Privacy Policy

1. Introduction

Steadyway ("the studio", "we", "us") operates from Suite 7, Wisma Sabah, Jalan Tun Razak, 88000 Kota Kinabalu, Sabah. This policy explains how we collect, handle, and protect personal information that participants and enquirers share with us through our website, contact form, and programme enrolment processes.

We take the privacy of everyone who contacts or enrols with Steadyway seriously. This document sets out our obligations and your rights under Malaysia's Personal Data Protection Act 2010 (PDPA) and, where applicable, the principles of fair data handling observed internationally.

If you have questions about how your data is handled, write to us at [email protected].

2. Personal Data We Collect

We collect only what is reasonably needed to respond to enquiries, administer programme enrolments, and improve the website experience.

2.1 Data you provide directly

• Name and preferred contact name
• Email address
• Phone number (optional — only if provided)
• Message content submitted via the contact form
• Programme enquiry details you include in correspondence

2.2 Data collected automatically

• Browser type, device type, and operating system
• Pages visited and approximate time of visit
• Referring website or search query (if applicable)
• Anonymised IP address

2.3 Legal basis for processing

Under the PDPA 2010, we process personal data with your consent (given when you submit a contact form or enquiry) and on the basis of legitimate interest where we need to respond to or administer a request you have made. We do not process sensitive personal data as defined under the Act.

2.4 How long we keep your data

Enquiry records are kept for up to 24 months from the date of last contact. Enrolment records for completed programmes are retained for up to 5 years for administrative purposes, after which they are securely deleted. You may request earlier deletion at any time (see Section 6).

3. How We Use Your Data

Personal data is used for the following purposes only:

• Responding to enquiries — to answer questions and provide the information you requested.
• Programme administration — to confirm enrolments, share session dates, and supply printed materials.
• Studio communications — to send updates about upcoming workshop dates or changes to scheduled sessions, where you have consented.
• Website improvement — anonymised analytics data helps us understand which pages are most useful and where the website can be clearer.

3.1 Data sharing

We do not sell or rent personal data to any third party. We do not share contact details with other businesses for marketing purposes. Data may be processed by the following categories of service provider, under contractual obligations of confidentiality:

• Website hosting provider (server infrastructure only)
• Email delivery service (to send replies to your enquiries)
• Analytics platform (anonymised traffic data; no personal identifiers)

We may disclose data if required to do so by Malaysian law or a valid order of a competent authority.

3.2 Marketing communications

We only send studio updates and workshop notifications to people who have explicitly opted in. You may withdraw this consent at any time by writing to [email protected] or by using the unsubscribe link in any message we send.

4. How We Protect Your Data

• Encrypted transmission — the website uses HTTPS/TLS to encrypt data in transit between your browser and our server.
• Access controls — only staff members with a specific operational need are given access to contact or enrolment records.
• Storage practices — records are held on password-protected systems with regular access reviews.
• Breach response — if a data breach occurs that is likely to affect your rights or interests, we will notify the relevant authority and, where required, notify you directly within the timeframes prescribed under applicable law.

No method of electronic storage or transmission is completely secure. While we apply reasonable precautions, we cannot guarantee absolute security and encourage you to contact us only with information you are comfortable sharing digitally.

5. Cookies

The Steadyway website uses cookies to support basic functionality and to collect anonymised usage data. We do not use cookies to identify you personally or to track you across other websites.

Cookies we use include:

• Essential cookies — required for the site to function (e.g. storing your cookie consent preference).
• Analytics cookies — help us understand page visit patterns in aggregate, with no personal identifiers stored.
• Preference cookies — remember optional settings you have applied on the site.

You can manage or withdraw cookie consent at any time through our Cookie Policy page, which also provides instructions for adjusting cookie settings in your browser.

6. Your Rights

Under the Personal Data Protection Act 2010 and general principles of fair data practice, you have the following rights in relation to personal data we hold about you:

To exercise any of these rights, write to [email protected] with your full name and a description of your request. We will respond within 21 days.

7. Third-Party Links

Our website may contain links to external resources or organisations relevant to retirement preparation in Malaysia. Steadyway does not control these external websites and is not responsible for their content or privacy practices. We recommend reading the privacy notice of any external site before providing personal information to it.

8. Minimum Age

Steadyway's programmes and website are intended for adults aged 18 and above. We do not knowingly collect personal data from persons under 18. If you believe we have inadvertently received data from a minor, please contact us at [email protected] and we will delete it promptly.

9. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or in applicable law. The updated version will be posted on this page with a revised "Last updated" date at the top. Where a change is material, we will take reasonable steps to notify programme participants directly.

Continued use of the website after the date of an update constitutes acceptance of the revised policy.

10. Contact the Data Controller