Privacy Policy.

At a glance

This summary is for convenience. The full policy below is what applies.

Who we are

Mênê Consulting (“Mênê”, “we”, “us”) is a marketing, public relations, branding and training consultancy based in Klang, Selangor, Malaysia. We decide how and why the personal data described in this policy is used, which makes us its data controller (the term used by Malaysia’s Personal Data Protection Act 2010 (“PDPA”) as amended in 2024, and by the EU and UK GDPR).

Registered office

Mênê Consulting, 26 Jalan Zapin 3A, Bandar Bukit Raja, 41050 Klang, Selangor, Malaysia

Data protection enquiries

letsconnect@meneconsulting.com, subject “Data request”

Telephone

+60 12 572 1618

Where we run a training programme or project for a client organisation and handle personal data only on its instructions, that organisation is the controller and its own privacy notice applies. We act as its processor.

What this policy covers

This policy applies to personal data we handle when you:

• visit this website;
• send us an enquiry by email, telephone, the enquiry form on our contact page, or social media;
• engage us for consultancy, branding, public relations, campaign or design work;
• attend, or are enrolled by your employer on, one of our training programmes;
• are a supplier, associate, freelancer or partner working with us.

We are a Malaysian business and the PDPA applies to everything we do. We work with people and organisations in other countries too, so this policy is written to meet the standard of the main privacy laws our visitors and clients live under — including the EU General Data Protection Regulation (“GDPR”), the UK GDPR, and the privacy laws of Singapore, Australia and US states such as California — and we give the rights described here to everyone, whether or not a particular law obliges us to.

It does not cover third-party websites we link to. Those sites have their own policies and we are not responsible for them.

Personal data we collect

Information you give us

• Enquiry details — your name, email address, telephone number, organisation, the type of work you are asking about and whatever you choose to put in your message.
• Engagement details — the names, job titles and contact details of the people we deal with at a client organisation, briefing material, approvals and correspondence.
• Training records — participant name, organisation, job title, contact details, attendance, assessment results and feedback, and where a claim is made to the Human Resource Development Corporation (HRD Corp), the information that scheme requires.
• Billing details — the information needed to raise and settle an invoice. We do not take card payments on this website.
• Supplier and associate details — contact, business and payment details of the people we work with.

Information from other sources

When an employer enrols you on a programme, we receive your details from that employer. We may also receive a colleague’s contact details from a client who introduces them to us for a project.

Information collected automatically

This website does not run analytics, advertising or tracking software, it sets no cookies, and it stores nothing in your browser. See our Cookie Policy.

Like every website, it cannot be delivered without your device’s IP address. Our hosting provider receives that address, together with the page requested, the time and your browser’s description of itself, in order to deliver the page, protect the site from attack, and keep standard access logs. We do not use these records to identify or profile visitors.

Sensitive personal data

We do not seek sensitive personal data — such as data about health, biometric data, religious beliefs or political opinions. Please do not include it in an enquiry. Where a training venue needs dietary or accessibility requirements, we collect only what is necessary to make the arrangements, with your explicit consent, and we delete it once the programme has run.

The enquiry form

The fields are your name, your email address, your organisation if you give one, the kind of work you are asking about and your message. Your email address is put in the reply-to line so that answering you is one click in our inbox; nothing else about your browser or your visit is attached to it. The email is then kept for the period shown under retention.

If our mail service cannot be reached, the form does not discard your enquiry and does not pretend to have sent it. It opens your own email application with the message prepared instead, and nothing leaves your device until you press send there yourself.

To stop the form being used to send bulk mail, the server may note the time of a submission and the address it came from, in memory only. That record is not written to disk, is not linked to the contents of your enquiry, and is gone within ten minutes.

Why we use it, and our legal basis

We use personal data only for the purposes below. The PDPA requires us to tell you the purpose; the GDPR and similar laws also require a legal basis, which is shown alongside.

We do not sell or rent personal data, and we do not share it for cross-context behavioural advertising. We do not make decisions about you by automated means alone, and we do not profile you. If we ever wanted to use your data for a new purpose, we would tell you first and, where the law requires it, ask for your consent.

Where we rely on legitimate interests you can object, and where we rely on consent you can withdraw it, as described under your rights.

Who we share it with

We disclose personal data only where it is necessary, and only to:

• Service providers acting for us — our website hosting, content delivery and email provider (Hostinger), and our IT, document storage and accounting providers, limited to what they need to provide their service.
• Our associate practices — where a brief calls for their specialism, we work with First Nurture Sdn Bhd and Aibots Sdn Bhd. We tell you when a third party is being brought into your project.
• HRD Corp — where an employer claims a training programme under the scheme, the participant information the scheme requires.
• Suppliers for a project — printers, venues, photographers and media partners, limited to what they need to perform their task.
• Professional advisers — accountants, auditors and lawyers, where required.
• Authorities — where we are required to disclose by law, court order or a regulator.
• A successor business — if our business is reorganised, merged or sold, to the organisation taking it over, which must continue to protect the data as this policy describes.

Where a provider processes personal data on our behalf, we require it by contract to keep the data secure, to use it only on our instructions, and not to retain it longer than necessary.

