Privacy Policy

1. Introduction

Lestari Works ("we", "us", "our") is a business support service registered and operating in Miri, Sarawak, Malaysia. We provide AI-assisted compliance reporting, vendor enquiry drafting, and support hours to small businesses.

This policy explains what personal information we collect, why we collect it, how we use it, and what rights you have over your information. It applies to information collected through our website at lestariw.biz and through our service delivery activities.

We process personal data in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia.

2. Data We Collect

We collect the following categories of personal data:

• Contact information: Name, email address, phone number — collected when you submit our website contact form or enquire about services.
• Business information: Company name, business address, nature of business — collected during service setup to configure our tools for your situation.
• Operational data: Figures, documents, and records shared with us for the purpose of compliance return preparation or vendor enquiry management — collected only for the specific task agreed and not retained beyond the task period.
• Communication records: Emails and messages exchanged during service delivery — retained for the period the service agreement is active and up to 12 months after termination.
• Website data: Cookies and usage data collected when you visit our website — see Section 5 below.

Legal basis: We process personal data on the basis of consent (for contact form submissions and cookies), contract performance (for service delivery), and legitimate interest (for maintaining records of service activity).

3. How We Use Your Data

• To respond to enquiries submitted through our website contact form
• To configure and deliver the specific service you have engaged us for
• To produce compliance return packages, vendor reply drafts, or support logs as agreed
• To send quarterly support hour reports to Support Hours clients
• To maintain records of work completed for billing and dispute resolution purposes
• To improve our website and services based on aggregate usage patterns

We do not sell personal data to third parties. We do not use your data for unsolicited marketing without your prior consent.

4. Data Sharing

We do not share personal data with third parties except:

• Service providers: Software tools we use to perform data assembly and drafting functions. These providers process data on our behalf under agreements that restrict their use of the data.
• Legal requirements: If required to do so by Malaysian law or by a competent authority.

We do not transfer personal data outside Malaysia unless required to do so to deliver the service, in which case we will inform you in advance.

5. Cookies

Our website uses cookies to maintain basic site functionality and to understand how the site is used. We do not set advertising or tracking cookies without your consent.

• Essential cookies: Required for the site to function. Cannot be disabled.
• Analytics cookies: Used to understand visit patterns in aggregate. Only set after you accept optional cookies.
• Preference cookies: Remember your cookie consent choice. Set when you interact with the cookie consent banner.

See our Cookie Policy for full details and to manage your preferences.

6. Data Retention

• Contact enquiry records: 24 months from date of enquiry
• Service delivery records: Duration of active service plus 12 months
• Operational data shared for task completion (figures, documents): Deleted within 30 days of task completion unless a longer period is agreed in writing
• Financial and billing records: 7 years as required by Malaysian accounting regulations

7. Data Security

We apply reasonable technical and organisational measures to protect personal data from loss, misuse, and unauthorised access. These include:

• Encrypted communications for data transfer
• Access controls limiting who within our team can access client data
• Regular review of our data handling procedures

In the event of a data breach that is likely to affect your rights, we will notify you and the relevant authority as required by Malaysian law within a reasonable timeframe.

8. Your Rights Under PDPA 2010

Under Malaysia's Personal Data Protection Act 2010, you have the following rights:

• Right of access: You may request a copy of the personal data we hold about you.
• Right of correction: You may request that inaccurate personal data be corrected.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time. This does not affect data processed before withdrawal.
• Right to cease processing: You may request that we stop processing your data for direct marketing purposes.

To exercise any of these rights, write to us at [email protected]. We will respond within 21 days.

If you have a complaint about how we handle your data, you may contact the Department of Personal Data Protection Malaysia (JPDP): www.pdp.gov.my.

9. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any external site you visit.

10. Children's Privacy

Our services are intended for business operators and are not directed at persons under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has submitted data to us, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this policy from time to time. The most current version will be published on this page with an updated date at the top. For significant changes, we will notify active service clients by email.

12. Contact for Data Enquiries

For any questions about this policy or about how we handle your data: