Privacy Policy

1. Who we are

Millowvale is a family communication support service operating from 44 Lebuh Pantai, 10300 George Town, Pulau Pinang, Malaysia. We provide facilitated sessions and clerical support — we do not offer legal, financial, health, or counselling services.

For privacy enquiries, contact us at [email protected].

2. What personal data we collect

When you contact us or use our services, we may collect:

• Full name and preferred name
• Email address
• Telephone number (where provided)
• Postal address (for programme correspondence)
• The content of messages or enquiries you send us
• Session-related information you share with us during the course of a programme

We collect this data through our website contact form, by telephone, by email, and in the course of in-person sessions.

3. Legal basis and how we use your data

We process personal data on the following bases under PDPA 2010:

• Contract: to respond to your enquiry and deliver the session or programme you have engaged
• Legitimate interest: to maintain records of communications and programme history for operational purposes
• Consent: where you have explicitly agreed to receive updates or information from us

We use personal data to:

• Respond to enquiries and schedule sessions
• Administer programmes and maintain session records
• Send session minutes and programme materials to participants
• Improve the operation and usability of our website
• Meet our legal and regulatory obligations

4. How long we keep your data

Enquiry records are retained for twelve months from the date of the last contact. Programme records (minutes, registers, correspondence) are retained for twenty-four months from the close of the programme, after which they are securely deleted unless you have requested earlier deletion.

All family documents provided to us during a retainer programme are returned or deleted at programme close. Millowvale does not retain copies of family documents after handover.

5. Data sharing

We do not sell or share personal data with third parties for marketing purposes. We may share data in the following limited circumstances:

• With other session participants — only the minute, which is provided to all parties present
• With service providers who support our operations (web hosting, email delivery) under data processing agreements
• Where required by Malaysian law or a lawful order of a competent authority

6. Data security

We maintain appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include:

• Encrypted storage of digital records
• Access controls limiting data access to authorised coordinators
• Secure disposal of physical documents at programme close
• Regular review of data handling practices

In the event of a data breach affecting your personal data, we will notify you as soon as reasonably practicable and in accordance with our obligations under PDPA 2010.

7. Cookies

Our website uses cookies solely for essential functionality (such as remembering your cookie preference). We do not currently use analytics or advertising cookies. For full details, please see our Cookie Policy.

8. Your rights

Under PDPA 2010 and applicable Malaysian data protection law, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your data where we have no continuing legal basis to hold it
• Withdraw consent where processing is based on consent
• Object to processing based on legitimate interest
• Request a copy of your data in a portable format

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days. If you are dissatisfied with our response, you may raise a complaint with the Department of Personal Data Protection Malaysia (JPDP).

9. Third-party links

Our website may contain links to external websites, including the practitioner directories we provide at programme close. We are not responsible for the privacy practices of those sites and encourage you to read their policies separately.

10. Children

Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from persons under 18. If you believe we have received data relating to a minor, please contact us at [email protected] so we can take appropriate action.

11. Changes to this policy

We may update this policy from time to time. When we do, the revised version will be published on this page with an updated date. Continued use of our services after a change constitutes acceptance of the revised policy.