What this website loads

Every file this site asks your browser to fetch — every page, stylesheet, script, image and typeface — comes from meneconsulting.com. There is no third-party font service, no analytics, no advertising network, no tag manager and no embedded social media.

The site is delivered through our hosting provider’s content delivery network, which answers each visitor from a server near them. That provider is our processor, bound to use your IP address only to deliver and protect the site. No one else is told that you visited.

Earlier versions of this site loaded its typefaces from Google Fonts and its animation library from Cloudflare’s cdnjs. Both now ship with the site itself, so those disclosures no longer happen.

Our social media links are ordinary links. Nothing is loaded from Facebook, Instagram or LinkedIn on our pages, and those platforms learn nothing about your visit unless you click through to them, at which point their own policies apply.

International transfers

We are based in Malaysia, and some of our providers — including our hosting, content delivery and email provider — may process data on servers in other countries. If you contact us from outside Malaysia, your data will come to us in Malaysia.

We transfer personal data across borders only where the law allows it, and only what the purpose needs. That means the destination has laws giving comparable protection, or we have put safeguards in place — for data subject to the GDPR or UK GDPR, normally the standard contractual clauses approved for that purpose — or another lawful ground applies, such as the transfer being necessary for a contract with you. You can ask us for details of the safeguards used.

How long we keep it

When a retention period ends we delete the data or anonymise it so that it can no longer identify anyone. We may keep data longer only where the law requires it or it is needed for a legal claim.

How we protect it

We take practical technical and organisational steps to keep personal data secure, including access controls and strong authentication on the accounts and devices that hold it, reputable providers for email and file storage, encrypted HTTPS connections to this website with modern security headers, and limiting access to the people who need it for their work.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal data breach occurs, we will act promptly to contain it and will notify the relevant authority, and the people affected, where and within the time the law requires — under Malaysian law, the Personal Data Protection Commissioner as soon as practicable and within 72 hours, and, where the breach is likely to cause them significant harm, affected individuals without unnecessary delay and within seven days of notifying the Commissioner.

Your rights

Wherever you live, you can ask us to:

• Give you access to the personal data we hold about you, and tell you how it is used and who it has been shared with.
• Correct data that is inaccurate, incomplete or out of date.
• Delete your data, unless we have to keep it by law or for a legal claim.
• Give you a copy of data you provided, in a common machine-readable format, or send it to another organisation where that is technically feasible (data portability).
• Stop or limit processing that is causing or likely to cause you damage or distress, or that you object to where we rely on legitimate interests.
• Stop direct marketing. We will comply without question.
• Withdraw your consent, where we rely on it. This does not affect processing already carried out, and it may mean we can no longer provide a service to you.

You also have the right to complain to a data protection authority, listed under questions and complaints. We will never treat you differently, charge you more or give you a worse service for exercising any of these rights.

Rights under specific laws

Malaysia (PDPA)

Rights of access, correction, data portability, withdrawal of consent, and to prevent processing likely to cause damage or distress or for direct marketing. The PDPA permits a fee for some data access requests; we will tell you before charging anything.

European Union, EEA and United Kingdom (GDPR and UK GDPR)

Rights of access, rectification, erasure, restriction, portability and objection, and not to be subject to decisions based solely on automated processing. You may complain to the supervisory authority where you live or work, or where an infringement took place.

California and other US states

Rights to know, access, correct and delete personal information, and to opt out of its sale, sharing for targeted advertising, or profiling. We do not sell or share personal information and have not done so in the past twelve months, and we do not use sensitive personal information to infer characteristics about you. Browser signals such as Global Privacy Control are honoured as an opt-out, although this site has nothing to opt out of. You may use an authorised agent, and if we decline a request you may appeal by replying to our decision.

Singapore, Australia and elsewhere

Rights of access and correction under Singapore’s Personal Data Protection Act 2012 and the Australian Privacy Principles, and the equivalent rights under the privacy law of any other country you live in.

How to exercise your rights

Email letsconnect@meneconsulting.com with “Data request” in the subject line, or write to us at Mênê Consulting, 26 Jalan Zapin 3A, Bandar Bukit Raja, 41050 Klang, Selangor, Malaysia.

Please tell us what you are asking for and enough detail for us to find your records. We may ask you to confirm your identity before we act, so that we do not disclose or delete someone else’s data. If someone is asking on your behalf, we may ask for proof that you authorised them.

We aim to respond to every request within 21 days, the period the PDPA sets for access and correction requests, and within the time limit of any other law that applies to you (one month under the GDPR and UK GDPR; 45 days under California law). If we need longer, or cannot do what you ask, we will tell you why.

Children

This website and our services are aimed at organisations and working professionals, not children. We do not knowingly collect personal data from anyone under 18. Where a training programme involves participants under 18, we work through the school or organisation running it and rely on the consent it has obtained from a parent or guardian.

If you believe a child has given us personal data directly, contact us and we will delete it.

Changes to this policy

We review this policy when our practices change and at least once a year. The date at the top of this page shows when it was last revised. Where a change materially affects how we use data you have already given us, we will tell you directly rather than rely on you noticing the update.

Questions and complaints

If you have a question about this policy, or you are unhappy with how we have handled your personal data, contact us first at letsconnect@meneconsulting.com or +60 12 572 1618. We would rather hear about it and put it right.

You also have the right to complain to a data protection authority: