Privacy Policy

1. Introduction

Kasturi Tech (referred to in this document as "we", "us", or "our") is an AI development school operating in Kuala Lumpur, Malaysia. This Privacy Policy describes how we collect, use, store, and protect personal information when you visit our website or enrol in one of our programmes.

We operate under the Personal Data Protection Act 2010 (PDPA) of Malaysia. By using our website or submitting an enquiry form, you acknowledge that you have read and understood this policy.

For questions about this policy, contact us at [email protected].

2. Information We Collect

2.1 Information you provide directly

• Contact form submissions: name, email address, phone number (optional), and message content
• Enrolment information: name, email address, and background information relevant to course placement
• Course participation: questions submitted during sessions, project submissions, and communications with instructors

2.2 Information collected automatically

• Usage data: pages visited, time spent on pages, referring pages, and browser type
• Device information: operating system, device type, and screen resolution
• Cookies: see our Cookie Policy for details

2.3 Legal basis for processing

We process personal data on the following grounds under the PDPA 2010: your consent (for marketing communications and analytics cookies), the performance of a contract (for enrolled learners), legitimate interests (for website security and service improvement), and legal compliance (where required by Malaysian law).

3. How We Use Your Information

• Responding to enquiries: we use contact form data to reply to your message and provide information about our programmes
• Course administration: enrolled learner data is used to manage session access, feedback, and communications during the course period
• Service improvement: anonymised usage data helps us understand how our website is used and where content can be improved
• Marketing communications: only if you have separately consented, we may send updates about new cohort openings or course changes. You can withdraw this consent at any time
• Legal compliance: we may retain records where required under Malaysian law

3.1 Data retention

Contact form enquiries are retained for 12 months. Enrolled learner records are retained for 3 years following course completion. Analytics data is retained for 26 months. Data is then securely deleted unless a longer retention period is required by law.

3.2 Third parties

We do not sell personal data. We may share data with service providers who support our operations (email delivery, analytics platforms) under data processing agreements. We may disclose data when required by Malaysian law or a competent authority.

4. Data Protection Measures

• Website traffic is encrypted using TLS/HTTPS
• Access to personal data is restricted to staff members with a need for it
• Internal systems are password protected and access-controlled
• In the event of a data breach affecting your personal information, we will notify you and the relevant authority within 72 hours where practicable
• Security practices are reviewed periodically

5. Cookies

We use essential cookies to keep the website functioning, and optional analytics and preference cookies if you consent. You can manage your cookie preferences at any time via our Cookie Policy page.

6. Your Rights

Under the PDPA 2010 and applicable data protection principles, you have the following rights regarding your personal data:

• Access: request a copy of personal data we hold about you
• Correction: request correction of inaccurate or incomplete data
• Erasure: request deletion of your personal data, subject to legal retention requirements
• Object to processing: object to processing based on legitimate interests
• Withdraw consent: withdraw consent for marketing communications or analytics at any time
• Complaints: lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP) at www.pdp.gov.my

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days.

7. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites. We recommend reviewing the privacy policy of any site you visit through a link on our pages.

8. Children's Privacy

Our programmes are intended for individuals aged 18 and above. We do not knowingly collect personal data from persons under 18. If you believe we have received information from a minor in error, please contact us and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with a revised date. For significant changes, we will notify enrolled learners by email. Continued use of our website after changes are posted constitutes acceptance of the updated policy.