Privacy Policy

1. Introduction

Obsidia ("we", "us", "our") is an advisory practice registered and operating in Kuala Lumpur, Malaysia. We provide franchise development advisory services to business owners. This Privacy Policy explains how we collect, use, store, and protect personal data submitted through our website at obsidia.blog and through our engagement processes.

Our data practices are guided by Malaysia's Personal Data Protection Act 2010 (PDPA). If you have questions about this policy, contact us at [email protected].

2. Data We Collect

2.1 Information You Provide

When you submit the contact form on our website or enter into an engagement, we may collect: your full name, email address, phone number, and the content of your message or enquiry. For engagement clients, we may also collect business name, address, and relevant operational information.

2.2 Automatically Collected Data

When you visit our website, we may automatically collect browser type, IP address, pages visited, and time spent on pages. This is collected through cookies and analytics tools. See our Cookie Policy for details.

2.3 Legal Basis for Processing

• Consent — when you submit a contact form or agree to communications
• Legitimate interest — to respond to enquiries and manage our business
• Contract performance — when processing data as part of a service engagement

2.4 Data Retention

Enquiry data is retained for up to 12 months. Engagement records are retained for up to 7 years in accordance with Malaysian business record requirements. You may request deletion of your data at any time (subject to legal obligations).

3. How We Use Your Data

We use personal data to respond to your enquiries and provide advisory services, manage the engagement relationship, send relevant updates about your engagement (no unsolicited marketing), improve our website through aggregated analytics, and comply with legal obligations under Malaysian law.

We do not sell personal data to third parties. We do not use your data for automated decision-making or profiling.

4. Data Sharing

We may share data with: service providers operating on our behalf (website hosting, email delivery) under data processing agreements; and when required by Malaysian law or a valid court order.

We do not transfer personal data outside of Malaysia without ensuring appropriate safeguards are in place.

5. Data Protection Measures

We implement reasonable technical and organisational measures to protect personal data from unauthorised access, loss, or misuse. These include encrypted data transmission (HTTPS), restricted access to client records, and regular review of our data handling practices.

In the event of a data breach that is likely to affect your rights, we will notify you and the relevant authorities as required under Malaysian PDPA.

6. Cookies

Our website uses cookies to support basic functionality and, with your consent, to collect analytics data. You can manage cookie preferences through the consent banner on our website or through your browser settings. For full details, see our Cookie Policy.

7. Your Rights

Under Malaysia's Personal Data Protection Act 2010, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete personal data
• Request deletion of your personal data (subject to legal obligations)
• Withdraw consent where processing is based on consent
• Object to processing in certain circumstances
• Lodge a complaint with Malaysia's Department of Personal Data Protection

To exercise your rights, contact us at [email protected]. We will respond within 21 days.

8. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and encourage you to review their policies independently.

9. Children's Privacy

Our services are directed at business owners and are not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, contact us and we will promptly delete it.

10. Policy Updates

We may update this policy from time to time. Material changes will be noted on our website with an updated effective date. Continued use of our website after changes constitutes acceptance of the revised policy.

11. Contact

For privacy-related enquiries or to exercise your rights: