Privacy Policy

1. Introduction

Vellumind Sdn. Bhd. ("Vellumind", "we", "us", or "our") operates a sustainability and ESG operations advisory service based in Kuala Lumpur, Malaysia. We are committed to handling any personal information you share with us carefully and in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia.

This Privacy Policy describes how we collect, use, store, and protect personal data submitted through our website at vellumind.cyou, including via our contact form, telephone inquiries, and email correspondence.

By using our website or reaching out to us, you acknowledge that you have read and understood this policy. If you have any questions before proceeding, please write to us at [email protected].

2. Data We Collect

We only collect information that genuinely helps us respond to your inquiry or deliver a service you have requested. This includes:

Information You Provide Directly

• Name — so we know who we are speaking with
• Email address — to correspond and share documents
• Phone number — if you provide it optionally in the contact form
• Company name and message content — to understand your context

Information Collected Automatically

• Cookies and session data — to keep the website functional (see Section 5)
• Basic analytics data — page views, referring sources, general location by city/country (no precise tracking)
• Browser and device type — to display the website correctly

Legal Basis for Processing

• Your consent — when you submit a contact form or accept cookies
• Legitimate interest — for analytics that help us improve the website
• Contractual necessity — where you have engaged us for a service

3. How We Use Your Data

We use personal data only for the purpose for which it was collected. Specifically:

• Responding to your inquiry or request
• Scheduling and delivering advisory sessions
• Sending project deliverables, meeting notes, and follow-up communications
• Improving our website based on aggregate, anonymised usage patterns
• Maintaining financial and business records as required by Malaysian law

Marketing Communications

We do not send unsolicited marketing emails. If you have previously engaged with us and would find occasional updates on our advisory work useful, we may reach out. You may opt out at any time by replying with "unsubscribe" or writing to us directly.

Data Sharing

We do not sell, rent, or trade your personal data. We may share limited information with trusted service providers (such as cloud storage providers or email platforms) strictly to operate our business. These providers are required to handle data in a manner consistent with this policy. We do not share personal data with advertising networks.

4. Data Protection Measures

We take reasonable and proportionate steps to keep your data safe:

5. Cookies

We use a small number of cookies to operate and understand the website. These fall into the following categories:

You can review and adjust your cookie preferences at any time on our Cookie Policy page.

6. Your Rights

Under the PDPA 2010 (Malaysia) and applicable data protection principles, you have the following rights regarding your personal data:

• Right to access — request a copy of the personal data we hold about you
• Right to rectification — ask us to correct inaccurate or incomplete data
• Right to erasure — request deletion of data where we no longer have a valid reason to hold it
• Right to data portability — receive your data in a machine-readable format where applicable
• Right to object — to processing based on legitimate interest
• Right to withdraw consent — at any time, for data processed on that basis
• Right to lodge a complaint — with the Department of Personal Data Protection Malaysia (JPDP)

To exercise any of these rights, write to us at [email protected]. We aim to respond within 14 working days.

7. Third-Party Links

Our website may occasionally link to external resources, regulatory bodies, or partner organisations. We are not responsible for the privacy practices of those external sites. We encourage you to read their privacy policies before sharing any personal data with them.

8. Children's Privacy

Our services are intended for business professionals and are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has submitted information through our website, please contact us and we will delete it promptly.

9. Policy Updates

We may update this Privacy Policy from time to time as our services or applicable laws change. When we do, we will revise the "Last Updated" date at the top of this page. Where a change is significant, we may also place a brief notice on the homepage.

Continued use of our website after an update takes effect constitutes acceptance of the revised policy. We encourage you to review this page periodically.

10. Contact Us

If you have any questions, concerns, or requests relating to this policy or to how we handle your data, please reach out: