Privacy Policy

Mendways ("we", "us", "our") is committed to handling your personal information responsibly and in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia. This Policy explains what information we collect, how we use it, and your rights in relation to it.

Questions about this Policy may be directed to [email protected].

1. What Personal Data We Collect

We collect personal information in the following contexts:

• Contact enquiries: Name, email address, phone number, and any information you include in your message when you contact us via our website form or by telephone.
• Intake calls: Information shared during the intake conversation, including the nature of the family situation and the names and relationships of participants. This is noted by the facilitator and used to prepare for the session.
• Session notes and summaries: Written records of what was discussed and agreed during facilitated sessions. These are shared only with participating family members.
• Website usage: Technical data including IP address, browser type, pages visited, and cookies (see Section 5 below).

2. How We Use Personal Data

We use the information we collect to:

• Respond to enquiries and schedule intake calls
• Prepare for and conduct facilitation sessions
• Produce and distribute written session summaries and follow-up notes to participants
• Maintain records of completed engagements for a reasonable period
• Improve our website and services based on usage patterns
• Comply with legal requirements

We do not use your personal data for marketing communications. We do not sell your data to third parties.

3. Legal Basis for Processing

We process personal data on the following bases:

• Contractual necessity: To deliver the facilitation services you have engaged us for.
• Legitimate interests: To operate and improve our services in a way that does not override your rights.
• Legal obligation: Where required by Malaysian law.
• Consent: For optional data uses such as analytics cookies, where consent is requested.

4. Data Retention

We retain personal information for as long as is necessary for the purposes described in this Policy:

• Contact enquiries not resulting in a session: up to 6 months
• Session records and summaries: up to 5 years from the date of the last session
• Billing records: up to 7 years in compliance with Malaysian financial record-keeping requirements
• Website analytics data: up to 26 months (where analytics are in use)

5. Cookies

Our website uses cookies to function correctly and to understand how visitors use our pages. Essential cookies are required for the site to work. Optional cookies (analytics, preference) are used only with your consent. Please see our Cookie Policy for full details.

6. Data Sharing

We do not sell personal data. We share personal information only in the following limited circumstances:

• Session participants: Written summaries and follow-up notes are shared only with the family members who participated in the session.
• Service providers: We may use trusted third-party services for hosting and website analytics. These providers are bound by data processing agreements and do not use your data for their own purposes.
• Legal requirement: Where disclosure is required by Malaysian law or a competent authority.

7. Data Security

We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, or disclosure. These include:

• Encrypted transmission of data via HTTPS
• Access controls limiting who within our team can access personal information
• Secure storage of session notes and documentation
• Regular review of data handling practices

In the event of a data breach that is likely to affect your rights, we will notify you and the relevant authority in accordance with applicable law.

8. Your Rights

Under the PDPA 2010 and applicable Malaysian law, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Withdraw consent for optional data uses at any time
• Request deletion of your personal data (subject to retention requirements)
• Object to processing based on legitimate interests

To exercise any of these rights, please write to us at [email protected]. We will respond within 21 days.

9. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites and recommend reviewing their privacy policies before providing personal information.

10. Children's Privacy

Our services are directed at adult participants (aged 18 and above). We do not knowingly collect personal information from persons under 18 without the consent of a parent or guardian. If you believe we have inadvertently collected such information, please contact us immediately.

11. Changes to This Policy

We may update this Policy from time to time. The updated version will be published on this page with a revised "Last Updated" date. Where changes are material, we will notify existing clients by email.

12. Contact

Data Controller: Mendways
Suite 8-2, Jalan Tun Abdul Razak, 80000 Johor Bahru, Johor, Malaysia
Email: [email protected]
Telephone: +60 7-225 7136