Legal — Data Handling
Privacy Policy
Provenance holds a single, clear commitment: the personal details a household entrusts to us when enquiring about our records curation or heritage cataloguing programme are used only to respond to that enquiry and to carry out the agreed sessions. This policy records exactly what we collect, how long we hold it, and what rights each individual retains.
Last updated: 19 April 2025 | Version 1.0 | Governing jurisdiction: Malaysia (PDPA 2010)
1. Data We Collect
When a household contacts us through the enquiry form on this site, we receive the following details:
- Full name — to address correspondence correctly.
- Email address — primary channel for scheduling and session notes.
- Phone number (optional) — if a household chooses to include it for easier coordination.
- Message content — the notes or questions a household includes in their initial enquiry.
We do not collect sensitive personal data (national identification numbers, financial account details, or health records) through this site. During sessions, we assist households in noting the location and custodians of their own documents — we do not retain copies of those documents.
Legal basis (PDPA 2010): Processing is carried out with the consent of the data subject at the time of enquiry submission and, where a programme is subsequently engaged, on the basis of contractual necessity.
2. How We Use Personal Data
Contact details submitted through this site are used solely for the following purposes:
- Responding to enquiries about our records inventory and heritage cataloguing sessions.
- Scheduling and confirming session appointments.
- Sending session notes or follow-up correspondences directly related to an active programme.
- Issuing invoices or receipts where a programme has been formally engaged.
We do not use submitted contact details for unsolicited marketing. If a household enquires but does not proceed to engage a programme, the submitted details are held only long enough to close the correspondence thread and are then deleted per the retention schedule below.
3. Retention Periods
| Data Type | Retention Period | Reason |
|---|---|---|
| Enquiry correspondence (no programme engaged) | 90 days | Close of correspondence thread |
| Programme client contact details | 3 years from last session | Continuity for follow-up programmes |
| Invoice and payment records | 7 years | Malaysian Companies Act / tax compliance |
| Website analytics (aggregated, non-personal) | 13 months | Standard analytics rolling window |
4. Protection Measures
We apply the following measures to keep personal data secure:
In Transit
This site is served over HTTPS. Data submitted through the enquiry form is transmitted over an encrypted connection.
At Rest
Enquiry records are held in password-protected email and document systems accessible only to Provenance staff.
Access Control
Access to personal data is limited to team members with a direct operational need in the context of an enquiry or active programme.
Breach Response
In the event of a data breach, Provenance will notify affected individuals and, where required, the relevant authority under PDPA 2010, within a reasonable timeframe.
7. Your Rights
Under the Personal Data Protection Act 2010 (Malaysia), individuals whose data we hold may exercise the following rights by writing to [email protected]:
Right to Access
Request a copy of the personal data we hold about you.
Right to Correction
Ask us to correct inaccurate or incomplete personal data.
Right to Withdraw Consent
Withdraw consent for processing at any time. This does not affect the lawfulness of processing prior to withdrawal.
Right to Erasure
Request deletion of your data, subject to any legal retention obligation (e.g. financial records).
Right to Object
Object to processing where it is not strictly necessary for carrying out the programme you engaged.
Supervisory Authority
Lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP) if you believe your rights have not been respected.
We will respond to data rights requests within 21 days. Where a request is complex, we may extend this by a further 21 days and will notify you accordingly.
8. External Links
This site may contain links to third-party resources for reference. Provenance is not responsible for the privacy practices of those external sites. We recommend reviewing the privacy policy of any external site before submitting personal information to it.
9. Minors
Our records and heritage cataloguing sessions are engaged by households, represented by an adult (18 years or older) who acts as the primary contact and data subject. We do not knowingly collect personal data from individuals under 18. If you believe personal data relating to a minor has been submitted through this site, please contact us at [email protected] so we may review and delete it promptly.
10. Policy Updates
This policy may be revised from time to time to reflect changes in our practice or applicable law. When material changes are made, the Last Updated date at the top of this page will be revised. Where a change materially affects the rights of existing programme clients, we will notify them directly by email. Continued use of the site following any update constitutes acceptance of the revised policy.
11. Contact for Data Enquiries
For any question or request relating to this policy or to the personal data we hold, please write to:
Data Controller
Provenance
27 Lorong Universiti A
11700 Gelugor, Penang
Malaysia
Contact Channels
- [email protected]
- +60 4 6529 8374
- Mon–Fri, 9:00 am – 5:30 pm MYT