Privacy Policy

1. Introduction

Heirloom Ledger ("we", "us", "our") is a household archival practice based at Suite 4A, Lebuh Pantai, 10300 George Town, Penang, Malaysia. This Privacy Policy explains how we collect, use, and protect personal information provided to us through this website and in the course of our services.

Our services involve working directly with household members in their homes and at our studio. We take the privacy of household information and personal data seriously. This policy applies to data collected through our website contact form, email correspondence, and service enquiries. It does not apply to the household records, photographs, or archival materials we produce on your behalf — those belong to you entirely and are not retained by us.

2. Data We Collect

We collect the following categories of personal data:

• Contact information: Name, email address, and phone number submitted through our contact form or sent directly by email.
• Enquiry content: The content of messages sent to us describing your household's situation or service interest.
• Website usage data: Through cookies and analytics tools, we may collect data about how visitors interact with our website — pages visited, time spent, browser type, and approximate location derived from IP address. This data is not linked to individual identities.

We do not collect sensitive personal categories such as financial account information, government-issued identification numbers, or health data.

3. Legal Basis for Processing

We process personal data on the following grounds under the Personal Data Protection Act 2010 (Malaysia) and general data protection principles:

• Consent: When you submit a contact form, you consent to us using the data provided to respond to your enquiry.
• Legitimate interests: We use website analytics data to understand how our site is used and to improve it. This does not override your privacy rights.
• Contract performance: Once a project is agreed upon, we process contact details to arrange sessions, confirm appointments, and deliver the completed work.

4. How We Use Your Data

• To respond to enquiries submitted via the contact form or email
• To schedule workshop sessions, project appointments, and subscription visits
• To communicate about an active project or subscription — delivery timelines, session reminders, and follow-up notes
• To understand how our website is used and improve its content
• To comply with applicable legal requirements in Malaysia

We do not use your personal data for direct marketing without your explicit consent. We do not sell, trade, or rent personal data to third parties.

5. Data Retention

Contact information is retained for as long as needed to respond to an enquiry and, if a project is commissioned, for the duration of that project plus twelve months. After this period, personal contact data is deleted from our records unless you have an active subscription, in which case it is retained for the duration of the subscription.

Website analytics data is retained in aggregated form for up to twenty-four months. It is not tied to personally identifiable information.

6. Data Protection Measures

• Our website uses HTTPS to encrypt data transmitted between your browser and our server.
• Contact form data is transmitted securely and stored in access-controlled systems.
• Physical project records (notes, schedules, correspondence) are stored in locked filing at our studio and destroyed after the retention period.
• Access to personal data is restricted to team members directly involved in your project.
• In the event of a data breach affecting your personal information, we will notify you as soon as practicable and in accordance with applicable Malaysian law.

7. Cookies

Our website uses cookies for essential site functionality and, with your consent, for analytics purposes. You can manage your cookie preferences at any time. For full details, see our Cookie Policy.

8. Your Rights

Under the Personal Data Protection Act 2010 (Malaysia) and general privacy principles, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that inaccurate or incomplete data be corrected.
• Erasure: Request deletion of your personal data, subject to our legal obligations to retain certain records.
• Withdraw consent: Where processing is based on consent, withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.
• Object: Object to processing for legitimate interests purposes.

To exercise any of these rights, contact us at [email protected]. We will respond within thirty days.

9. Third-Party Services

Our website may use third-party services for analytics (such as Google Analytics). These services may collect data about your visit in accordance with their own privacy policies. We recommend reviewing those policies independently. We do not control these third-party services.

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites and encourage you to review their policies before providing any personal information.

10. Children's Privacy

Our website and services are directed at adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If you believe a minor has submitted personal information to us, please contact us at [email protected] and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the Last Updated date at the top of this page. If changes are material, we will notify active clients by email. Continued use of our website after changes are posted constitutes acceptance of the revised policy.

12. Contact for Privacy Enquiries

For any questions about this Privacy Policy or to exercise your data rights, contact us: