Privacy Policy

1. Introduction

Vessalyn ("we", "us", "our") is committed to protecting the personal data of individuals who contact us, engage our services, or visit this website. This Privacy Policy describes how we collect, use, and protect your personal data in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA 2010).

This policy applies to all services offered by Vessalyn, including the Co-Parenting Logistics Toolkit, Family Records Consolidation, and Community Support Circle Programme. If you have any questions, contact us at [email protected].

2. Data we collect and how we collect it

We collect personal data through the following means:

• Contact and enquiry form on our website: name, email address, phone number (optional), and message content.
• Service engagement: name, contact details, and — for the Records Consolidation service — details of documents presented at appointments (for the purpose of creating a file inventory only).
• Community Programme: names and contact details of volunteer facilitators and the organising group's representative.
• Website cookies: see Section 6 and our Cookie Policy.

Legal basis for processing: We process personal data on the basis of consent (where you provide it via our contact form or cookie consent) and legitimate interest (responding to enquiries, administering service engagements). For service delivery, processing is necessary for the performance of a contract.

Retention: Enquiry data is retained for 12 months. Service engagement records are retained for 3 years after the engagement closes, after which they are securely deleted. Document contents scanned during the Records Consolidation service are not retained after the encrypted archive is delivered to you.

3. How we use your data

• To respond to enquiries sent via our contact form
• To administer, schedule, and deliver the service you have engaged
• To contact you regarding session logistics and follow-up
• To comply with any legal obligations applicable to our operations in Malaysia

We do not use your personal data for marketing without your explicit consent. We do not sell personal data to third parties. We do not share your data with third parties except where necessary to deliver the service (for example, if a shared digital calendar platform is used in the Co-Parenting Toolkit, we will discuss this with you before setup).

4. Data protection measures

• Personal data is stored on password-protected systems with access limited to Vessalyn staff involved in the relevant engagement.
• Document archives produced for clients use AES-256 encryption. The encryption password is set by the client and not held by Vessalyn.
• Paper records, where used temporarily during appointments, are stored in locked filing at our Kuala Lumpur office and destroyed after the relevant session.
• In the event of a data breach that may affect your rights, we will notify you without undue delay and in accordance with applicable law.

5. Third-party services

Our website uses standard third-party tools including analytics and font services. These may set cookies on your device. Please see our Cookie Policy for details. We are not responsible for the privacy practices of third-party websites linked from our pages.

6. Cookies

This website uses cookies for basic functionality and analytics. You can manage your cookie preferences at any time via our Cookie Policy page. Essential cookies cannot be disabled without affecting website functionality.

7. Your rights under PDPA 2010

Under Malaysia's Personal Data Protection Act 2010, you have the right to:

• Access personal data we hold about you
• Correct inaccurate personal data
• Withdraw consent for data processing where consent was the basis
• Request deletion of personal data we hold (subject to legal retention requirements)
• Object to processing in certain circumstances
• Lodge a complaint with the Personal Data Protection Department (JPDP) of Malaysia if you believe your rights have been violated

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days.

8. Children's privacy

Our services are directed at adults (18 years and over). We do not knowingly collect personal data from individuals under 18. In the context of the Co-Parenting Logistics Toolkit, documents relating to children may be referenced in the shared calendar or handover checklist. These documents are not retained by Vessalyn after the engagement.

9. Changes to this policy

We may update this Privacy Policy from time to time. The current version will always be available on this page with a "Last Updated" date at the top. Continued use of our website or services following a policy update constitutes acceptance of the revised policy.

10. Contact us

Data Controller: Vessalyn
15 Jalan Bukit Bintang, 55100 Kuala Lumpur, Malaysia
Email: [email protected]
Phone: +60 3 9082 4671

For complaints regarding data processing, you may contact the Personal Data Protection Department (JPDP) of Malaysia at pdp.gov.my.