Privacy Policy

Introduction

Halcyon Strategy ("we," "us," or "our") is committed to protecting the personal information of those who engage with us or visit our website. This Privacy Policy explains how we collect, use, store, and safeguard your personal data in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia.

This policy applies to all personal data processed in connection with our website at halcyonsad and our advisory services. For questions about this policy, contact us at privacy@halcyonsad.

Data We Collect

Information you provide directly

• Name and contact details (email address, phone number)
• Information shared through our website contact form
• Business role or organization, if provided voluntarily
• Content of any written communication with our team

Information collected automatically

• IP address and browser type
• Pages visited and time spent on our website
• Referring website or search terms used to find us
• Device type and operating system

Cookies and tracking

We use cookies to understand how visitors use our website. See our Cookie Policy for full details.

Legal Basis for Processing

We process your personal data on the following lawful bases under the PDPA:

• Consent — where you have submitted a contact form or agreed to cookies
• Legitimate interests — for website analytics and improving our services
• Contractual necessity — when processing is required to fulfil an advisory engagement
• Legal obligation — where required by Malaysian law or regulatory requirement

How We Use Your Data

• To respond to enquiries submitted through our contact form
• To conduct advisory engagements you have entered into with us
• To improve our website through aggregate analytics data
• To comply with our legal and regulatory obligations
• To communicate relevant updates about our services, only where you have consented

We do not use your data for automated decision-making or profiling.

Data Sharing

We do not sell or share personal data with third parties for commercial purposes. We may share data in the following limited circumstances:

• Service providers — including website hosting, email delivery, and analytics providers, who process data on our behalf under data processing agreements
• Legal compliance — if required to do so by Malaysian law, court order, or regulatory authority
• Business transfer — in the unlikely event of a merger or acquisition, with appropriate confidentiality protections

Our third-party service providers include Google Analytics (website analytics) and cloud hosting providers. These services may set cookies on your device.

Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected:

• Website enquiry data: retained for 24 months from the date of enquiry
• Engagement-related data: retained for 7 years after the end of an engagement, in accordance with Malaysian company law requirements
• Analytics data: retained for 26 months in aggregate form
• Cookie preference data: retained for 12 months from the date of consent

Data Protection Measures

We take the security of personal data seriously. Measures in place include:

• Encrypted data transmission using HTTPS/TLS
• Access to personal data restricted to authorised team members only
• Regular review of our data handling practices
• Secure storage on servers located within the Asia-Pacific region
• Prompt notification to affected individuals in the event of a data breach, as required by applicable law

Cookies

Our website uses essential and optional cookies. You can manage your cookie preferences at any time. For full details, see our Cookie Policy.

Your Rights

Under the PDPA and applicable Malaysian data protection law, you have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Withdrawal of consent — withdraw consent for processing at any time, where consent is the lawful basis
• Objection — object to processing in certain circumstances
• Complaint — lodge a complaint with the Personal Data Protection Commissioner of Malaysia

To exercise any of these rights, contact us at privacy@halcyonsad. We will respond within 21 days.

Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policies of any external sites you visit.

Children's Privacy

Our services are intended for business professionals and individuals aged 18 and above. We do not knowingly collect personal data from minors. If you believe a minor has submitted personal data to us, please contact us and we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this page. Continued use of our website following any update constitutes acceptance of the revised policy.

Contact

For any privacy-related questions or to exercise your data rights:

• Email: privacy@halcyonsad
• Address: Level 8, Menara Shell, Jalan Tun Sambanthan, 50470 Kuala Lumpur, Malaysia
• Phone: +60 3 2276 9481