Privacy Policy

1. Introduction

Mawar ("we", "us", "our") takes the privacy of individuals seriously. This policy explains how we collect, use, store, and protect personal data in the course of operating our home companionship and household coordination programmes. It applies to information collected through our website, contact forms, phone enquiries, and the delivery of our services.

This policy is governed by Malaysia's Personal Data Protection Act 2010 (PDPA). If you have questions, contact us at [email protected].

2. What Data We Collect

We collect only what is necessary to operate our programmes:

• Name, email address, and phone number submitted via our contact form
• Name and contact details of the older adult receiving support (provided by family)
• Home address for the purpose of scheduling visits and outings
• Household preferences and relevant personal context shared voluntarily by the family
• Brief visit notes recorded by companions and coordinators
• Website usage data collected via cookies (see Section 5)

3. How and Why We Use Your Data

Personal data is used for the following purposes:

• Responding to enquiries and arranging programme consultations
• Delivering, scheduling, and coordinating the programme you have selected
• Sending written updates and monthly summaries to designated family contacts
• Issuing monthly invoices and processing payments
• Maintaining programme records accessible to authorised family contacts
• Improving our website and service delivery

Legal bases: consent (website enquiries and cookies), contract (programme delivery), and legitimate interest (service improvement and fraud prevention).

4. Data Retention

Enquiry data not converted to a programme is retained for 12 months, then securely deleted. Programme records are kept for 3 years after the last active service date to support continuity and invoicing. Accounting records are retained for 7 years as required by Malaysian law.

5. Cookies

Our website uses cookies to maintain basic functionality (essential) and, with your consent, to understand visitor behaviour (analytics). We do not use advertising cookies. Full details are in our Cookie Policy.

6. Data Sharing

We do not sell personal data. We share data only:

• With family contacts designated by the enquirer (programme updates)
• With service providers strictly necessary for operations (e.g. secure email hosting)
• When required by Malaysian law or a lawful authority

All third-party service providers are contractually required to handle data securely and not use it for any other purpose.

7. Security

We apply reasonable technical and organisational measures to protect personal data: access controls, encrypted data transmission (HTTPS), password-protected records systems, and regular internal reviews. In the event of a data breach that is likely to cause harm, we will notify affected individuals promptly.

8. Your Rights Under PDPA 2010

Under Malaysia's Personal Data Protection Act 2010, you have the right to:

• Request access to personal data we hold about you
• Request correction of inaccurate or incomplete data
• Withdraw consent to data processing (subject to contractual obligations)
• Request that we cease processing your data for direct marketing purposes

To exercise these rights, contact us at [email protected]. We will respond within 21 days.

9. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites. Please review their policies independently before sharing personal data with them.

10. Children's Privacy

Our services are directed at families and individuals aged 18 and over. We do not knowingly collect personal data from persons under 18. If you believe we have inadvertently done so, please contact us so we can delete it promptly.

11. Changes to This Policy

If we make significant changes to this policy, we will update the "Last Updated" date at the top and, where appropriate, notify active programme families by email. Continued use of our website or services after changes take effect constitutes acceptance of the updated policy.