Privacy Policy

1. Introduction

Legacara ("we", "our", "us") is committed to handling the personal data of individuals who engage with our website and household heritage cataloguing services in a manner that is transparent, proportionate, and consistent with applicable Malaysian data protection law — principally the Personal Data Protection Act 2010 (PDPA 2010).

This policy applies to information collected through our website and through the enquiry and programme engagement process. Questions about this policy may be directed to [email protected].

2. Data We Collect

We collect personal data in the following situations:

• Contact form submissions: name, email address, and telephone number (where provided), along with the content of any message submitted.
• Programme correspondence: written exchanges before, during, and after sessions — names, addresses, and scheduling information.
• Analytics: browser type, approximate location, and pages visited — collected through anonymised analytics tools where cookie consent is given.
• Session-related information: household address and scheduling details provided for the purpose of arranging in-home sessions.

We do not collect, copy, or retain copies of any documents, photographs, or objects encountered during a session unless explicitly and separately consented to in writing.

Legal basis for processing

• Contact form data: consent (Article 5 PDPA 2010 — with your voluntary submission)
• Programme correspondence: performance of a contract (or pre-contractual steps)
• Analytics cookies: consent (via cookie banner)

Retention periods

Contact enquiry data is retained for 12 months from the date of last contact if no programme is undertaken. Programme correspondence and scheduling information is retained for 36 months following the conclusion of a programme. Analytics data is retained by the analytics processor per their standard policies.

3. How We Use Your Data

• Responding to enquiries submitted via the contact form
• Arranging and confirming in-home session schedules
• Sending session confirmation, follow-up notes, and programme documentation
• Improving our website and understanding how visitors use it (analytics, with consent only)
• Maintaining records required by applicable law

We do not sell personal data to third parties. We do not use personal data for automated decision-making. We will not send marketing communications without separate consent.

Third-party processors

We may share data with third-party service providers who process it on our behalf — such as website hosting and analytics providers. These processors are bound by data processing agreements consistent with PDPA 2010 requirements.

4. Data Protection Measures

• Website communications are transmitted over HTTPS (TLS encryption)
• Internal correspondence and programme records are stored in access-controlled systems
• Access to personal data is restricted to staff with a direct need to process it
• In the event of a data breach, affected individuals will be notified without undue delay as required by applicable law

5. Cookies

Our website uses cookies to function correctly and, with your consent, to collect analytics data. Essential cookies are necessary for the site to operate. Optional analytics and preference cookies are only activated after you accept via the cookie banner.

For full details of the cookies we use and how to manage your preferences, see our Cookie Policy.

6. Your Rights

Under the Personal Data Protection Act 2010 (Malaysia) and applicable data protection principles, you have the following rights in relation to personal data we hold about you:

• Right to access: to request a copy of the personal data we hold about you.
• Right to correction: to request correction of inaccurate or incomplete data.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing prior to withdrawal.
• Right to object: to object to processing for direct marketing at any time.
• Right to erasure: to request that we delete personal data we hold, subject to applicable legal retention obligations.

To exercise any of these rights, write to [email protected]. We will respond within 21 days. If you are not satisfied with our response, you may raise a complaint with the Personal Data Protection Department of Malaysia (PDPD).

7. Third-Party Links

Our website may contain links to external sites. Legacara is not responsible for the privacy practices of third-party websites and we encourage you to review their policies independently.

8. Children's Privacy

Our services are directed at adults (18 years of age and over). We do not knowingly collect personal data from persons under 18 without the consent of a parent or guardian. If we become aware that such data has been submitted, we will delete it promptly.

9. Policy Updates

We may update this Privacy Policy from time to time. When we do, the "Last updated" date at the top of this page will be revised. We encourage you to review this page periodically. Continued use of our services after an update constitutes acceptance of the revised policy.

10. Contact

For any questions about this Privacy Policy or to exercise your data rights:

Legacara
8 Jalan Cangkat Stulang, 80300 Johor Bahru, Johor, Malaysia
Email: [email protected]
Telephone: +60 7 293 56184