Privacy Policy

1. About This Notice

This Privacy Policy applies to Kasturi, an advisory practice registered in Malaysia and operating from Lot 4-15, KL Sentral, Jalan Stesen Sentral, 50470 Kuala Lumpur. It covers personal data we collect when you contact us, engage our services, or visit our website at luxetailoringch.com.

We handle personal data in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia. If you have questions about this notice or wish to exercise your rights, please write to us at [email protected].

2. Personal Data We Collect

We collect only what is needed to respond to your enquiry or deliver the engagement you have requested. This may include:

• Identification data — your name, job title, and the organisation you represent.
• Contact data — your business email address and phone number.
• Engagement data — information you share when describing your audit team's needs, work-paper templates, or policy library, in the course of scoping an engagement.
• Website usage data — pages visited, time on page, and browser type, collected through analytics tools described in Section 6.

We do not collect sensitive personal data as defined under the PDPA, such as health records, financial account numbers, or biometric identifiers, as part of our ordinary advisory practice.

3. How We Use Your Personal Data

We use the personal data we hold to:

• Respond to your enquiry and scope a suitable engagement.
• Prepare and deliver written advisory reports, briefing notes, and related deliverables.
• Send you engagement updates or follow-up correspondence relevant to your matter.
• Comply with legal obligations, including record-keeping requirements.
• Improve the quality of our advisory services through aggregated, non-identifiable analysis.

We do not use your personal data for unsolicited marketing, and we do not sell or license your data to third parties.

4. Legal Basis for Processing

Under the PDPA, we process personal data where:

• You have given your consent, for example by submitting an enquiry form or entering into a written engagement agreement.
• Processing is necessary to perform services you have requested.
• We are required to do so by law or a regulatory obligation.

Where we rely on consent, you may withdraw it at any time by contacting us at [email protected]. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

5. How We Share Your Personal Data

Kasturi does not share your personal data with external parties except in the following circumstances:

• Service providers — we may share limited data with trusted technology or hosting providers who process it strictly on our behalf and under written agreements.
• Legal requirements — we may disclose data where required by a court order, regulatory authority, or applicable Malaysian law.
• Engagement delivery — where your engagement involves review of materials from your organisation, those materials remain within a contained, read-only environment and are not shared beyond the agreed advisory team.

6. Analytics and Cookies

Our website uses analytics tools to understand how visitors use the site. These tools may set cookies or similar tracking technologies on your device. You may manage your cookie preferences through the banner presented on your first visit, or at any time via our Cookie Policy.

We use Google Analytics, Meta Pixel, and Microsoft Clarity for website performance measurement. Data collected by these tools is pseudonymised where possible and governed by the respective providers' privacy practices.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law. Engagement records, including written reports and correspondence, are typically retained for seven years in accordance with standard professional practice and applicable regulatory guidance in Malaysia.

Website enquiry data that does not lead to an engagement is reviewed and deleted after twelve months.

8. Security Measures

We apply reasonable technical and organisational measures to protect personal data from unauthorised access, loss, or alteration. Engagement materials shared with us are handled within contained, access-controlled environments. Our advisory team operates under written confidentiality obligations.

9. Your Rights Under the PDPA

Under the Personal Data Protection Act 2010, you have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate or incomplete personal data.
• Withdraw consent to processing, subject to applicable legal or contractual obligations.
• Request that we cease processing your data for direct marketing purposes.

To exercise any of these rights, please contact us in writing at [email protected] or by post to our registered address. We will respond within the timeframe required under the PDPA.

10. Third-Party Websites

Our website may contain links to third-party resources or references to external standards bodies such as the Institute of Internal Auditors. We are not responsible for the privacy practices of those sites and encourage you to review their notices separately.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The date at the top of this page indicates when the policy was last reviewed. Continued use of our website or services following an update constitutes acknowledgment of the revised notice.

12. Contact Us

If you have questions about this notice or about how we handle your personal data, please reach us through the following:

• Email: [email protected]
• Phone: +60 14 528 9613
• Address: Lot 4-15, KL Sentral, Jalan Stesen Sentral, 50470 Kuala Lumpur, Malaysia