Privacy Policy

1. Introduction

Stardrift Labs takes the handling of personal data seriously. We collect only the data we need to operate our programmes, communicate with participants, and maintain records required by law. This policy explains what we collect, why we collect it, how it is stored, and what rights you have over it.

This policy is written in plain language. If anything is unclear, contact us at [email protected].

2. What Data We Collect

We collect the following categories of personal data:

• Contact details: Full name, email address, and optionally a phone number — collected via the enquiry form on our website.
• Programme records: Enrolment details, cohort assignment, practice notebook submissions, and completion status.
• Payment records: Transaction reference numbers and payment confirmation details. We do not store card details directly.
• Communication records: Emails and messages exchanged with our team.
• Technical data: IP address, browser type, and page visit data collected via cookies and analytics tools.

Legal basis for processing: Contact data submitted via the enquiry form is processed on the basis of your consent. Programme records are processed on the basis of contract (to deliver the programme you enrolled in). Analytics data is processed on the basis of our legitimate interest in understanding how the website is used.

Retention periods: Enquiry data is retained for 12 months if no enrolment follows. Programme records are retained for 3 years following programme completion. Payment records are retained as required by Malaysian financial regulations.

3. How We Use Your Data

• To respond to enquiries and assist with programme selection.
• To manage enrolment, cohort scheduling, and programme delivery.
• To send programme-related communications — session schedules, notebook releases, milestone reminders.
• To issue course completion records to participants who meet the submission requirements.
• To maintain financial records in compliance with Malaysian law.
• To improve the website and programme materials using anonymised analytics data.

We do not use your data for marketing purposes without your explicit opt-in. We do not sell or share your personal data with third parties for their own commercial use.

4. Data Protection Measures

We take reasonable technical and organisational measures to protect the data we hold. These include:

• Data transmitted to and from our website is encrypted via HTTPS/TLS.
• Access to participant data is restricted to staff members who require it to operate programmes.
• Third-party services that process data on our behalf are selected for their data handling practices.
• In the event of a data breach that affects your personal data, we will notify affected individuals within a reasonable timeframe.

5. Cookies

We use cookies to operate this website. Essential cookies are required for basic functionality. Optional analytics and preference cookies are only placed with your consent, managed via the cookie banner on the homepage. Full details are in our Cookie Policy.

6. Your Rights

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data held by Stardrift Labs:

• Right to access: Request a copy of the personal data we hold about you.
• Right to correction: Request correction of inaccurate or incomplete data.
• Right to withdraw consent: Withdraw consent for processing where consent is the legal basis. Note that withdrawal does not affect processing already completed.
• Right to limit processing: Request that we limit how we use your data in certain circumstances.
• Right to object: Object to processing based on legitimate interest.

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days.

If you believe your data has been handled incorrectly, you may raise a complaint with the Department of Personal Data Protection Malaysia (JPDP) at pdp.gov.my.

7. Third-Party Links

Our website and programme materials may include links to external resources. We are not responsible for the privacy practices of those external sites. We recommend reviewing the privacy policy of any external service you access via links from our materials.

8. Children's Privacy

Our programmes are designed for adults aged 18 and over. We do not knowingly collect personal data from persons under 18. If you believe data has been submitted by a minor, contact us and we will delete it promptly.

9. Policy Updates

We may update this policy from time to time. Material changes will be communicated by email to current programme participants and by notice on this page. Continued use of our website or participation in our programmes after a policy update constitutes acceptance of the revised policy.

10. Contact

For any data-related enquiries: