Privacy Policy

1. Introduction

Halcyon Reef ("we", "us", "our") is committed to protecting the personal information of individuals who interact with our business. This Privacy Policy explains what data we collect, why we collect it, how we use it, and what rights you have in relation to it.

This policy applies to personal data collected through our website at https://halcyony.club, through enquiry forms, and in the course of our advisory engagements.

Halcyon Reef is based at Tower 2, PFCC, Jalan Puteri 1/2, 47100 Puchong, Selangor, Malaysia and operates under the Personal Data Protection Act 2010 (PDPA) of Malaysia.

2. Personal Data We Collect

We collect personal data in the following ways:

2.1 Data You Provide Directly

• Full name and job title
• Business email address
• Phone number (if provided)
• Company name and business information shared during enquiries or engagements
• Messages and correspondence sent to us

2.2 Data Collected Automatically

• Website usage data via analytics cookies (if consent is given)
• IP address and browser information for security purposes
• Pages visited and time spent on our site

2.3 Legal Basis for Processing

We process personal data on the following bases under the PDPA: your consent (for marketing and analytics), the performance of a contract or pre-contractual steps (for enquiries and engagements), and our legitimate business interests (for internal records and improving services).

2.4 Retention Periods

Enquiry data is retained for 12 months. Engagement records, including documents and correspondence, are retained for 3 years after project completion. Financial records are kept for 7 years as required by Malaysian law.

3. How We Use Your Personal Data

• To respond to enquiries and provide advisory services
• To manage engagement contracts and deliver agreed outputs
• To send service-related communications (e.g. meeting confirmations, deliverables)
• To send occasional updates about our services — only with your consent, which you can withdraw at any time
• To improve our website using aggregated, anonymised analytics data
• To comply with our legal obligations under Malaysian law

We do not sell personal data to third parties. We do not share your data with marketing networks or data brokers.

4. Data Sharing with Third Parties

We may share data with the following categories of third parties, where necessary:

• Service providers: Email and cloud storage services used to deliver our work. These are bound by confidentiality obligations.
• Analytics providers: We may use Google Analytics to understand website usage. Data collected is aggregated and anonymised where possible.
• Legal and regulatory bodies: If required by law or in response to valid legal process.

All third parties we work with are required to handle your data securely and in accordance with applicable data protection law.

5. How We Protect Your Data

• Data transferred via our website is encrypted using TLS/HTTPS
• Internal documents and engagement files are stored in access-controlled cloud storage
• Access to personal data is restricted to staff who need it for their role
• We conduct periodic reviews of our data handling practices
• In the event of a data breach affecting your rights, we will notify you and the relevant authority within the timeframe required by law

6. Cookies

Our website uses cookies to function and, with your consent, to understand how visitors use it. Essential cookies are necessary for basic site operation. Optional analytics and preference cookies are only set if you accept them via the cookie banner.

For full details, see our Cookie Policy.

7. Your Rights Under the PDPA

Under the Personal Data Protection Act 2010 (Malaysia), you have the following rights in relation to your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request that inaccurate data be corrected
• Withdrawal of consent: Withdraw consent for marketing or analytics processing at any time
• Restriction: Request that we limit the processing of your data in certain circumstances
• Erasure: Request deletion of data we no longer have a legal basis to retain

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days.

If you believe your rights under the PDPA have been infringed, you may lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP) at www.pdp.gov.my.

8. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those websites. We encourage you to review their privacy policies before providing any personal data.

9. Children's Privacy

Our services are directed at business professionals and organisations. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. Where changes are significant, we will provide a more prominent notice. Continued use of our website following any update constitutes your acceptance of the revised policy.