Privacy Notice

Who I am and who controls your data

Agnes Studio is operated by Agnes Foong in Kuala Lumpur, Malaysia. For personal data processed in connection with this website, project enquiries and services, Agnes Foong is the data controller.

In short

This website uses Cloudflare Web Analytics to count visits and see which pages are visited. The analytics service sets no cookies, stores nothing on your device and does not follow you across other websites. The website has no advertising trackers, user accounts or contact form.

However, the providers that host and protect this website may automatically process limited technical information. This may include your IP address, browser and device details, the pages requested, the page that brought you to this website, the date and time of requests, and security logs.

What I collect and where it comes from

I may process:

• Information you provide directly, such as your name, business name, email address, telephone or WhatsApp number, project requirements, messages and files.
• If you become a client, quotations, project agreements, correspondence, deliverables, support records, invoices and payment confirmations.
• Limited technical information collected automatically by the website's hosting and security providers.
• Basic contact or project information provided by a business contact or referral, where relevant.

This website is not directed at children under 18, and I do not intentionally collect children's data, sensitive personal data or biometric data through it.

Please do not send passwords, full payment-card details, identity documents, health information or other sensitive information unless I have specifically requested it and an appropriate method of transfer has been agreed.

How I use personal data

I use personal data to:

• Respond to enquiries.
• Understand and scope projects.
• Prepare quotations and project agreements.
• Deliver, administer and support contracted work.
• Issue invoices and maintain business, tax and accounting records.
• Operate, troubleshoot and protect the website and related systems.
• Prevent misuse, protect legal rights and manage disputes.
• Meet legal and regulatory obligations.

I do not sell or rent personal data. I do not use it for direct marketing unless you have separately agreed to receive such communications.

Whether you have to provide it

Providing information for an initial enquiry is voluntary. However, if you do not provide sufficient contact or project information, I may be unable to respond, prepare a quotation or deliver the requested services.

Certain information may be necessary if we enter into a project agreement or where I am required to retain it by law.

Who I share it with

I disclose personal data only where reasonably necessary to operate the website, communicate with you, provide services or comply with legal obligations. The service providers currently used are:

• Website hosting, content-delivery, security and analytics: Cloudflare
• Email: Zoho Mail
• WhatsApp messaging: WhatsApp/Meta
• Cloud storage or project records: none currently used
• Invoicing, accounting or payment services: none currently used

Payment methods are agreed for each project and vary between clients. Where a payment is made directly to me, I do not use a payment or invoicing service that would receive your information.

These providers may process information under their own privacy terms. I limit access to what is reasonably necessary for the relevant service. Information may also be disclosed to professional advisers, insurers, regulators, courts, law-enforcement agencies or other authorities where reasonably necessary or legally required.

Processing outside Malaysia

Some service providers may store or process personal data outside Malaysia in countries where they or their service infrastructure operate. Where personal data is transferred outside Malaysia, I take reasonable steps to ensure that the transfer is made in accordance with applicable Malaysian law and that appropriate protection is maintained.

Security

I use reasonable administrative and technical safeguards appropriate to the nature of the information. These may include restricted access, strong and unique passwords, multi-factor authentication where available, secured devices, reputable service providers and protected backups where appropriate.

No internet transmission or storage system can be guaranteed completely secure. If a personal data breach requires notification under Malaysian law, I will notify the relevant authority and affected individuals as required.

How long I keep personal data

• Enquiries that do not become projects: up to 12 months after the last substantive communication.
• Routine project correspondence, working files and support records: for the project and generally up to 24 months after completion, unless needed for an ongoing obligation or dispute.
• Project agreements, core delivery records, invoices, payment records and tax or accounting records: generally up to seven years, or for any longer period required by law.
• Website technical and security logs: Cloudflare may automatically process limited request, network and security information to deliver and protect the website. I do not enable separate long-term visitor-log storage or log export (Logpush).

When information is no longer reasonably required, I delete or anonymise it where practicable.

Your rights and choices

Subject to applicable law, you may ask me to:

• Confirm whether I hold personal data about you.
• Provide access to that personal data.
• Correct or update inaccurate information.
• Limit certain processing.
• Withdraw consent where processing relies on your consent.
• Delete information where deletion is applicable.
• Transfer your personal data to another data controller where the right to data portability applies and the transfer is technically feasible and compatible.

I may need to verify your identity before completing a request. I may also need to retain certain information for legal, tax, accounting, contractual, security or dispute-resolution purposes. To make a request, email hello@agnesstudio.my.

Cookies and analytics

This website uses Cloudflare Web Analytics to count visits and see which pages are visited. The analytics service sets no cookies, stores nothing on your device and does not follow you across other websites. It reports overall statistics, such as pages requested, the pages that brought visitors to this website, and general information about browsers, operating systems, device types and countries. It does not build a profile of you and is not used for advertising.

This website sets no advertising cookies or tracking pixels. Providers that host or protect the website may use cookies or similar technologies where necessary to keep it working and secure. If I introduce advertising or other non-essential tracking technology, I will update this notice and put any required consent controls in place before using it.

Contact and complaints

Privacy contact: Agnes Foong
Role: Owner and Data Controller
Email: hello@agnesstudio.my
Telephone/WhatsApp: +60 17-508 8077
Location: Kuala Lumpur, Malaysia

You may contact me with questions, complaints or requests concerning your personal data. You may also lodge a complaint with the Personal Data Protection Commissioner of Malaysia through pdp.gov.my.

Updates to this notice

I may update this notice when my services, technology providers, data practices or applicable laws change. Any revised notice will be published on this page with updated effective and review dates. Where appropriate, I will also provide additional notice of material changes.