Privacy Policy

1. Introduction

Brackish & Co ("we", "our", "the practice") is committed to handling personal data responsibly and transparently. This policy describes what data we collect, why we collect it, how it is used, and what rights you have in relation to it.

This policy applies to personal data collected through our website at brackishs.pro, through our contact form, and in the course of our consulting engagements. It is governed by the Personal Data Protection Act 2010 (Malaysia) (PDPA).

Questions about this policy may be directed to [email protected].

2. Data We Collect

We collect personal data only when it is relevant to providing our services or responding to enquiries. The categories we may collect include:

• Contact information: name, email address, and phone number when submitted through our contact form.
• Engagement data: information shared with us in the course of a consulting engagement — interview notes, internal documents, and organisational information provided by the client.
• Website usage data: analytics data collected by third-party tools (see Section 5) about how visitors use our website, including pages visited and time spent.
• Communication data: the content of emails and messages exchanged with us.

Legal basis for processing

We process personal data on the following bases under the PDPA:

• Consent — where you have submitted a form or agreed to cookie use.
• Contract performance — to deliver services you have engaged us for.
• Legitimate interests — to respond to enquiries and improve our services.

Retention periods

Contact form data is retained for up to 24 months. Engagement data is retained for 36 months after the engagement concludes, after which it is deleted or returned to the client on request. Analytics data is retained subject to the third-party service's own retention policies.

3. How We Use Your Data

We use personal data for the following purposes:

• Responding to enquiries received through the contact form.
• Delivering consulting engagements that have been agreed in writing.
• Sending administrative communications related to an ongoing engagement.
• Improving our website and understanding how it is used.
• Complying with applicable legal obligations.

We do not send marketing communications without prior consent. We do not sell, rent, or trade personal data to third parties. We do not share engagement data with any party outside the engagement without written permission from the client.

4. How We Protect Your Data

• Data is stored on password-protected systems with access limited to the principal consultant and one operations associate.
• Communications containing personal data are sent over encrypted channels.
• Engagement documents are not stored on shared cloud services accessible to third parties.
• In the event of a data breach that affects your personal data, we will notify you within 72 hours of becoming aware of it.

5. Cookies

Our website uses cookies for essential functionality and, where you have consented, for analytics. Cookie categories include:

• Essential cookies: required for the site to function; cannot be disabled.
• Analytics cookies: used to understand site usage; only set with your consent.

For full details and to manage your preferences, see our Cookie Policy.

6. Your Rights

Under the PDPA and applicable data protection principles, you have the following rights in relation to your personal data:

• Access: you may request a copy of the personal data we hold about you.
• Rectification: you may ask us to correct inaccurate data.
• Erasure: you may request deletion of your personal data where there is no overriding legal basis for retaining it.
• Withdrawal of consent: where processing is based on consent, you may withdraw it at any time without affecting prior processing.
• Objection: you may object to processing based on legitimate interests.

To exercise any of these rights, write to [email protected]. We will respond within 21 days. If you believe your rights have not been respected, you may lodge a complaint with the Department of Personal Data Protection Malaysia (PDPD), which is the relevant supervisory authority.

7. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites and recommend reviewing their policies directly before submitting any personal information.

8. Children's Privacy

Our services are intended for individuals aged 18 and over. We do not knowingly collect personal data from minors. If you believe a minor has submitted data through our website, please contact us and we will delete it promptly.

9. Policy Updates

We may update this policy from time to time. Changes will be posted on this page with a revised effective date. Continued use of our website or services after changes are posted constitutes acceptance of the updated policy.

10. Contact

Data controller: Brackish & Co, Jalan Hang Lekiu 9, 50100 Kuala Lumpur, Malaysia.

Privacy enquiries: [email protected]