Privacy Policy

1. Introduction

Merbau Labs ("we", "us", "our") is registered in Malaysia and operates from 30 Jalan Bagan Luar, 12000 Butterworth, Pulau Pinang. This policy explains how we collect, use, and protect personal data when you use our website or engage our services.

We are committed to handling personal data in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia. If you have questions about this policy, contact us at [email protected].

2. Data We Collect

We collect the following categories of personal data:

• Contact data: Name, email address, phone number — provided when you complete our contact form or communicate with us.
• Business data: Business name, business address, and operational information you share during a site survey or service engagement.
• Usage data: Pages visited, time spent, browser type — collected automatically through cookies and analytics tools if you have consented.
• Job data: Job notes and operational records provided by clients for the purpose of the job sheet summary service. This data is processed solely to produce summaries and is not retained beyond what is necessary for that purpose.

Legal basis: We process contact and business data on the basis of your consent (where given via the contact form) or legitimate interest (for existing clients). Job data is processed on the basis of contract performance.

3. How We Use Your Data

• Responding to enquiries submitted via the contact form
• Delivering the site survey, job sheet summary service, and care retainer
• Producing monthly retainer reports for active clients
• Sending invoices and service correspondence
• Improving our website through aggregated analytics (with consent only)

We do not sell personal data. We do not use personal data for marketing to third parties. Job data provided by clients is used only to produce the summaries they have engaged us to produce.

4. Data Sharing

We share data only where necessary to deliver our services:

• AI service providers: Job notes are processed through third-party AI APIs to produce summaries. These providers process data on our instructions and do not use it for their own purposes.
• Analytics tools: Aggregated, anonymised usage data may be shared with analytics providers where you have consented to analytics cookies.
• Legal obligations: We may disclose data where required by Malaysian law or a competent authority.

5. Data Retention

• Contact form enquiries: retained for 12 months, then deleted
• Client records: retained for the duration of the engagement plus 5 years (for accounting purposes under Malaysian law)
• Job data: retained only for the period required to produce and deliver summaries, then deleted

6. Data Protection Measures

• Data in transit encrypted via HTTPS/TLS
• Access to client data restricted to team members with a need to access it
• Job data not stored beyond the processing period
• Breach notification procedure in place — affected parties notified within 72 hours of discovery

7. Cookies

Our website uses essential cookies for basic functionality and optional analytics cookies, subject to your consent. See our Cookie Policy for full details on what we use and how to manage your preferences.

8. Your Rights Under PDPA 2010

Under the Personal Data Protection Act 2010 (Malaysia), you have the right to:

• Access personal data we hold about you
• Request correction of inaccurate data
• Withdraw consent to processing (where processing is based on consent)
• Request that we stop using your data for direct marketing purposes

To exercise these rights, contact us at [email protected]. We will respond within 21 days as required under PDPA.

9. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites. We recommend reviewing their policies before providing personal data.

10. Children's Privacy

Our services are directed at business operators and are not intended for persons under 18. We do not knowingly collect data from minors.

11. Changes to This Policy

We may update this policy from time to time. The updated date at the top of this page will reflect any changes. Continued use of our services after a change constitutes acceptance of the updated policy.

12. Contact

For questions about this policy or data-related requests: