Privacy Policy

1. Introduction

Cobalt Reef ("we", "us", "our") is a brand positioning and identity consulting firm based in Kuala Lumpur, Malaysia. We are committed to handling personal data responsibly and in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia and any other applicable data protection legislation.

This policy applies to personal data collected via this website (including the enquiry form) and through our consulting work. By using this website or engaging our services, you agree to the practices described here.

Questions about this policy may be directed to privacy@{{DOMAIN}}.

2. Data we collect

2.1 Information you provide

When you use the contact form or engage with us directly, we may collect:

• Name (first and last)
• Email address
• Phone number (if provided)
• Organisation name and role
• The content of your message or enquiry

2.2 Automatically collected data

When you visit this website, certain technical data is collected automatically. This may include your IP address, browser type, pages visited, referral source and approximate geographic location. This data is used in aggregate to understand how the site is used and to improve it.

2.3 Cookies

We use cookies to support the operation of the site and to understand visitor behaviour. Please refer to Section 5 and our Cookie Policy for full details.

2.4 Legal basis for processing

We process personal data on the following bases:

• Consent — where you have opted in, for example by submitting the contact form or accepting optional cookies.
• Legitimate interests — to operate and improve this website and to respond to genuine enquiries.
• Contractual necessity — where we have agreed to provide services, personal data is processed as needed to fulfil that agreement.

2.5 Retention

Enquiry data is retained for up to 24 months from the date of last contact. Client project data is retained for up to five years to support continuity and comply with record-keeping obligations. You may request deletion at any time; see Section 6.

3. How we use your data

3.1 Service delivery

We use contact information to respond to enquiries, schedule working sessions and deliver the agreed scope of our consulting engagements.

3.2 Communications

We may send project updates, working notes and relevant correspondence to clients. We do not send unsolicited marketing emails. Any newsletter or updates communication requires explicit opt-in and includes a clear unsubscribe option.

3.3 Site analytics

Aggregated and anonymised analytics data helps us understand which pages are most useful and where the site can be improved. We do not use this data to build individual profiles.

3.4 Third-party processors

We may share data with service providers who support our operations, including email hosting, analytics platforms and cloud storage. These providers are bound by data processing agreements and are not permitted to use your data for their own purposes. We do not sell personal data to any third party.

3.5 Legal compliance

We may disclose personal data if required to do so by applicable law or in response to a valid request from a competent authority.

4. Data protection measures

We apply reasonable technical and organisational measures to protect personal data against loss, misuse and unauthorised access. These include:

• TLS/HTTPS encryption for all data in transit
• Access controls limiting data to personnel with a need to know
• Secure, password-protected cloud storage with multi-factor authentication
• Regular review of access permissions

In the event of a data breach that is likely to result in risk to affected individuals, we will notify those individuals and, where required, the relevant authority under the PDPA within a reasonable timeframe.

No transmission over the internet can be fully secure. While we take these measures seriously, we cannot warrant absolute security.

5. Cookies

This website uses cookies for essential functionality, analytics and optional preference storage. You can manage your cookie choices at any time via our Cookie Policy page, which includes category-level controls.

Essential cookies are always active as they are necessary for the site to function. Optional cookie categories (analytics, marketing, preferences) require your consent and can be withdrawn at any time.

6. Your rights

Under the Personal Data Protection Act 2010 and related legislation, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your personal data, subject to legal retention obligations.
• Portability — receive your data in a structured, commonly used format where technically feasible.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.
• Object — object to processing based on legitimate interests where your particular situation warrants it.
• Complaint — lodge a complaint with the Department of Personal Data Protection (JPDP) Malaysia if you believe your rights have been infringed.

To exercise any of these rights, write to privacy@{{DOMAIN}}. We aim to respond within 14 working days.

7. Third-party links

This website may contain links to external sites. We are not responsible for the content or privacy practices of those sites. We encourage you to review the privacy policies of any external site you visit.

8. Children's privacy

Our services are directed at businesses and professionals. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us and we will remove it promptly.

9. Policy updates

We may update this policy from time to time to reflect changes in our practices or applicable law. The current version and its effective date will always be shown at the top of this page. Continued use of the website after a material change constitutes acknowledgement of the updated policy.

We will notify active clients of material changes by email where appropriate.

10. Contact

For questions, requests or concerns regarding personal data, please contact: