Privacy Policy

1. Who We Are

Kithora is a family communication education and information organisation service based at 17, Jalan Gaya, 88000 Kota Kinabalu, Sabah, Malaysia. We are the data controller for personal information collected through this website and through our programmes. For data-related enquiries, contact us at [email protected].

2. What Personal Data We Collect

We may collect the following categories of personal information:

• Contact information: your name, email address, and phone number, provided when you submit our contact form or enquire about a programme.
• Message content: any information you choose to include in your message to us.
• Usage data: technical information about how you use our website, including IP address, browser type, pages visited, and time spent on each page (collected via analytics cookies where consent is given).
• Cookie preferences: your choices regarding cookie consent, stored in your browser's local storage.

We do not collect sensitive personal information (such as health data, financial account details, or identity document numbers) through this website. Any such information shared voluntarily during a session is handled under a separate participant confidentiality agreement.

3. How and Why We Use Your Data

We use personal data for the following purposes:

• Responding to enquiries: to reply to messages submitted through our contact form. Legal basis: legitimate interest.
• Programme delivery: to schedule, confirm, and follow up on session bookings. Legal basis: performance of a contract or pre-contractual steps.
• Website improvement: to understand how visitors use our website and improve its content, using anonymised or aggregated analytics data. Legal basis: consent (where analytics cookies are accepted).
• Legal compliance: to meet our obligations under Malaysian law, including the Personal Data Protection Act 2010 (PDPA). Legal basis: legal obligation.

We do not sell, rent, or trade personal information to third parties. We do not use your data for automated decision-making or profiling.

4. Data Retention

We retain personal data for as long as necessary to fulfil the purpose for which it was collected:

• Contact form submissions: up to 12 months from the date of last contact, unless you become a programme participant.
• Programme participant records: up to 3 years from the final session date, after which records are securely deleted.
• Analytics data: retained in anonymised or aggregated form for up to 26 months.

You may request earlier deletion at any time (see Section 7).

5. Third-Party Services

We may use the following third-party services, each of which has its own privacy policy:

• Google Analytics: used to understand website usage patterns (only where analytics cookies are accepted). Data is processed by Google LLC. See Google's privacy policy at google.com/policies/privacy.
• Google Maps: used to display our location on the homepage via an embedded map. Accessing the map may involve Google collecting data about your visit. See Google's privacy policy for details.
• Email service providers: we use a third-party email platform to manage and store contact form submissions. Data is encrypted in transit.

6. Cookies

Our website uses cookies. For a full explanation of the types of cookies we use, their purpose, and how to manage your preferences, please see our Cookie Policy. Essential cookies are required for the website to function. All other cookies are optional and require your consent.

7. Your Rights Under Malaysian PDPA and General Practice

Under the Personal Data Protection Act 2010 (Malaysia) and in line with general best practice, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Withdraw consent for processing where consent is the legal basis.
• Request deletion of your personal data, subject to legal retention requirements.
• Object to or limit certain processing activities.
• Lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP) if you believe your data has been handled unlawfully.

To exercise any of these rights, please email [email protected]. We will respond within 21 days. We may ask you to verify your identity before processing a request.

8. Data Security

We take reasonable technical and organisational steps to protect personal data against unauthorised access, loss, or disclosure. These include:

• HTTPS encryption for all data in transit on this website.
• Access controls limiting who within Kithora can access personal data.
• Secure storage of participant records in password-protected systems.
• Regular review of our data handling practices.

In the event of a personal data breach that is likely to affect your rights, we will notify you without undue delay and take steps to mitigate the impact.

9. Third-Party Links

Our website may contain links to external websites, including those of professional services we recommend. We are not responsible for the privacy practices of those websites. We encourage you to review their privacy policies before providing any personal information.

10. Children's Privacy

Our website is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors through this website. If you believe a minor has provided us with personal data, please contact us at [email protected] and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. We encourage you to check this page periodically. Continued use of the website after changes are posted constitutes your acceptance of the revised policy.

12. Contact Us

For any privacy-related questions, requests, or concerns:

• Email: [email protected]
• Address: Kithora, 17, Jalan Gaya, 88000 Kota Kinabalu, Sabah, Malaysia
• Phone: +60 88 246 907