Privacy Notice

Who I am and who controls your data

Agnes Studio is operated by Agnes Foong in Kuala Lumpur, Malaysia. For personal data processed in connection with this website, project enquiries and services, Agnes Foong is the data controller.

In short

This website does not currently use advertising trackers or analytics, and it has no user accounts or contact form.

However, the providers responsible for hosting and protecting the website may automatically process limited technical information, such as your IP address, browser and device information, pages requested, referring page, timestamps and security logs.

What I collect and where it comes from

I may process:

• Information you provide directly, such as your name, business name, email address, telephone or WhatsApp number, project requirements, messages and files.
• If you become a client, quotations, project agreements, correspondence, deliverables, support records, invoices and payment confirmations.
• Limited technical information collected automatically by the website's hosting and security providers.
• Basic contact or project information provided by a business contact or referral, where relevant.

This website is not directed at children under 18, and I do not intentionally collect children's data, sensitive personal data or biometric data through it.

Please do not send passwords, full payment-card details, identity documents, health information or other sensitive information unless I have specifically requested it and an appropriate method of transfer has been agreed.

How I use personal data

I use personal data to:

• Respond to enquiries.
• Understand and scope projects.
• Prepare quotations and project agreements.
• Deliver, administer and support contracted work.
• Issue invoices and maintain business, tax and accounting records.
• Operate, troubleshoot and protect the website and related systems.
• Prevent misuse, protect legal rights and manage disputes.
• Meet legal and regulatory obligations.

I do not sell or rent personal data. I do not use it for direct marketing unless you have separately agreed to receive such communications.

Whether you have to provide it

Providing information for an initial enquiry is voluntary. However, if you do not provide sufficient contact or project information, I may be unable to respond, prepare a quotation or deliver the requested services.

Certain information may be necessary if we enter into a project agreement or where I am required to retain it by law.

Who I share it with

I disclose personal data only where reasonably necessary to operate the website, communicate with you, provide services or comply with legal obligations. The service providers currently used are:

• Website hosting, content-delivery and security: Cloudflare
• Email: Zoho Mail
• WhatsApp messaging: WhatsApp/Meta
• Cloud storage or project records: none currently used
• Invoicing, accounting or payment services: none currently used

These providers may process information under their own privacy terms. I limit access to what is reasonably necessary for the relevant service. Information may also be disclosed to professional advisers, insurers, regulators, courts, law-enforcement agencies or other authorities where reasonably necessary or legally required.

Processing outside Malaysia

Some service providers may store or process personal data outside Malaysia in countries where they or their service infrastructure operate. Where personal data is transferred outside Malaysia, I take reasonable steps to ensure that the transfer is made in accordance with applicable Malaysian law and that appropriate protection is maintained.

Security

I use reasonable administrative and technical safeguards appropriate to the nature of the information. These may include restricted access, strong and unique passwords, multi-factor authentication where available, secured devices, reputable service providers and protected backups where appropriate.

No internet transmission or storage system can be guaranteed completely secure. If a personal data breach requires notification under Malaysian law, I will notify the relevant authority and affected individuals as required.

How long I keep personal data

• Enquiries that do not become projects: up to 12 months after the last substantive communication.
• Routine project correspondence, working files and support records: for the project and generally up to 24 months after completion, unless needed for an ongoing obligation or dispute.
• Project agreements, core delivery records, invoices, payment records and tax or accounting records: generally up to seven years, or for any longer period required by law.
• Website technical and security logs: Cloudflare may automatically process limited request, network and security information to deliver and protect the website. I do not enable separate long-term visitor-log storage or log export (Logpush).

When information is no longer reasonably required, I delete or anonymise it where practicable.

Your rights and choices

Subject to applicable law, you may ask me to:

• Confirm whether I hold personal data about you.
• Provide access to that personal data.
• Correct or update inaccurate information.
• Limit certain processing.
• Withdraw consent where processing relies on your consent.
• Delete information where deletion is applicable.
• Transfer your personal data to another data controller where the right to data portability applies and the transfer is technically feasible and compatible.

I may need to verify your identity before completing a request. I may also need to retain certain information for legal, tax, accounting, contractual, security or dispute-resolution purposes. To make a request, email hello@agnesstudio.my.

Cookies and analytics

This website does not currently use advertising cookies, analytics cookies or tracking pixels. The website's hosting or security providers may use cookies or similar technologies that are necessary to deliver, operate or protect the website. If analytics, advertising or other non-essential tracking technology is introduced, this notice and any required consent controls will be updated before it is used.

Contact and complaints

Privacy contact: Agnes Foong
Role: Owner and Data Controller
Email: hello@agnesstudio.my
Telephone/WhatsApp: +60 17-508 8077
Location: Kuala Lumpur, Malaysia

You may contact me with questions, complaints or requests concerning your personal data. You may also lodge a complaint with the Personal Data Protection Commissioner of Malaysia through pdp.gov.my.

Updates to this notice

I may update this notice when my services, technology providers, data practices or applicable laws change. Any revised notice will be published on this page with updated effective and review dates. Where appropriate, I will also provide additional notice of material changes.