Privacy Policy

1. Introduction

Otrelo ("we", "us", "our") is committed to handling personal data responsibly. This Privacy Policy describes how we collect, use, retain, and protect personal information when you interact with our website or engage our advisory services.

This policy applies to all personal data processed by Otrelo in connection with our website at otreloxxad.pro and our consulting engagements. It is issued in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA).

If you have questions about this policy, please contact us at [email protected].

2. What personal data we collect

We collect the following categories of personal data:

• Contact information: name, email address, phone number — collected through our website contact form or provided directly during an engagement.
• Business information: company name, role, and relevant business context — provided during scoping conversations or working sessions.
• Communication records: emails, call notes, and working session documentation — retained as part of the engagement record.
• Website usage data: anonymised analytics data including pages visited, time on site, and browser type — collected through analytics cookies where consent is given.

We collect personal data when you submit our contact form, correspond with us by email or telephone, or participate in an engagement. We do not purchase or obtain personal data from third parties.

Legal basis for processing: We process personal data on the basis of your consent (for website analytics and marketing communications), contractual necessity (for delivering engagement services), and legitimate interests (for maintaining engagement records and responding to enquiries).

Retention periods: Contact form submissions are retained for 12 months. Engagement records (including working documents and deliverables) are retained for 5 years from the conclusion of the engagement, after which they are securely deleted. We retain only what is necessary for the purpose for which it was collected.

3. How we use your personal data

We use personal data for the following purposes:

• Responding to enquiries submitted through our website or by email
• Scoping, delivering, and documenting our advisory engagements
• Issuing invoices and processing payments
• Maintaining engagement records for quality assurance
• Understanding how our website is used, to improve it (analytics, where consent is given)

We do not use your personal data for automated decision-making or profiling. We do not sell or transfer your personal data to third parties for commercial purposes.

Third-party service providers: We use a small number of third-party services to operate our website and business, including email hosting and analytics tools. These providers process data on our behalf and are bound by appropriate data protection agreements. We do not share client data with any third party beyond what is required to deliver the services described.

Marketing: We do not send unsolicited marketing emails. If you have asked to receive updates from us, you may withdraw that consent at any time by contacting [email protected].

4. How we protect your personal data

We take data security seriously and maintain appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include:

• Encrypted email and document transmission
• Access to engagement files restricted to the named consultants on that engagement
• Password-protected storage systems
• Regular review of access rights

In the event of a data breach that is likely to result in harm to affected individuals, we will notify those individuals and the relevant authority as required under the PDPA and applicable guidelines from the Personal Data Protection Department of Malaysia.

5. Cookies

Our website uses cookies to function properly and, where you have given consent, to understand how visitors use the site. The types of cookies we use are described in our Cookie Policy.

You can manage your cookie preferences at any time through our Cookie Policy page or through your browser settings.

6. Your rights

Under Malaysia's Personal Data Protection Act 2010, you have the following rights in relation to personal data we hold about you:

• Right to access: You may request a copy of the personal data we hold about you.
• Right to correction: You may ask us to correct personal data that is inaccurate or incomplete.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to limit processing: In certain circumstances, you may ask us to stop processing your personal data for particular purposes.
• Right to lodge a complaint: If you believe we have handled your personal data unlawfully, you may lodge a complaint with the Personal Data Protection Department of Malaysia (pdp.gov.my).

To exercise any of these rights, please contact us at [email protected]. We will respond within 21 working days.

7. Third-party links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites and we encourage you to review their privacy policies before sharing personal data with them.

8. Children's privacy

Our services are intended for business professionals aged 18 and over. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly.

9. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of our website or services following any change constitutes acceptance of the revised policy. We encourage you to review this policy periodically.

10. Contact us

For any privacy-related questions, requests, or complaints, please contact: