Privacy Policy

Last Updated: 10 April 2026  |  Effective: 10 April 2026

1. Introduction

Crestholm ("we", "us", "our") is committed to handling your personal data with care and transparency. This Privacy Policy explains what personal information we collect, why we collect it, how we use it, and what rights you have in relation to it.

This policy applies to all personal data collected through our website at crestholmad, through our contact forms, and through the course of providing our consulting services. By using our website or engaging our services, you acknowledge the practices described in this policy.

For questions related to data privacy, please contact us at privacy@crestholmad.

2. Data Controller

Crestholm operates from 42 Jalan Semantan, Damansara Heights, 50490 Kuala Lumpur, Malaysia. We act as the data controller for personal information collected through our website and during our consulting engagements.

3. Personal Data We Collect

3.1 Information You Provide

• Full name and job title
• Business email address
• Phone number (optional)
• Message content submitted through our contact form
• Company name and industry (if provided)

3.2 Information Collected Automatically

• IP address and browser type (via web server logs)
• Pages visited and time spent on site
• Referring website or search terms (analytics cookies, where consented)
• Device type and operating system

3.3 Information Collected During Engagements

When you engage our consulting services, we may receive financial records, management accounts, and related business data. This information is governed by our engagement agreement and treated as strictly confidential. It is not used for marketing, shared with third parties, or retained beyond the engagement period unless expressly agreed.

4. How We Use Your Data

• To respond to enquiries submitted through our contact form
• To scope and deliver consulting engagements
• To send relevant information about our services if you have consented
• To improve our website based on aggregated, anonymized usage data
• To comply with our legal and regulatory obligations under Malaysian law

We do not use your personal data for profiling, automated decision-making, or targeted advertising.

5. Legal Basis for Processing

• Consent — for optional marketing communications and non-essential cookies
• Contractual necessity — to deliver services you have engaged us for
• Legitimate interest — to respond to enquiries, improve our website, and manage our business operations
• Legal obligation — to comply with applicable Malaysian laws, including the Personal Data Protection Act 2010 (PDPA)

6. Data Retention

Contact form submissions are retained for up to 24 months from the date of submission. Engagement-related financial data is retained for the duration of the engagement and for a reasonable period afterward to manage any post-delivery queries, after which it is securely deleted. We do not retain data longer than necessary for the purpose it was collected.

7. Data Sharing

We do not sell, rent, or trade your personal data. We may share data in the following limited circumstances:

• With service providers who support our operations (e.g., email hosting, analytics), bound by data processing agreements
• With professional advisors (e.g., lawyers, accountants) under confidentiality obligations
• Where required by Malaysian law or a court order

All third parties are required to handle your data in accordance with applicable data protection law.

8. Cookies

Our website uses cookies to support basic functionality and, with your consent, to understand how the site is used. For a full description of the cookies we use and how to manage your preferences, please see our Cookie Policy.

9. Data Security

We take reasonable technical and organizational measures to protect personal data against unauthorized access, loss, or disclosure. These measures include access controls, secure data storage, and regular review of our data handling practices. In the event of a data breach that poses a significant risk to your rights, we will notify affected individuals in accordance with our obligations under the PDPA.

10. Your Rights

Under the Personal Data Protection Act 2010 (Malaysia), you have the following rights in relation to your personal data:

• Right of access — to request a copy of the personal data we hold about you
• Right to correct — to request correction of inaccurate or incomplete data
• Right to withdraw consent — to withdraw consent for processing where consent is the legal basis
• Right to limit processing — to request that we restrict how we use your data in certain circumstances
• Right to object — to object to processing carried out on the basis of legitimate interest

To exercise any of these rights, please contact us at privacy@crestholmad. We will respond within 21 days.

11. Third-Party Links

Our website may contain links to third-party sites. We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies before providing any personal data.

12. Children's Privacy

Our services are directed to business professionals and are not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us immediately.

13. Policy Updates

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this page. Continued use of our website following any changes constitutes your acknowledgment of the updated policy.

14. Contact

For privacy-related enquiries, please contact us at:

• Email: privacy@crestholmad
• Address: 42 Jalan Semantan, Damansara Heights, 50490 Kuala Lumpur, Malaysia
• Phone: +60 3-2093 6418

Supervisory authority: Department of Personal Data Protection Malaysia (JPDP) — www.pdp.gov.my