Our Commitment to Your Privacy
Studio Twenty Sdn. Bhd. ("Studio20", "we", "our", or "us") is committed to protecting the personal data of our clients, partners, and website visitors. This Privacy Policy is our notice under Malaysia’s Personal Data Protection Act 2010 (PDPA), as amended. It explains what personal data we collect, why we collect it, who we share it with, and the choices and rights you have.
This policy applies to personal data collected through our website at https://www.studio20.my (the "Website") and in the course of our business operations. Studio Twenty Sdn. Bhd. is the data controller for this personal data.
What Personal Data We Collect and Why
We collect personal data directly from you, and from your device when you use the Website. The types of data and the purposes are:
- Enquiry Data: Your name, email address, organisation, role, phone number, the topic you choose, your question, what you are running today, and the page you wrote from. We use it to reply to your enquiry, to email you an acknowledgement with a related article, to provide our services if you engage us, and to send you marketing communications if you have agreed to receive them.
- Security Data: When you submit an enquiry, we store a one-way hash of your IP address, never the address itself, to limit repeated submissions. The form also checks your browser to tell people from automated bots.
- Analytics Data (with your consent only): Pages visited, clicks, scrolling and mouse movement, session duration, device and browser type, approximate location, the site that referred you, and whether you sent an enquiry. We use it to understand how the Website is used and to improve it. The tools are listed under "Third-Party Services and Data Transfers" and "Cookie Policy" below.
Your name, email address, and question are required to send an enquiry. Without them we cannot reply. All other fields are optional.
We do not seek sensitive personal data, as defined in the PDPA (such as information about your health, religious beliefs, political opinions, or biometric data), through the Website. Please do not include it in an enquiry.
How We Obtain Your Consent
Enquiry Form
This Privacy Policy is linked beside the enquiry form. By submitting the form, you consent to us processing your enquiry data for the purposes listed under "What Personal Data We Collect and Why".
Cookie Notice
Analytics and session recording tools load only after you accept them in our cookie notice. If you decline, or make no choice, they do not load. You can change your choice at any time through "Cookie settings" at the foot of every page.
How We Use and Disclose Your Data
We do not sell, rent, or trade your personal data. We disclose it only to the following classes of third parties:
- Our Service Providers: Companies that host the Website and our database, deliver email, alert our team to new enquiries, and provide website analytics, as listed under "Third-Party Services and Data Transfers". They process your data on our instructions and are bound to protect it.
- Our Related Company: Our team in Singapore shares our enquiry system and may see your enquiry on a need-to-know basis.
- Professional Advisers: Our lawyers, auditors, and accountants, where needed for their work for us.
- Authorities: Where required by law, court order, or other legal process, or to protect our legal rights.
Third-Party Services and Data Transfers
We use the following third-party services to operate the Website:
- Vercel: Hosts the Website, receives enquiry form submissions, and runs the bot check on the form.
- Resend: Sends your acknowledgement email and our team’s notification email.
- Discord: Delivers new-enquiry alerts, including your enquiry details, to a private channel for our team.
- Google Tag Manager and Google Analytics (with your consent only): Measure Website traffic and usage. Google Analytics does not log or store IP addresses.
- Hotjar (with your consent only): Records how visitors move through pages (clicks, scrolling, and mouse movement) as session recordings and heatmaps, so we can find and fix problems with the Website. Hotjar does not record what you type into form fields.
These providers may store or process your personal data outside Malaysia, including in Singapore, the United States, and the European Union. We transfer personal data outside Malaysia only as permitted by section 129 of the PDPA, including where the recipient is bound to protect it to a standard at least equivalent to the PDPA.
How We Protect Your Data
We take practical steps to protect your personal data from loss, misuse, modification, unauthorised or accidental access or disclosure, alteration, or destruction. These include:
- Technical Safeguards: Encrypted (HTTPS) connections for the Website and the enquiry form, and access controls on our systems.
- Administrative Safeguards: Access to personal data limited to authorised personnel, and service providers bound by contract to protect it.
How Long We Keep Your Data
We keep personal data only for as long as needed for the purposes it was collected for, or as required by law:
- Enquiry Data: 2 years from our last communication, unless a business relationship is established.
- Client Data: For the duration of the client relationship and 7 years after it, for legal and accounting purposes under Malaysian law.
- Analytics Data: Up to 14 months in Google Analytics, and for the limited period set by Hotjar’s retention policy. Aggregated, anonymised statistics may be kept longer.
When the retention period ends, we securely destroy or permanently anonymise your personal data.
Your Data Protection Rights
Under the PDPA, you have the right to:
- Access: Request a copy of the personal data we hold about you. We may charge the fee the PDPA allows for this.
- Correction: Ask us to correct personal data that is inaccurate, incomplete, misleading, or out of date.
- Withdraw Consent: Withdraw your consent to our processing of your personal data at any time.
- Prevent Processing: Ask us to stop processing that is likely to cause you substantial damage or distress.
- Stop Direct Marketing: Ask us at any time to stop using your personal data for direct marketing.
- Data Portability: Ask us to transmit your personal data to another data controller, where technically feasible.
To exercise any of these rights, email info@studio20.my. We respond to access and correction requests within 21 days. If you are not satisfied with our response, you may complain to the Personal Data Protection Commissioner of Malaysia (https://www.pdp.gov.my).
Data Breach Notification
If a personal data breach occurs, we will notify the Personal Data Protection Commissioner within 72 hours of becoming aware of it. If the breach is likely to cause you significant harm, we will also notify you without unnecessary delay, as the PDPA requires.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised "Last updated" date. For material changes, we will give a more prominent notice, such as a banner on the Website.
Contact Us
For questions about this Privacy Policy, requests, or complaints about your personal data, contact us at:
Studio Twenty Sdn. Bhd.
Email: info@studio20.my
Website: https://www.studio20.my