Privacy Policy

1. Introduction

Drumlin ("we", "us", "our") is a business continuity consultancy based in Kuala Lumpur, Malaysia. We are committed to handling personal information responsibly and in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA 2010).

This policy explains what personal data we collect, how we use it, how we protect it, and what rights you have in relation to it. It applies to information collected through our website at https://drumlini.biz and through our consulting engagements.

2. Data We Collect

We collect personal data only when it is necessary for a legitimate purpose. The categories of data we may collect include:

• Contact information: name, email address, phone number — provided when you submit an enquiry through our website contact form.
• Business information: company name, role, details about your operations — shared during consulting engagements.
• Website usage data: pages viewed, session duration, browser type — collected via analytics tools if you have consented to analytics cookies.
• Cookie preference data: stored in your browser's local storage to remember your cookie consent choices.

Legal basis: We process personal data on the basis of consent (website forms and cookies), contractual necessity (consulting engagements), and legitimate interest (responding to enquiries). Data collected through contact forms is retained for up to 24 months. Engagement-related data is retained for the duration of the engagement plus three years for reference purposes.

3. How We Use Personal Data

• To respond to enquiries submitted through our contact form
• To deliver consulting services as agreed in an engagement
• To communicate about engagement progress, scheduling, and deliverables
• To understand how visitors use our website and make improvements (analytics, with consent)
• To comply with legal or regulatory obligations

We do not sell, rent, or share personal data with third parties for marketing purposes. We do not send unsolicited marketing communications.

4. How We Protect Personal Data

• Website is served over HTTPS with TLS encryption
• Access to client data is restricted to the consulting team directly involved in the engagement
• Engagement documents and correspondence are stored on password-protected, access-controlled systems
• In the event of a data breach that affects your personal data, we will notify you and, where required, the relevant authority under PDPA 2010

5. Cookies

Our website uses essential cookies to function correctly and optional analytics and preference cookies. You can manage your cookie choices at any time via our Cookie Policy page. Essential cookies cannot be disabled as they are necessary for the site to work.

6. Your Rights

Under Malaysia's PDPA 2010 and general data protection principles, you have the following rights regarding your personal data:

• Access: You may request a copy of the personal data we hold about you.
• Correction: You may request that inaccurate or incomplete data be corrected.
• Withdrawal of consent: Where processing is based on consent, you may withdraw consent at any time.
• Objection to processing: You may object to processing where we rely on legitimate interest as the legal basis.
• Erasure: In certain circumstances, you may request that we delete your personal data.

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days.

If you have a concern about how we have handled your data, you may raise it with the Department of Personal Data Protection Malaysia (Jabatan Perlindungan Data Peribadi).

7. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites, and this policy applies only to information collected by Drumlin. We encourage you to review the privacy policies of any external sites you visit.

8. Children's Privacy

Our services are intended for use by businesses and individuals aged 18 and over. We do not knowingly collect personal data from individuals under 18. If we become aware that data has been submitted by someone under 18, we will delete it promptly.

9. Policy Updates

We may update this policy from time to time. Significant changes will be noted on this page with a revised "Last Updated" date. Continued use of our website after changes take effect constitutes acceptance of the updated policy.