Privacy Policy

1. Data controller

Kinstone operates from 45 Jalan Tebrau, 80300 Johor Bahru, Johor, Malaysia. We are the data controller for personal data collected through our website, enquiry forms, and session administration. Contact: [email protected].

2. What we collect

We collect only what is needed to arrange and deliver sessions and to respond to enquiries:

• Name and preferred contact method (email or phone)
• Email address and/or phone number
• A brief description of your enquiry or situation (if provided)
• Session attendance records (date, format, session type)
• Technical data via cookies (see section 5 and our Cookie Policy)

We do not collect information about the content of your documents, your financial situation, family relationships, or any other personal circumstances beyond what is needed to book and confirm a session.

3. How we use your data

• To respond to your enquiry and arrange sessions
• To send session confirmations and follow-up notes
• To maintain internal records of sessions delivered
• To improve our services based on aggregated, non-identifying patterns

We do not use your data for marketing without explicit consent. We do not sell, rent, or share your data with third parties for commercial purposes.

4. Legal basis for processing

Under Malaysia's Personal Data Protection Act 2010 (PDPA), we process your data on the following bases:

• Consent — when you submit an enquiry form or contact us directly
• Contractual necessity — to arrange and deliver the session you have booked
• Legitimate interests — for internal record-keeping and service improvement

5. Cookies

We use essential cookies to remember your cookie consent preference. Optional analytics and preference cookies are used only with your consent. Full details are in our Cookie Policy.

6. Data retention

Enquiry records are kept for 12 months unless a session is booked, in which case session records are retained for 3 years for administrative purposes. Anonymised aggregate data (e.g. total sessions delivered per month) is kept indefinitely. You may request deletion at any time.

7. Third-party services

We may use the following third-party services, each with their own privacy policies:

• Email delivery service (for session confirmations)
• Google Analytics (if enabled — with your cookie consent)
• Video conferencing platform for online sessions (Zoom or equivalent)

We do not share personal data with these services beyond what is needed for the stated purpose.

8. Data protection measures

• Enquiry data is stored on password-protected systems
• Access is limited to Kinstone staff who need it to arrange sessions
• Online forms are transmitted over encrypted HTTPS connections
• We review our data practices annually

9. Your rights

Under Malaysia's PDPA, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data (subject to our retention obligations)
• Withdraw consent at any time (without affecting prior processing)
• Object to processing for particular purposes

To exercise any of these rights, write to [email protected]. We will respond within 14 working days.

10. Third-party links

Our website may link to external sites. We are not responsible for the privacy practices of those sites and recommend reviewing their policies before providing personal data.

11. Children

Our services are directed at adults (18 and over). We do not knowingly collect personal data from individuals under 18. If you believe we hold data about a minor, contact us at [email protected].

12. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of the page reflects when it was last revised. Continued use of the website after a change constitutes acceptance of the updated policy.

13. Contact

Kinstone
45 Jalan Tebrau, 80300 Johor Bahru, Johor, Malaysia
[email protected]