Privacy Policy

1. Introduction

Norvane ("we", "us", "our") is committed to handling personal information with care and transparency. This Privacy Policy describes how we collect, use, store and protect personal data provided through our website and during advisory engagements. It applies to all visitors to this website and to clients who engage our services.

Our services are advisory in nature and are directed to business owners and representatives. This website and our services are not directed at individuals under the age of 18.

Questions about this policy should be directed to: [email protected]

2. Data We Collect

We may collect the following categories of personal data:

• Contact information: Full name, email address, phone number submitted via our contact form or during engagement setup.
• Business information: Company name, role, business sector and operational details shared during advisory engagements.
• Website usage data: Pages visited, time on site and browser type collected via analytics tools, where consent has been obtained.
• Communications: Emails, messages and notes exchanged during the course of an engagement.

Data is collected through our website contact form, direct email correspondence and in-engagement documentation processes.

3. Legal Basis for Processing

We process personal data on the following legal bases under the Personal Data Protection Act 2010 (Malaysia) and applicable data protection principles:

• Consent: Where you have provided explicit consent, such as through the contact form or acceptance of optional cookies.
• Contract performance: Where processing is necessary to carry out advisory services you have engaged us for.
• Legitimate interests: For reasonable business purposes such as responding to enquiries and maintaining records, where these do not override your rights.

4. How We Use Your Data

Personal data collected is used for the following purposes:

• Responding to enquiries and consultation requests submitted through the website.
• Carrying out advisory engagements and delivering agreed outputs.
• Maintaining engagement records and working documentation during retainer periods.
• Sending service-related communications (meeting notes, deliverable drafts, follow-ups).
• Improving the website and understanding how it is used, where analytics consent has been given.
• Meeting any applicable legal obligations.

We do not use your personal data for direct marketing without your explicit consent. We do not sell, rent or share personal data with third parties for their own marketing purposes.

5. Data Sharing

We do not share personal data with third parties except in the following circumstances:

• Service providers: We may use trusted third-party tools (such as email and document platforms) to deliver services. These providers process data only as necessary for the service they provide.
• Legal specialists: Where an engagement requires involvement of legal professionals (referred by us to the client), we do not transfer your personal data to those professionals without your knowledge and agreement.
• Legal requirements: Where disclosure is required by applicable Malaysian law or regulatory authority.

6. Data Retention

We retain personal data for as long as is necessary for the purposes described above:

• Enquiry records: up to 12 months from last contact if no engagement was entered into.
• Engagement records: up to 5 years after completion, for business record and compliance purposes.
• Analytics data (where applicable): in accordance with the settings of the analytics platform used, typically 14–26 months.

After the applicable retention period, personal data is deleted or anonymised.

7. Data Protection Measures

We implement reasonable technical and organisational measures to protect personal data against unauthorised access, loss or disclosure, including:

• Encrypted email and file transfer for sensitive engagement materials.
• Access controls limiting who within Norvane can access client information.
• Password-protected document storage for engagement files.

In the event of a data breach that poses a risk to individuals, we will notify affected parties and the relevant authority in accordance with applicable law as promptly as practicable.

8. Cookies

Our website uses cookies to support basic functionality and, with your consent, to collect analytics data. Cookie categories, their purposes and how to manage them are described in our Cookie Policy. You can adjust cookie preferences at any time through the Cookie Policy page.

9. Your Rights

Under the Personal Data Protection Act 2010 (Malaysia), you have the following rights regarding your personal data:

• Access: Request a copy of personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of personal data in certain circumstances.
• Objection: Object to processing based on legitimate interests.
• Withdrawal of consent: Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days. If you are not satisfied with our response, you may contact the Personal Data Protection Department of Malaysia (JPDP) at www.pdp.gov.my.

10. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those websites and encourage you to review their privacy policies before providing any personal information.

11. Children's Privacy

Our services are directed at business owners and their representatives, and are not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that data has been submitted by a minor, we will delete it promptly.

12. Updates to This Policy

We may update this Privacy Policy from time to time. Material changes will be indicated by a revised "Last Updated" date at the top of this page. Where changes significantly affect how we use your personal data, we will make reasonable efforts to notify you directly.

13. Contact

Data Controller: Norvane
Address: Level 5, Menara Symphony, Jalan Prof. Khoo Kay Kim, 46050 Petaling Jaya, Selangor
Email: [email protected]
Phone: +60 12-873 6049