Privacy policy
How Think Risk International Sdn Bhd collects, uses, shares and protects personal data under Malaysia’s Personal Data Protection Act 2010 and, where it applies, the EU and UK GDPR.
We respect your privacy. This policy explains what personal data we collect through this website and when you deal with us, why we collect it, who we share it with, how long we keep it, and the rights you have. It is our written notice under section 7 of the Personal Data Protection Act 2010 (“PDPA”), as amended by the Personal Data Protection (Amendment) Act 2024.
1. Who we are
Think Risk International Sdn Bhd (Registration No. 202501024430 (1625843V)) of Block D, Platinum Sentral, Jalan Stesen Sentral 2, Level 3–5, Kuala Lumpur, 50470 Malaysia (“Think Risk International”, “we”, “us”, “our”) is the data controller (formerly “data user”) for the personal data described in this policy. We are part of the Think Risk group, with offices in Australia, Malaysia and the Philippines.
For any question about this policy or your personal data, contact us at [email protected] with the subject line “Personal data”.
2. Scope of this policy
This policy applies to personal data we process when you:
- visit thinkriskinternational.com.my (the “website”);
- send us an enquiry through a form on the website or by email;
- discuss, propose or receive our services, as a client, prospective client or a client’s representative; and
- otherwise correspond with us.
Personal data we receive while delivering an engagement (for example, employee records reviewed during an internal audit or investigation) is handled under the written engagement terms agreed with our client, who is usually the data controller for that data. This policy does not replace those terms.
3. Personal data we collect
Information you give us
- Enquiry details: your name, work email address, company, phone number (optional), the service you are interested in, and the message you write.
- Your consent record: confirmation that you agreed to us using your details to reply to your enquiry.
- Correspondence: anything you send us by email or tell us when we speak, including your job title and business contact details.
- Client information: if you become a client, the contact, billing and contract details needed to deliver and invoice our services.
Information collected automatically
- Enquiry context: which page and which form you used, and, if you arrived through a campaign link, the campaign tags in that link (for example
utm_source,utm_campaignor a Google Ads click ID). - Technical data: your IP address, browser type, device type, the pages requested and the date and time, recorded in our web server’s security logs and used briefly to stop spam and abuse.
- Analytics: only if you accept analytics cookies, information about how you use the website (pages viewed, time on page, approximate location derived from your IP address, device and referring site), collected by Google Analytics. See section 9.
Sensitive personal data
We do not ask for sensitive personal data (such as information about health, religious beliefs, political opinions, the commission of an offence, or biometric data) through the website. Please do not include it in an enquiry. If an engagement requires it, we will handle it only as permitted by section 40 of the PDPA and the engagement terms.
If you do not provide your data
Your name, email address, the service you need and your consent are required to send an enquiry. Without them we cannot reply to you. Everything else is optional.
4. Why we use it, and our legal bases
| Purpose | Data used | PDPA basis | GDPR basis (where it applies) |
|---|---|---|---|
| Replying to your enquiry and sending an automatic acknowledgement | Enquiry details, correspondence | Your consent (s.6(1)(a)); steps taken at your request with a view to entering a contract (s.6(2)(b)) | Steps at your request before a contract (Art. 6(1)(b)); legitimate interests in answering business enquiries (Art. 6(1)(f)) |
| Preparing proposals, entering into and delivering engagements, invoicing | Client information, correspondence | Performance of a contract with you (s.6(2)(a)), or your consent where you act for your organisation (s.6(1)(a)) | Contract (Art. 6(1)(b)) |
| Understanding which pages and campaigns bring enquiries | Enquiry context | Consent given with your enquiry | Legitimate interests in measuring our marketing (Art. 6(1)(f)) |
| Website analytics | Analytics data | Consent through the cookie notice | Consent (Art. 6(1)(a)) |
| Keeping the website secure and preventing spam and abuse | Technical data | Your consent when using the website, and our duty to keep personal data secure (s.9) | Legitimate interests in security (Art. 6(1)(f)) |
| Meeting legal, regulatory, tax and professional obligations; establishing or defending legal claims | Any of the above, as needed | Compliance with a legal obligation (s.6(2)(c)); the administration of justice (s.6(2)(e)) | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
We do not sell or rent personal data. We do not make decisions about you based solely on automated processing, and we do not profile you.
5. Who we share it with
We disclose personal data only for the purposes above, and only to:
- Our service providers (data processors), who act on our instructions under contract and must keep the data secure:
- Amazon Web Services, Inc. (Singapore region): website hosting and the delivery of enquiry emails (Amazon Simple Email Service);
- our business email provider, which hosts the [email protected] mailbox ; and
- Google LLC (Google Analytics), only if you accept analytics cookies.
- The Think Risk group (Think Risk in Australia and its delivery team in the Philippines), where they help us respond to you or deliver an engagement, under intra-group arrangements that require the same standard of protection.
- Professional advisers such as our lawyers, auditors and insurers, under a duty of confidentiality.
- Authorities such as regulators, law enforcement and courts, where the law requires or permits it.
- A purchaser or successor of all or part of our business, under the same protections.
If you choose to load the map on our Contact page, or follow a link to Google Maps or another website, that provider receives your data under its own privacy policy. The map does not load until you click “Show map”.
6. Transfers outside Malaysia
Some of the recipients above are outside Malaysia, mainly in Singapore (Amazon Web Services), Australia and the Philippines (the Think Risk group), and the United States (Google, if you accept analytics). We transfer personal data abroad only as section 129 of the PDPA, as amended, allows. This means the destination has a law substantially similar to the PDPA or ensures an adequate level of protection, or we have taken reasonable precautions and exercised due diligence, for example contractual data protection clauses with the recipient. This follows the Personal Data Protection Commissioner’s Cross-Border Personal Data Transfer Guidelines.
For data subject to the GDPR, transfers rely on an adequacy decision or the European Commission’s Standard Contractual Clauses (and the UK Addendum). You can ask us for a copy of the relevant safeguards.
7. How long we keep it
We keep personal data only for as long as the purpose requires, then delete or anonymise it securely (PDPA s.10, Retention Principle).
| Record | How long |
|---|---|
| Enquiries that do not lead to an engagement | Up to 24 months after our last contact with you |
| Client, contract and billing records | For the engagement, then for as long as Malaysian law requires. For example, accounting records are kept for seven years under the Companies Act 2016. |
| Web server security logs | Up to 90 days |
| Analytics data (if you consented) | 14 months (our Google Analytics data-retention setting), then deleted automatically |
Enquiries are not stored in the website’s database. They are delivered by email and kept in our mailbox under the periods above.
8. How we protect it
We take practical steps to protect personal data from loss, misuse, modification and unauthorised access or disclosure (PDPA s.9, Security Principle). These include:
- encrypting all traffic to the website (HTTPS, with HSTS);
- sending email through Amazon SES with domain authentication (SPF, DKIM, DMARC);
- hosting the website in an isolated environment with its own database, separate from other sites;
- limiting access to personal data to the people who need it, and protecting accounts with strong authentication;
- adding spam protection and rate limits to our forms; and
- holding our service providers to security obligations in their contracts.
No system is completely secure. Please do not send confidential documents through the enquiry form; we will agree a secure method with you.
9. Cookies and browser storage
The website does not use advertising cookies. It uses a small amount of storage in your browser, as follows.
| Name | Type | Purpose | Duration |
|---|---|---|---|
tr-consent | Strictly necessary (local storage) | Remembers your analytics cookie choice | Until you clear it |
tr-popup-snooze, tr-enquiry-sent | Functional (local storage) | Stops the enquiry pop-up from showing again too soon or after you have sent an enquiry | 7 days / until you clear it |
tr-attr | Functional (local storage) | Remembers the campaign link that first brought you to the site, sent only with an enquiry | Until you clear it |
tr-loaded | Functional (session storage) | Shows the opening animation once per visit | Until you close the tab |
_ga, _ga_<ID> | Analytics cookies (Google Analytics) | Distinguishes visitors and sessions to produce usage statistics | Up to 2 years. Set only if you click “Accept”. |
Analytics runs in Google Consent Mode: until you accept, no analytics cookies are set. To change your choice, clear this website’s data in your browser settings; the notice will appear again. You can also block cookies in your browser, and the website will still work.
10. Your rights
Under the PDPA you have the right to:
- Access the personal data we hold about you, and receive a copy (s.30);
- Correct personal data that is inaccurate, incomplete, misleading or out of date (s.34);
- Withdraw your consent to processing at any time, by written notice (s.38);
- Ask us to stop processing that causes, or is likely to cause, substantial and unwarranted damage or distress (s.42);
- Stop direct marketing at any time (s.43); and
- Data portability: ask us to transmit your personal data to another data controller, where technically feasible and the format is compatible (s.43A).
How to make a request. Email [email protected] with the subject line “Personal data request”, or write to us at our registered address. We may ask you to verify your identity first. We respond to access and correction requests within 21 days, as the PDPA requires. If we need longer, we will tell you why in writing within that period, and complete the request within a further 14 days. We may charge the fee allowed under the Personal Data Protection (Fees) Regulations for a copy of your data, and we may refuse a request in the cases the PDPA permits. If we refuse, we will tell you why.
Withdrawing consent does not affect processing that already took place. If you withdraw consent to us replying to an enquiry, we will not be able to respond to it.
11. Visitors in the European Union and United Kingdom (GDPR)
If the EU General Data Protection Regulation or the UK GDPR applies to our processing of your data, for example because you contact us from the EU or the UK about our services, the following applies in addition to the sections above.
- Controller: Think Risk International Sdn Bhd, contactable as set out in section 1.
- Legal bases: as listed in the table in section 4.
- Your rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection to processing based on legitimate interests, and to direct marketing at any time (Art. 21), and withdrawal of consent at any time (Art. 7(3)). We respond within one month, which can be extended by two further months for complex requests. We will tell you if we extend it.
- International transfers: see section 6.
- Complaints: you may lodge a complaint with the data protection authority in the EU country where you live or work, or where the issue arose, or in the UK with the Information Commissioner’s Office. We would appreciate the chance to address your concern first.
12. Marketing
We do not send marketing emails unless you have asked to receive them. Every marketing message includes a simple way to opt out, and you can opt out at any time by emailing us. Replying to your enquiry is not marketing.
13. Children
The website and our services are intended for businesses, not for children. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, please contact us and we will delete it.
14. Data breaches
If a personal data breach occurs, we will notify the Personal Data Protection Commissioner as soon as practicable, and within 72 hours where the law requires. If the breach causes or is likely to cause you significant harm, we will tell you without unnecessary delay, including what happened and what you can do to protect yourself. Where the GDPR applies, we will notify the relevant supervisory authority and you as that regulation requires.
15. Changes to this policy
We may update this policy to reflect changes in the law or in how we work. The “Last updated” date at the top shows the current version. If we make a significant change, we will make it clear on this page.
16. Contact and complaints
Think Risk International Sdn Bhd
Block D, Platinum Sentral, Jalan Stesen Sentral 2, Level 3–5, Kuala Lumpur, 50470 Malaysia
Email: [email protected]
If you are not satisfied with our response, you may complain to the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi) at www.pdp.gov.my.
Language
This policy is available in English and Bahasa Malaysia. If the two versions are inconsistent, the English version prevails, to the extent permitted by law.
