Privacy Policy

Ferrum Trails ("we", "us", "our") is committed to handling personal data responsibly and in accordance with the Malaysian Personal Data Protection Act 2010 (PDPA 2010). This Privacy Policy explains what data we collect, why we collect it, and how we use and protect it.

This policy applies to personal data collected through our website at ferrumtred, through enquiry forms, and in the course of providing our consulting services.

1. Data Controller

The data controller responsible for personal data collected and processed by this website is:

2. Data We Collect

Website Enquiries

When you submit our contact form, we collect the information you provide, which may include your name, email address, telephone number, organisation, and the content of your message.

Engagement Data

In the course of conducting a consulting engagement, we may collect and process personal data relating to individual directors, company secretaries, and other stakeholders. The scope of this data collection is described in the engagement letter for each assignment.

Website Usage Data

We collect aggregated, anonymised data about how visitors use our website through Google Analytics. This data does not identify you as an individual. Please refer to our Cookie Policy for further details.

Communications

If you correspond with us by email or telephone, we retain records of those communications to the extent necessary for the conduct of the engagement or enquiry.

3. How We Use Personal Data

We use personal data for the following purposes:

• To respond to enquiries received through our website or by other means
• To conduct, deliver, and document consulting engagements under signed engagement letters
• To maintain records required for professional and legal purposes
• To understand how our website is used, in aggregated and anonymised form only
• To communicate with clients about ongoing or prospective engagements

We do not use personal data for marketing, profiling, automated decision-making, or any purpose beyond those described above without first obtaining your consent.

4. Legal Basis for Processing

Under the PDPA 2010 and applicable Malaysian data protection requirements, we process personal data on the following bases:

• Consent: For website enquiries and non-essential cookies, where you have indicated consent.
• Contract: For data necessary to perform or prepare a consulting engagement you have entered into with us.
• Legitimate interests: For maintaining professional records and ensuring the security and performance of our website, where these interests do not override your rights.
• Legal obligation: Where processing is required to comply with applicable Malaysian law.

5. Sharing of Data

We do not share personal data with third parties except in the following limited circumstances:

• Service providers: We use a small number of trusted service providers (such as our website hosting and email providers) who process data on our behalf under appropriate agreements. These providers are not permitted to use data for their own purposes.
• Legal requirements: We may disclose data where required to do so by law, court order, or the direction of a competent Malaysian authority.
• With your consent: We will not share your data with any other party without your explicit consent.

6. Retention of Data

We retain personal data only for as long as is necessary for the purposes described in this policy, or as required by law. The following general retention periods apply:

• Enquiry data: Retained for two years from the date of last contact, unless an engagement follows.
• Engagement records: Retained for seven years from the close of an engagement, in line with standard professional record-keeping requirements.
• Website analytics: Aggregated and anonymised; no personal retention applies.

Upon expiry of the relevant period, data is securely deleted or anonymised.

7. Your Rights

Under the PDPA 2010, you have the right to:

• Request access to personal data we hold about you
• Request correction of inaccurate or incomplete personal data
• Withdraw consent to the processing of your personal data (where processing is based on consent)
• Request that we cease using your data for direct marketing (where applicable)

To exercise any of these rights, please contact us at the details provided in Section 11 below. We will respond within a reasonable period and in accordance with the requirements of the PDPA 2010.

8. Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or loss. These measures include encrypted communications, access controls, and regular review of our data handling practices.

No method of electronic transmission or storage is completely secure. If you have reason to believe that your data has been compromised, please notify us promptly.

9. Cookies

Our use of cookies and similar technologies is described in our Cookie Policy, which forms part of this Privacy Policy.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The date at the top of the page will reflect the most recent revision. Where changes are material, we will take reasonable steps to bring them to your attention. Your continued use of our website or services after any update constitutes acceptance of the revised policy.

11. Contact and Complaints

For questions or concerns about this Privacy Policy or our data handling practices, please contact us:

If you are not satisfied with our response, you may direct a complaint to the Department of Personal Data Protection Malaysia (JPDP) at pdp.gov.my.