Privacy Policy

1. Introduction

Lattica ("we", "us", "our") is a business consulting practice registered in Malaysia and operating from Level 23, Menara Allianz, Jalan Tun Razak, 50400 Kuala Lumpur. We are committed to handling personal data responsibly and transparently.

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and what rights you have in relation to it. It applies to personal data collected through our website and through our consulting engagement activities. This policy is issued in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA).

2. Data We Collect

We collect the following types of personal data:

• Contact information: Name, email address, and phone number (when provided via our contact form or during engagement communications).
• Professional information: Job title, organisation name, and role — shared by you as part of enquiries or engagement scoping.
• Communication content: Messages, notes, and documents shared during an engagement.
• Website usage data: Browser type, pages visited, and referral sources — collected through analytics cookies if you have given consent.

We collect data through our website contact form, direct email correspondence, and in the course of delivering consulting engagements.

3. Legal Basis and Purpose

We process personal data on the following bases:

• Consent: For analytics cookies and marketing communications. You may withdraw consent at any time.
• Contractual necessity: To deliver consulting services to clients who have engaged us.
• Legitimate interests: To respond to enquiries, improve our services, and maintain records of our work.

We use personal data to: respond to enquiries; deliver and document our consulting engagements; issue invoices and manage payment; send service-related communications; and improve our website and services.

4. Data Retention

We retain contact enquiry data for up to 12 months from the date of enquiry if no engagement follows. Client engagement data — including documents, notes, and communications — is retained for up to 5 years following the close of an engagement to comply with Malaysian accounting and business record requirements. Analytics data is retained for up to 26 months.

5. Data Sharing

We do not sell personal data to third parties. We may share data with:

• Service providers: Email hosting, cloud storage, and invoicing tools used to operate our business. These providers are contractually bound to handle data securely.
• Analytics services: If you have consented to analytics cookies, anonymised usage data may be processed by services such as Google Analytics.
• Legal compliance: Where required by Malaysian law or a lawful order from a competent authority.

6. Data Security

We use TLS encryption for all data transmitted through our website. Client documents and communications are stored on access-controlled cloud platforms. Access to personal data is limited to team members who require it to deliver services. In the event of a data breach that is likely to affect your rights, we will notify you as promptly as circumstances allow.

7. Cookies

We use cookies to support website functionality and, with your consent, to understand how visitors use our site. Our Cookie Policy explains the types of cookies used, their purpose, and how to manage your preferences.

8. Your Rights Under the PDPA

Under the Personal Data Protection Act 2010, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Withdraw consent where processing is based on consent
• Request that we stop processing your data for direct marketing purposes
• Enquire about the categories of data held and the purposes for which it is used

To exercise any of these rights, please contact us at [email protected]. We will respond within 21 days. In some cases, we may need to verify your identity before fulfilling a request.

If you have concerns about how we handle your data, you may contact the Personal Data Protection Commissioner of Malaysia via the Department of Personal Data Protection (JPDP) at www.pdp.gov.my.

9. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and encourage you to review their policies independently.

10. Children's Privacy

Our services are directed at business professionals aged 18 and over. We do not knowingly collect personal data from minors. If we become aware that personal data from someone under 18 has been submitted, we will delete it promptly.

11. Changes to This Policy

We may update this policy from time to time. The current version and its effective date will always be shown at the top of this page. Continued use of our website after a policy update constitutes acceptance of the revised terms.

12. Contact Us

For any privacy-related questions or to exercise your rights: