Privacy Policy

1. Who We Are

Thornmark is an educational organisation based in Kuala Lumpur, Malaysia, providing structured consumer financial awareness programmes. We are the data controller for personal data collected through our website and programme administration processes.

Address: 53 Jalan Tun Sambanthan, 50470 Kuala Lumpur, Malaysia
Email: [email protected]
Phone: +60 3 2274 6195

2. Data We Collect

We collect the following personal data when you interact with us:

• Contact enquiries: Name, email address, phone number (optional), and any message content submitted through our contact form.
• Programme enrolment: Name, email address, phone number, and organisation name (if applicable).
• Website usage: Analytics data such as pages visited, session duration, and browser type, collected through cookies where consent has been given.

We do not collect sensitive personal data (such as financial account information, health data, or identity document numbers) through our website or forms.

3. Legal Basis for Processing

Under Malaysia's Personal Data Protection Act 2010 (PDPA), we process personal data on the following grounds:

• Consent: For marketing communications and analytics cookies, where you have provided consent.
• Contractual necessity: For programme administration and communication related to a programme you have enrolled in.
• Legitimate interests: For responding to enquiries and improving our website and services.

4. How We Use Your Data

• Responding to enquiries submitted through our contact form
• Administering programme enrolments, scheduling, and follow-up
• Sending programme-related information where you have enrolled
• Sending occasional updates about new programme intakes, where you have consented
• Improving our website experience through anonymised analytics
• Maintaining records as required under applicable Malaysian law

We do not use personal data for automated profiling or decision-making.

5. Data Sharing

We do not sell, rent, or trade personal data. We may share data with:

• Service providers: Such as email delivery services and website hosting providers, who process data on our behalf under data processing agreements.
• Legal authorities: Where required to do so by applicable Malaysian law or a lawful court order.

Any third-party service providers we engage are required to maintain appropriate data security standards.

6. Data Retention

• Enquiry data: retained for 12 months from last contact unless a programme relationship continues
• Programme participant records: retained for 3 years following programme completion for administrative purposes
• Analytics data: retained in anonymised form for up to 26 months
• Marketing consent records: retained until consent is withdrawn

7. Data Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse. These include:

• Encrypted data transmission (HTTPS) on our website
• Access controls limiting data to authorised staff
• Regular review of data handling practices
• In the event of a data breach, we will notify affected individuals as required under the Personal Data Protection Act 2010.

8. Cookies

Our website uses cookies. Essential cookies are required for basic site functionality. Analytics and preference cookies are used only with your consent. For full details, including how to manage your cookie preferences, see our Cookie Policy.

9. Your Rights Under Malaysian PDPA

You have the following rights in relation to your personal data:

• Access: You may request a copy of the personal data we hold about you.
• Correction: You may request correction of inaccurate data.
• Withdrawal of consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing.
• Complaint: You may lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP) at www.pdp.gov.my.

To exercise these rights, contact us at [email protected]. We will respond within 21 days.

10. Third-Party Links

Our website may contain links to external websites, including official government bodies such as BNMLINK and PDRM. We are not responsible for the privacy practices of those sites. We encourage you to review their respective privacy policies.

11. Children's Privacy

Our programmes are designed for adults and our website is not directed at persons under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has submitted data through our site, please contact us and we will delete it promptly.

12. Policy Updates

We may update this policy from time to time. The "Last Updated" date at the top of this page will reflect any changes. Continued use of our website following an update constitutes acceptance of the revised policy. For material changes, we will provide a prominent notice on our website.