Privacy Policy

1. Scope of This Policy

This Privacy Policy applies to personal data collected through our website at deepffiield, through email correspondence, phone enquiries, and during the course of our AI supply chain consulting engagements. It covers data relating to individuals who contact us, submit enquiries, or engage our services.

This policy does not extend to third-party websites linked from our site. We are not responsible for the data practices of those external services.

2. What Data We Collect

We collect personal data only when it is reasonably necessary for the purposes described in this policy. The types of data we may collect include:

Directly Provided Data

• Full name and job title
• Business email address and phone number
• Company name and industry
• Message content from contact forms or email correspondence
• Information shared during project scoping discussions

Automatically Collected Data

• IP address and browser type
• Pages visited and time spent on site
• Referring URL and device type
• Cookie identifiers (see Section 7 for details)

3. Legal Basis for Processing

Under the PDPA 2010, we process personal data on the following grounds:

• Consent: Where you have provided explicit consent, such as completing our contact form or subscribing to communications.
• Contractual necessity: Where processing is needed to fulfil an engagement or service agreement with your organisation.
• Legitimate interests: For purposes such as maintaining business records, responding to enquiries, and improving our services — provided this does not override your rights.
• Legal compliance: Where processing is required to meet our obligations under Malaysian law.

4. How We Use Your Data

Personal data collected by Deepfield is used for the following purposes:

• Responding to enquiries and scheduling consultations
• Delivering and managing AI supply chain consulting engagements
• Sending relevant service information or project updates (with consent)
• Improving our website and understanding how visitors use it
• Maintaining internal business and accounting records
• Complying with legal and regulatory requirements in Malaysia

We do not use personal data for automated decision-making or profiling that significantly affects individuals.

5. Data Retention

We retain personal data only for as long as is necessary for the purpose for which it was collected or as required by applicable Malaysian law:

• Enquiry and contact form data: up to 24 months from date of last contact
• Client project records: up to 7 years following project completion, consistent with business record-keeping norms
• Website analytics data: retained in aggregate form for up to 26 months
• Marketing consent records: retained until withdrawal of consent plus 12 months

When data is no longer required, it is securely deleted or anonymised.

6. Data Sharing with Third Parties

Deepfield does not sell personal data to third parties. We may share data only in the following limited circumstances:

• Service providers: We may use third-party tools for analytics, communication, or project management. These providers process data only under our instruction and are bound by appropriate data processing agreements.
• Legal obligations: Where required to disclose data to Malaysian regulatory bodies or law enforcement agencies under applicable law.
• Business transfers: In the unlikely event of a business restructuring, personal data may be transferred to a successor entity, subject to equivalent protections.

Third-party services currently in use may include Google Analytics for website usage data and email communication tools. These services have their own privacy policies which we encourage you to review.

7. Cookies and Tracking Technologies

Our website uses cookies to improve functionality and understand usage patterns. We use the following categories of cookies:

• Essential cookies: Required for the website to function correctly. These cannot be disabled.
• Analytics cookies: Help us understand how visitors interact with our site. Collected in aggregate and non-identifiable form where possible.
• Preference cookies: Remember your cookie consent settings and other site preferences.

You can manage your cookie preferences at any time via our Cookie Policy page. Withdrawing consent for optional cookies will not affect the core functionality of the site.

8. Data Protection Measures

We take the security of your personal data seriously. Technical and organisational measures in place include:

• HTTPS encryption for all data transmitted via our website
• Access controls limiting data access to relevant personnel only
• Regular review of data handling practices
• Secure deletion protocols for data no longer required

In the event of a data breach that is likely to harm affected individuals, we will notify the relevant parties and, where appropriate, the Personal Data Protection Commissioner in accordance with Malaysian obligations.

9. Your Rights Under PDPA 2010

As a data subject under Malaysian law, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right of correction: Request correction of inaccurate or incomplete data.
• Right to withdraw consent: Withdraw consent for processing at any time, where consent is the basis for processing.
• Right to limit processing: Request that we restrict how your data is used in certain circumstances.
• Right to raise a complaint: Lodge a complaint with the Personal Data Protection Commissioner of Malaysia if you believe your rights have been infringed.

To exercise any of these rights, please contact us at [email protected]. We will respond within 21 days of receiving your request.

10. Children's Privacy

Our services are directed exclusively at business professionals and organisations. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has submitted data to us, please contact us and we will promptly remove it.

11. Third-Party Links

Our website may include links to external sites for reference purposes. We do not control those sites and are not responsible for their privacy practices. We recommend reviewing the privacy policy of any external site before sharing personal information.

12. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The "Last Updated" date at the top of this page indicates when the most recent changes were made. Continued use of our website after changes are posted constitutes acceptance of the revised policy.

For material changes, we will make reasonable efforts to notify users via the website or direct communication where appropriate.

13. Contact Details

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact: