Privacy Policy

1. Introduction

Bakti AI ("we", "us", "our") is committed to protecting the personal data of individuals who interact with our services and website. This Privacy Policy explains how we collect, use, store, and protect your information when you visit our website at bakti.world or engage our consulting and training services.

This policy is prepared in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia. If you have questions about how we handle your data, please contact us at [email protected].

Data Controller: Bakti AI · 78 Jalan Sultan Azlan Shah, 31400 Ipoh, Perak, Malaysia.

2. Personal Data We Collect

We collect personal data in the following ways:

• Contact forms: Name, email address, phone number, and any message content you submit.
• Service engagements: Business name, role, project details, and any data shared as part of a consulting or training engagement.
• Website analytics: IP address, browser type, pages visited, and session duration (collected via analytics cookies, subject to your consent).
• Email communications: Content of emails sent to us and your contact details.

Legal bases for processing: Consent (for marketing and analytics), contract performance (for service delivery), legitimate interests (for responding to enquiries), and legal obligation (where required by Malaysian law).

Data retention: Contact form submissions are retained for 24 months. Client engagement data is retained for 5 years following engagement completion. Analytics data is retained for 13 months.

3. How We Use Your Data

• Responding to enquiries submitted through our contact form.
• Delivering and managing consulting and training services you have engaged us for.
• Sending service-related communications (project updates, invoices, post-engagement follow-ups).
• Improving our website and understanding how visitors use it (analytics, subject to consent).
• Complying with applicable Malaysian legal and regulatory obligations.

We do not use your personal data for automated decision-making or profiling that has legal effects on you.

4. Data Sharing

We do not sell, rent, or trade your personal data. We may share data with:

• Service providers: Website hosting, email, and analytics platforms that process data on our behalf under data processing agreements.
• Regulatory authorities: Where required by Malaysian law or a valid legal request.
• Professional advisors: Accountants or legal advisors, subject to confidentiality obligations.

Where data is transferred outside Malaysia, we take steps to ensure appropriate protections are in place.

5. Data Protection Measures

• Data in transit is encrypted using TLS/HTTPS.
• Access to client data is restricted to Bakti AI staff with a need to access it for their role.
• We maintain information security practices aligned with the ISO 27001 framework.
• In the event of a data breach affecting your rights, we will notify affected individuals as required under applicable law.

6. Cookies

Our website uses cookies to improve functionality and, with your consent, to gather analytics. For full details, please read our Cookie Policy. You can manage your cookie preferences at any time through the link on our homepage.

7. Your Rights Under the PDPA

As a data subject under Malaysian law, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Withdraw consent for processing based on consent (this does not affect prior lawful processing).
• Request deletion of your data, subject to legal retention requirements.
• Object to processing for direct marketing purposes.
• Lodge a complaint with the Department of Personal Data Protection (JPDP) Malaysia if you believe your rights have been infringed.

To exercise any of these rights, email us at [email protected]. We will respond within 21 days.

8. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies before sharing any personal data with them.

9. Children's Privacy

Our services are intended for business professionals aged 18 and above. We do not knowingly collect personal data from individuals under 18. If you believe we have inadvertently collected such data, please contact us so we can remove it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. Continued use of our website following a policy update constitutes acceptance of the revised terms.