Legal
Privacy Policy
How Croxena handles information shared with us — on this site and through our engagements.
Last reviewed: April 2025
Introduction
Our approach to your information
Croxena is a business consulting firm based in Kuala Lumpur, Malaysia. We take a considered approach to personal information — collecting only what is necessary, holding it with care, and not putting it to uses the person who shared it would not reasonably expect.
This policy describes the information we may collect through this website and through our consulting engagements, how we use it, and the choices available to you. It applies to all personal data processed by Croxena in connection with our services and this website.
By using this website or engaging our services, you acknowledge the practices described here. If something is unclear, you are welcome to write to us at [email protected].
1. Who we are
Data controller
The data controller for personal information processed through this website and our engagements is:
- Croxena (Business Consulting)
- Level 16, Etiqa Twins Tower 1, Jalan Pinang, 50450 Kuala Lumpur, Malaysia
- Telephone: +60 3-2095 7384
- Email: [email protected]
If you have any questions about how your personal information is handled, the contact details above are the right place to start.
2. What we collect
Information we may receive from you
We collect information in the following ways:
Through this website
When you complete the contact form on our site, you may share your name, the name of your organisation, your email address, your telephone number, and a brief description of what you are working on. We use this to respond to your enquiry and, where appropriate, to arrange an initial conversation.
We also collect standard technical data that is passed automatically by your browser when you visit any website — including your IP address, browser type, operating system, the pages you visit, and the time of your visit. This data is used for site security, performance monitoring, and broad traffic analysis. It is not used to build personal profiles.
Through consulting engagements
In the course of an engagement, you may share with us commercial and financial information relating to your firm, as well as contact details for individuals at your organisation. This information is used solely for the purposes of the engagement and is not disclosed to third parties unless we are required to do so by law or you have given us explicit permission.
Cookies and tracking technologies
This site uses cookies. A separate Cookie Policy describes these in more detail. You may adjust your browser settings to restrict or block cookies; please note that some parts of the site may not function correctly if you do.
3. How we use it
Purposes and legal grounds
We use personal information for the following purposes:
- To respond to enquiries submitted through our contact form
- To conduct and deliver consulting engagements
- To send correspondence relating to an engagement or a request you have made
- To maintain records required by law or professional standards
- To monitor and improve the performance and security of this website
We do not use personal information for automated decision-making, and we do not use it to send unsolicited marketing communications. If you contact us and subsequently choose not to proceed with an engagement, we will retain your enquiry details only for as long as reasonably necessary to respond to any follow-up questions, after which they are removed from active records.
4. Sharing and disclosure
Who may see your information
We do not sell, rent, or trade personal information. We may share it in the following limited circumstances:
- Service providers. We may use third-party service providers for hosting, email delivery, and analytics. These providers are permitted to use your data only to perform the services we have engaged them for, and are required to handle it with appropriate care.
- Legal obligations. We may disclose information where required to do so by applicable Malaysian law, a court order, or a regulatory authority.
- With your consent. We may share information in any other way you have specifically agreed to.
When we work with service providers outside Malaysia, we take steps to ensure that appropriate safeguards are in place for cross-border transfers of personal data, consistent with the requirements of the Personal Data Protection Act 2010 (Malaysia).
5. Retention
How long we keep information
We retain personal information for as long as is reasonably necessary for the purposes described in this policy. In practice:
- Enquiry data (contact form submissions that do not lead to an engagement) is held for up to twelve months and then removed from active records.
- Engagement records are retained for a minimum of seven years from the conclusion of the engagement, in line with standard commercial record-keeping practice in Malaysia.
- Website technical logs are typically retained for no longer than ninety days.
Where retention is no longer justified, we take reasonable steps to securely delete or anonymise the relevant information.
6. Your rights
What you may ask us to do
Under the Personal Data Protection Act 2010 and other applicable law, you have the right to:
- Request access to personal information we hold about you
- Request correction of inaccurate or incomplete information
- Withdraw consent to processing where consent is the basis on which we hold your data
- Request that we cease processing your data for direct marketing purposes
To exercise any of these rights, write to us at [email protected]. We will respond within a reasonable time and in any case within thirty days of receiving a clear and complete request. There is no charge for reasonable requests.
7. Security
How we protect information
We take reasonable and appropriate steps to protect personal information against loss, unauthorised access, disclosure, alteration, and destruction. This includes access controls, secure transmission protocols for this website, and internal handling procedures for engagement materials.
No transmission over the internet is entirely without risk. If you have reason to believe that your interaction with us has been compromised, please contact us without delay.
8. Changes to this policy
Updates and revisions
We may update this policy from time to time to reflect changes in our practices or in applicable law. When we do, we will revise the "last reviewed" date at the top of this page. If changes are material, we will make reasonable efforts to bring them to your attention.
We encourage you to review this page periodically. Continued use of this website after a revision constitutes acceptance of the updated policy.
9. Contact
Getting in touch
If you have questions about this policy or about how we handle your personal information, you are welcome to reach us at:
- Email: [email protected]
- Telephone: +60 3-2095 7384
- Post: Level 16, Etiqa Twins Tower 1, Jalan Pinang, 50450 Kuala Lumpur, Malaysia
We will do our best to respond promptly and plainly.