Privacy Policy

Who we are

This website is operated by Upcial Marketing, a sole proprietorship registered in Malaysia (SSM No. KT0614641-T), based in Penang. We provide professional website design and development services to insurance, reinsurance, and financial services firms in Malaysia.

This Privacy Policy explains how we collect, use, store, and protect personal data submitted through this website, in accordance with Malaysia's Personal Data Protection Act 2010 (Act 709), as amended by the Personal Data Protection (Amendment) Act 2024, which came into force in stages during 2025 — with the headline duties (mandatory Data Protection Officer appointment and 72-hour breach notification) in force from 1 June 2025.

Data Protection Officer (DPO)

In line with Section 12A of the amended PDPA, Upcial Marketing has appointed a Data Protection Officer responsible for ensuring compliance with the Act and for handling data subject enquiries and requests.

What personal data we collect

We collect personal data only when you voluntarily submit it through the forms on this website — the contact enquiry form and the checklist request form. This includes:

• Your full name
• Your work email address
• Your organisation name
• Your industry sector
• Any details you include in the message field

We do not collect sensitive personal data as defined under the PDPA (including biometric data, health information, or financial account details). We do not use tracking cookies or behavioural analytics on this website.

How we use your personal data

We use the personal data you submit exclusively to:

• Respond to your enquiry
• Send you a resource you have requested (such as the credibility checklist) — sent once, with no follow-up unless you ask
• Assess whether your project is within our scope and expertise
• Schedule and conduct a discovery call if you request one
• Communicate with you during the course of an engagement, if one is agreed

We do not use your personal data for marketing purposes without your explicit consent. We do not sell, rent, or share your personal data with third parties for commercial purposes.

Legal basis for processing

Under the amended PDPA, we process your personal data on the basis of:

• Your consent — by submitting the contact form, you consent to us processing your data for the purposes described above.
• Contractual necessity — where processing is required to take steps at your request prior to entering into a service agreement.

You may withdraw your consent at any time by contacting our DPO (details above). Withdrawal does not affect the lawfulness of any processing already carried out.

How we store and protect your data

Enquiries submitted through this website are relayed directly to our mailbox via Resend, an email delivery service. Submissions are transmitted over an encrypted connection (HTTPS) and are not stored in any public-facing system; access to enquiry data is limited to Upcial Marketing personnel.

We take reasonable steps to ensure your data is protected from unauthorised access, disclosure, alteration, or loss. Access to submitted enquiry data is limited to Upcial Marketing personnel only.

Data breach notification

In the event of a personal data breach that is likely to result in risk or harm to data subjects, we will:

• Notify the Personal Data Protection Commissioner within 72 hours of becoming aware of the breach, in accordance with Section 12B of the amended PDPA and the PDPD Guidelines on Data Breach Notification.
• Notify affected data subjects within 7 days of the initial notification to the Commissioner, where the breach is likely to result in significant harm.

How long we retain your data

If no engagement results from your enquiry, we retain your contact information for up to 12 months from the date of your enquiry, after which it is deleted.

If an engagement is agreed, we retain project-related correspondence and documentation for up to 7 years from project completion, in line with Malaysian statutory record-keeping obligations.

Your rights under the PDPA

Under Malaysia's Personal Data Protection Act 2010 (as amended), you have the following rights in respect of personal data we hold about you:

• Right of access — request a copy of the personal data we hold about you.
• Right of correction — request correction of any personal data that is inaccurate, incomplete, misleading, or not up to date.
• Right to withdraw consent — withdraw your consent to our processing of your personal data at any time.
• Right to data portability — request that your personal data be transmitted directly to another data controller, where technically feasible, in accordance with Section 43A of the amended PDPA (in force from June 2025).

To exercise any of these rights, please contact our DPO using the details above. We will respond within 21 days of receiving your request.

Cross-border data transfers

Your personal data may be processed or stored outside Malaysia by our third-party service providers (see below). Where such transfers occur, we ensure they are conducted in accordance with the PDPA's cross-border transfer framework introduced by the 2024 Amendment, which requires that the recipient jurisdiction provides substantially similar data protection, or that appropriate contractual or other safeguards are in place.

Third-party services

This website uses the following third-party services:

• Cloudflare (cloudflare.com) — website hosting (Cloudflare Pages) and privacy-first, cookieless visitor analytics (Cloudflare Web Analytics). Servers are located globally, including outside Malaysia.
• Resend (resend.com) — relays contact-form submissions and our outbound email. Servers are located outside Malaysia (Asia-Pacific region).
• Google Fonts — typography delivery via Google's CDN. The font request necessarily transmits your IP address to Google as part of standard browser request headers; no other personal data is sent.
• GSAP / GreenSock — scroll animation library loaded from Cloudflare CDN. No personal data is collected.

We are not responsible for the privacy practices of these third-party services. We encourage you to review their respective privacy policies.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The "Last updated" date at the top of this page will be revised accordingly. Material changes will be communicated where practicable.

Contact and complaints

For questions about this Privacy Policy, to exercise your data subject rights, or to raise a complaint, please contact our Data Protection Officer:

If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commissioner of Malaysia via the Department of Personal Data Protection (JPDP): pdp.gov.my.