Privacy Policy

01 Data We Collect

When you use our website or submit an enquiry, we may collect the following personal data:

Information you provide directly

• Full name and job title
• Business email address
• Phone number (if provided)
• Name of your institution or organisation
• Content of your message or enquiry

Information collected automatically

• IP address and approximate location (country/city level)
• Browser type and operating system
• Pages visited and time spent on each page
• Referring URL (the page you came from)
• Cookie identifiers (see Section 4)

Legal basis for processing

We process your personal data on the following grounds under PDPA 2010:

• Consent — when you submit our contact form, you consent to us using your data to respond to your enquiry.
• Legitimate interests — website analytics and service improvement, provided these do not override your rights.
• Contractual necessity — when you engage us for advisory services, processing is necessary to fulfil that engagement.

Retention periods

• Enquiry records: up to 24 months from the date of last contact
• Client engagement data: up to 7 years from end of engagement (for regulatory record-keeping)
• Analytics data: aggregated and retained for up to 26 months
• Cookie consent records: 13 months from the date of consent

02 How We Use Your Data

Service delivery and communication

• Responding to your enquiries and scheduling consultations
• Delivering contracted advisory and stewardship services
• Sending service-related correspondence (e.g. engagement letters, briefing notes)

Website improvement

• Understanding which pages are most useful to compliance professionals
• Identifying and correcting technical issues
• Improving the clarity of our service descriptions

Marketing communications

We do not send unsolicited marketing emails. If you have engaged our services and wish to receive occasional updates on regulatory changes or advisory notes, you may opt in by indicating this in your enquiry message. You may withdraw this consent at any time by writing to [email protected].

Data sharing

We do not sell your personal data. We may share limited data with:

• Google Analytics — anonymised usage statistics; no personal identifiers
• Hosting and infrastructure providers — bound by data processing agreements
• Legal or regulatory authorities — only when required by law or court order

Any third party receiving data from us is contractually required to protect it to at least the same standard as this policy.

03 How We Protect Your Data

Technical measures

• All data in transit is encrypted via TLS 1.2 or higher (HTTPS)
• Access to personal data is restricted to authorised personnel on a need-to-know basis
• Our systems are hosted on servers located in Malaysia or within jurisdictions with adequate data protection standards
• Regular vulnerability assessments and access log reviews are conducted

Organisational measures

• Staff with data access receive data handling guidance aligned with PDPA 2010
• Engagement documentation containing client data is stored in access-controlled environments
• Physical documents are stored in locked cabinets and disposed of securely

Breach response

In the event of a personal data breach that is likely to result in harm, we will notify affected individuals and, where applicable, the relevant authority within a reasonable timeframe. We will also document the breach and the steps taken to address it.

04 Cookies and Tracking

We use a small number of cookies to understand how visitors use our site and to remember your preferences. Cookies do not identify you personally unless you have submitted a form.

• Essential cookies — required for basic site functionality; cannot be disabled
• Analytics cookies — help us understand page performance (e.g. Google Analytics)
• Preference cookies — remember your cookie consent choice

You can manage or withdraw cookie consent at any time via our Cookie Policy page, which includes toggle controls for each category.

05 Your Rights Under PDPA

Under the Personal Data Protection Act 2010, you have the following rights with respect to your personal data held by Teguh:

• Right to access — you may request a copy of the personal data we hold about you
• Right to correction — you may ask us to correct inaccurate or incomplete data
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting data processed before withdrawal
• Right to limit processing — you may ask us to stop using your data for certain purposes
• Right to lodge a complaint — you may raise a concern with the Personal Data Protection Commissioner of Malaysia (Department of Personal Data Protection, Ministry of Digital, Malaysia)

To exercise any of these rights, please write to [email protected] with your full name and a description of your request. We will respond within 21 days.

06 Third-Party Links

Our website may include links to external resources — for example, publications by Bank Negara Malaysia, official AMLA guidance, or professional body websites. These external sites have their own privacy policies, which we do not control and are not responsible for. We recommend reviewing the privacy policy of any third-party site you visit.

07 Children's Privacy

Our services are directed at banking compliance professionals and regulated financial institutions. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has submitted personal data through our website, please contact us at [email protected] and we will remove it promptly.

08 Changes to This Policy

We review this policy periodically and may update it to reflect changes in our practices, legal requirements, or regulatory guidance. When we make material changes, we will update the "Last Updated" date at the top of this page. We encourage you to review this policy from time to time. Continued use of our website after a policy update constitutes acceptance of the revised terms.

09 Contact for Data Matters

For all data protection enquiries — including access requests, corrections, or complaints — please contact our data team: