Privacy Policy

1. Data Controller

The data controller is Substrate Co, registered in Malaysia, with offices at Unit B-7-3, Megan Avenue II, 12 Jalan Yap Kwan Seng, 50450 Kuala Lumpur. For data-related enquiries, contact us at [email protected].

2. Data We Collect

We collect personal data only when it is necessary for the purpose stated at the point of collection. The categories of data we may hold are:

• Contact information: full name, email address, phone number
• Correspondence records: messages submitted via the enquiry form or sent by email
• Engagement information: workload descriptions, hardware configuration details, and benchmark-related documents provided during a service engagement
• Technical data: IP address, browser type, and pages visited, collected automatically via server logs and analytics tools
• Cookie preferences: stored locally in your browser via localStorage

We do not collect sensitive personal data as defined by the PDPA unless it is strictly necessary and you have given explicit consent.

3. How We Collect Data

• Enquiry form submissions on this website
• Email correspondence initiated by you
• Documents and materials you share as part of a service engagement
• Automatic collection via server logs and analytics (where consent is given)

4. Legal Basis for Processing

We process personal data on the following bases:

• Contract performance: data needed to deliver the service you have requested
• Legitimate interests: responding to enquiries, maintaining client records, and improving our services
• Consent: analytics cookies and marketing communications, where you have opted in
• Legal obligation: retaining records as required by Malaysian law

5. How We Use Your Data

• Responding to enquiries and delivering requested services
• Communicating about your engagement, including deliverables and scheduling
• Maintaining internal records for accounting and service quality purposes
• Analysing website usage (where consent is given) to improve the site
• Complying with applicable legal or regulatory requirements

We do not use personal data for automated decision-making or profiling.

6. Data Sharing

We do not sell personal data to third parties. We may share data in the following limited circumstances:

• Service providers necessary to operate our business (e.g. email hosting, accounting software), under data processing agreements
• Legal authorities, where disclosure is required by law or court order
• Professional advisers (legal, accounting), under confidentiality obligations

Engagement data — workload descriptions, benchmark artefacts, hardware specifications — is never shared with other clients or third parties without your explicit written consent.

7. Data Retention

• Enquiry form data: retained for 12 months from submission if no engagement follows
• Client engagement records: retained for 7 years from project close, in accordance with Malaysian accounting requirements
• Website analytics data: retained for 26 months, consistent with standard analytics practice
• Cookie preferences: stored in your browser until cleared by you

8. Data Protection Measures

We apply the following measures to protect personal data:

• Encrypted transmission (TLS/HTTPS) for all data sent to and from this website
• Access controls limiting data access to team members with a need to know
• Secure disposal of engagement artefacts at agreed retention end dates
• Regular review of data handling practices

In the event of a data breach that is likely to result in risk to your rights, we will notify you and the relevant authority within the timeframe required under Malaysian law.

9. Cookies

This website uses cookies for essential functionality and, with your consent, for analytics purposes. You can manage your preferences at any time via our Cookie Policy page. Essential cookies cannot be disabled as they are required for the site to function.

10. Your Rights Under the PDPA

Under the Personal Data Protection Act 2010 (Malaysia), you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Withdraw consent to processing based on consent (this does not affect prior processing)
• Request deletion of data we no longer have a lawful basis to retain
• Limit processing in certain circumstances
• Lodge a complaint with the Personal Data Protection Department of Malaysia

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days.

11. Third-Party Links

This website may contain links to external resources. We are not responsible for the privacy practices of third-party sites and recommend reading their policies separately.

12. Children's Privacy

Our services are directed at organisations and professionals aged 18 and above. We do not knowingly collect personal data from individuals under 18. If you believe a minor has submitted data through this site, contact us and we will arrange deletion promptly.

13. Changes to This Policy

We may update this policy to reflect changes in our practices or applicable law. The date at the top of this page reflects the most recent revision. Continued use of our services after an update constitutes acceptance of the revised policy.

14. Contact for Data Enquiries

For questions, access requests, or complaints relating to this policy, contact: