Privacy Policy

1. Introduction

Nurtura ("we", "us", "our") is committed to handling personal information responsibly and transparently. This policy explains what data we collect, how we use it, and what rights you have in relation to it.

This policy applies to information collected through our website at nurtura.cyou, through our contact form, and in the course of delivering our services. It is written under Malaysian law, including the Personal Data Protection Act 2010 (PDPA).

If you have questions about this policy or about how we handle your data, contact us at [email protected].

2. Data We Collect

We collect the following types of personal data:

• Contact information: Name, email address, and phone number submitted through our contact form.
• Service delivery data: Information shared during appointments — document categories, locations, and items noted as missing or requiring replacement. This is organisational information only; no document content is recorded.
• Cookie data: Basic preference data stored locally in your browser. See Section 5 for details.
• Technical data: IP address, browser type, and pages visited, collected through website analytics if analytics cookies are accepted.

Legal basis: We process contact and enquiry data on the basis of legitimate interest in responding to your enquiry, and on the basis of contract performance when you have booked a service. Analytics data is processed on the basis of your consent.

Retention: Contact and enquiry records are kept for 24 months from last contact. Service delivery records are kept for 36 months from the end of service engagement, or until you request deletion.

3. How We Use Personal Data

• Responding to enquiries submitted through the contact form
• Booking and delivering Nurtura services
• Sending service-related communications (appointment confirmations, output delivery)
• Improving the website using aggregated, anonymised analytics data
• Complying with our legal and regulatory obligations under Malaysian law

We do not sell personal data to third parties. We do not use personal data for automated decision-making. We do not send marketing communications unless you have separately requested them.

4. Data Protection Measures

We take reasonable steps to protect personal data from unauthorised access, loss, or disclosure. These include:

• HTTPS encryption for all data transmitted through our website
• Access to client records restricted to staff involved in service delivery
• Service delivery data held on secured systems with restricted access
• Physical records held in locked storage where applicable

In the event of a data breach that poses a risk to your rights, we will notify you and, where required, the relevant authority, without undue delay.

5. Cookies

Our website uses cookies to store your cookie consent preference in your browser. We may also use analytics cookies if you have given consent. No cookies are used without your knowledge, and you may withdraw consent at any time through the Cookie Policy page.

For full details on the cookies we use, please see our Cookie Policy.

6. Your Rights

Under the Malaysian Personal Data Protection Act 2010 and applicable data protection principles, you have the following rights in relation to personal data we hold about you:

• Access: You may request a copy of the personal data we hold about you.
• Correction: You may request that inaccurate or incomplete data be corrected.
• Erasure: You may request deletion of personal data we hold about you, subject to any legal obligation to retain it.
• Withdrawal of consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that has already occurred.
• Objection to processing: You may object to processing based on legitimate interest.

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days. If you are not satisfied with our response, you may contact the Department of Personal Data Protection Malaysia.

7. Third-Party Links

Our website may contain links to external sites — for example, to government offices or professional associations mentioned in referral notes. We are not responsible for the privacy practices of those sites and recommend you read their privacy policies before sharing personal information with them.

8. Children's Privacy

Our services are contracted by adults on behalf of households. We do not knowingly collect personal data directly from individuals under the age of 18. Where a child's document information is recorded as part of a household index, it is handled under the instructions of the adult booking the service.

9. Changes to This Policy

We may update this policy from time to time. When we do, we will update the date at the top of the page. We recommend checking this page periodically. Continued use of our services following a policy update constitutes acceptance of the revised policy.