shared or publicly accessible systems
• Regular review of access controls

In the event of a data breach that poses a risk to individuals, we will notify affected parties and the relevant authority as required under the PDPA.

7. Cookies

Our website uses cookies. Essential cookies are required for the site to function. Analytics and preference cookies are set only with your consent. For full details, see our Cookie Policy.

8. Third-Party Services

We may use third-party services that process data on our behalf, including web hosting, analytics (such as Google Analytics), and email services. These services are bound by their own privacy policies and data processing agreements. We do not permit third-party service providers to use personal data for purposes beyond the services they provide to us.

9. Third-Party Links

Our website may include links to external websites. We are not responsible for the privacy practices of those sites. We recommend reviewing their privacy policies before submitting any personal data.

10. Children's Privacy

Our services are directed at businesses and professional individuals. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware that we have collected data from a minor, we will delete it promptly.

11. Your Rights Under the PDPA

Under Malaysia's Personal Data Protection Act 2010, you have the right to:

• Access personal data we hold about you
• Request correction of inaccurate personal data
• Request deletion of personal data where retention is no longer justified
• Withdraw consent to processing at any time, without affecting the lawfulness of prior processing
• Limit or object to certain types of processing

To exercise any of these rights, contact us at [email protected]. We will respond within 21 working days. We may need to verify your identity before processing a request.

12. International Data Transfers

Personal data collected through our website is stored and processed within Malaysia. Where we use third-party services based outside Malaysia, we ensure appropriate safeguards are in place in line with the PDPA's requirements for cross-border data transfer.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised "Last Updated" date. We encourage you to review this policy periodically. Continued use of our website after changes are posted constitutes acceptance of the revised policy.

14. Contact

For questions about this policy or to exercise your data rights:

• Email: [email protected]
• Address: Lot 5, Jalan Perindustrian Bukit Minyak, Kawasan Perindustrian, 14100 Simpang Ampat, Penang, Malaysia
• Phone: +60 4-5018 7263