Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

2. Personal Data We Collect

We collect personal data only where necessary for the purposes described in this policy. The categories of data we may collect include:

• Contact information: Full name, email address, and telephone number provided when you submit an enquiry form on our website.
• Enquiry content: Any message or question you submit via our contact form.
• Programme enrolment data: Name and contact details provided when registering for a session or course.
• Technical data: IP address, browser type, pages visited, and session duration, collected automatically through standard web server logs and analytics tools.
• Cookie data: Preferences stored in your browser. See our Cookie Policy for details.

Legal Basis for Processing

• Consent: For marketing communications and non-essential cookies, where you have given explicit consent.
• Legitimate interests: For responding to enquiries, managing programme attendance, and improving our services.
• Contractual necessity: For processing enrolments and delivering agreed programme services.
• Legal obligation: Where required to comply with applicable Malaysian law.

Data Retention

• Enquiry data: retained for up to 12 months from the date of submission, unless enrolment follows.
• Programme enrolment records: retained for up to 3 years for administrative purposes.
• Technical and analytics data: retained for up to 26 months in aggregated or anonymised form.

3. How We Use Your Personal Data

We use the personal data we collect for the following purposes:

• Responding to enquiries submitted through our contact form
• Processing programme enrolments and communicating session details
• Sending administrative communications related to programmes you have enrolled in
• Improving the content and usability of our website through anonymised analytics
• Complying with our legal obligations under Malaysian law

We do not use your personal data for automated decision-making or profiling. We do not sell, rent, or otherwise transfer your personal data to financial institutions, lenders, or product providers.

Third-Party Data Sharing

We may share data with the following categories of third parties where necessary:

• Service providers: Hosting, email delivery, and analytics providers operating under contractual data processing agreements.
• Legal or regulatory authorities: Where disclosure is required by applicable law or court order.

4. Data Security and Protection

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include:

• HTTPS encryption for all data transmitted through our website
• Access controls limiting who within Nilam can view personal data
• Use of reputable, security-compliant hosting infrastructure
• Regular review of data access and storage practices

In the event of a personal data breach that is likely to result in risk to your rights, we will notify you and, where required, the relevant supervisory authority, within the timeframes prescribed by applicable law.

5. Cookies

Our website uses cookies to support basic functionality, remember your preferences, and collect anonymised analytics data. You can manage your cookie preferences at any time. For full details, please read our Cookie Policy.

6. Your Rights

Under the Personal Data Protection Act 2010 (Malaysia) and applicable data protection principles, you have the following rights with respect to your personal data:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to correction: You may request that inaccurate or incomplete data be corrected.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of prior processing.
• Right to limit processing: You may request that we restrict the use of your data in certain circumstances.
• Right to erasure: Subject to legal obligations, you may request that we delete your personal data.
• Right to complain: You have the right to lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP) if you believe your data has been handled unlawfully.

To exercise any of these rights, please contact us at [email protected]. We aim to respond within 21 days.

7. Third-Party Links

Our website may contain links to external websites. These links are provided for convenience only. We are not responsible for the privacy practices or content of any third-party site. We encourage you to review the privacy policies of any external site you visit.

8. Children's Privacy

Our programmes and website are intended for adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If we become aware that personal data from a minor has been submitted, we will delete it promptly.

9. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The updated version will be published on this page with a revised "Last Updated" date. We encourage you to review this page periodically. Continued use of our website after an update constitutes acceptance of the revised policy.

10. Contact for Privacy Enquiries

If you have any questions about this policy or about how we handle your personal data, please contact us: