Privacy Policy

1. Introduction

Cresthollow is committed to handling personal information with care and transparency. This policy explains what information we collect when you use our website or engage with our services, how we use it, and what rights you have in relation to it.

This policy applies to all personal data processed by Cresthollow in connection with our website at cresthollow.live and our archival and editorial services. If you have questions, contact us at [email protected].

2. Data Controller

The data controller for all personal data processed under this policy is:

• Cresthollow
• 9 Jalan Ipoh, 51200 Kuala Lumpur, Malaysia
• Email: [email protected]
• Telephone: +60 14-625 9803

3. What Data We Collect

3.1 Information You Provide

• Contact form: name, email address, and telephone number if provided; message content.
• Engagement correspondence: information you share in the course of discussing or conducting a service engagement (e.g. household materials, names of family members, addresses, dates).

3.2 Information Collected Automatically

• Cookies and similar technologies — see our Cookie Policy for details.
• Basic web server logs (IP address, browser type, pages visited) for security and operational purposes.

3.3 Information We Do Not Collect

We do not collect payment card data, government identity numbers, or sensitive personal data beyond what is strictly necessary to conduct the engagement you have requested.

4. How We Use Your Data

We use personal data for the following purposes:

• Service delivery: to conduct the archival and editorial engagement you have commissioned — the legal basis is the performance of a contract.
• Enquiry response: to respond to questions submitted via our contact form — the legal basis is our legitimate interest in managing client communications.
• Website operation: to maintain and improve our website — the legal basis is our legitimate interest.
• Legal compliance: where required by applicable law, including Malaysia's Personal Data Protection Act 2010 (PDPA).

We do not use personal data for marketing profiling, automated decision-making, or any purpose unrelated to the engagement or enquiry you initiated.

5. Data Sharing

We do not sell, rent, or share personal data with third parties for their own marketing or commercial purposes. Data may be shared in the following limited circumstances:

• Print suppliers: a name and delivery address may be shared with our print supplier solely to dispatch your printed copies. No other personal data is shared.
• Legal requirement: where we are required to disclose information by law or regulatory authority.
• Service providers: web hosting and email service providers who process data on our behalf under appropriate data processing agreements.

6. Data Retention

We retain personal data for the following periods:

• Engagement records: retained for three years from the completion of the engagement, then deleted.
• Contact enquiries: retained for twelve months, then deleted if no engagement proceeds.
• Web server logs: retained for ninety days, then deleted.
• Household material (physical or digital) supplied during an engagement: deleted or returned within thirty days of final delivery.

7. Data Protection Measures

We take reasonable steps to protect personal data against unauthorised access, disclosure, or loss, including:

• Encrypted storage of digital files on local systems with restricted access.
• Access to engagement materials limited to the team members working on that engagement.
• Secure disposal of physical documents no longer required.
• Prompt notification if a data breach occurs that may affect your rights, in accordance with the PDPA.

8. Cookies

Our website uses cookies to store your cookie consent preference and to support basic website function. We do not use cookies for advertising or behavioural tracking. See our full Cookie Policy for details.

9. Your Rights

Under Malaysia's Personal Data Protection Act 2010, you have the following rights in relation to your personal data:

• Right of access: to request a copy of the personal data we hold about you.
• Right of correction: to request correction of inaccurate or incomplete data.
• Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time.
• Right to object: to object to processing based on legitimate interest, where your interests override ours.
• Right to limit use: to request that we limit the use of your data in certain circumstances.

To exercise any of these rights, contact us at [email protected]. We will respond within thirty days. If you believe your rights have not been respected, you may lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP).

10. Third-Party Links

Our website may contain links to external websites, including our print suppliers or professional associations. We are not responsible for the privacy practices of those sites. We encourage you to review their privacy policies before providing any personal data.

11. Children's Privacy

Our services are directed at adults. We do not knowingly collect personal data from persons under the age of 18. If you believe we have inadvertently collected such data, please contact us at [email protected] so that we may delete it.

12. Policy Updates

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Material changes will be communicated via a notice on our website. Continued use of our website or services after an update constitutes acceptance of the revised policy.