Privacy Policy

This Privacy Policy describes how Pith & Co ("we", "us", "our") collects, uses, and handles personal information submitted through this website and in the course of providing interior design services. We take the privacy of every person who interacts with us seriously, and this document is written to be as clear and readable as possible.

1. Who We Are

Pith & Co is an interior design studio based at 11 Jalan Kemuja, Bangsar, 59000 Kuala Lumpur, Malaysia. We offer interior design consultations, spatial design services, and project realisation support for residential and boutique hospitality clients.

For the purposes of data protection, Pith & Co is the data controller for personal information collected through this website.

2. Information We Collect

We collect personal information in the following ways:

• Contact form submissions — when you fill out the contact or enquiry form on our website, we collect your name, email address, phone number (if provided), and the content of your message.
• Direct communications — when you contact us by email or telephone, we retain a record of that communication.
• Website usage data — we may collect non-identifiable technical data such as browser type, pages visited, and session duration through analytics tools. This data is aggregated and does not personally identify you.
• Cookies — our website uses cookies to remember your preferences and support basic functionality. Please see our Cookie Policy for details.

We do not collect sensitive personal data (such as health information, financial account details, or identification numbers) through this website.

3. How We Use Your Information

We use the personal information we collect for the following purposes:

• To respond to your enquiries and schedule consultations
• To deliver the interior design services you have engaged us for
• To send project-related correspondence, invoices, and documentation
• To improve our website and communications based on aggregated usage patterns
• To comply with any applicable legal obligations

We do not use your personal information for unsolicited marketing without your consent.

4. Legal Basis for Processing

Under Malaysia's Personal Data Protection Act 2010 (PDPA), we process your personal data on the following grounds:

• Consent — when you submit a contact form or enquiry, you consent to us using that information to respond and follow up.
• Contract performance — when you engage us for a service, processing your information is necessary to deliver that service.
• Legitimate interests — we may process certain data where we have a legitimate business reason, provided this does not override your rights.
• Legal obligation — in certain circumstances, we may be required to process or retain data to comply with applicable law.

5. Sharing Your Information

We do not sell, rent, or trade your personal information to third parties. We may share your information in the following limited circumstances:

• Service providers — we may share information with trusted vendors who support our business operations (such as email hosting or website analytics), under contractual confidentiality obligations.
• Contractors and suppliers — for project realisation engagements, we may share relevant information with contractors or materials suppliers as necessary to deliver the agreed scope of work. We will inform you before doing so.
• Legal requirements — we may disclose your information where required by law, court order, or regulatory authority.

In all cases, we share only what is necessary and take reasonable steps to ensure the information is handled appropriately.

6. How Long We Keep Your Information

We retain personal information only for as long as is necessary for the purposes described in this policy, or as required by applicable law.

• Enquiries that do not lead to a project: retained for up to 12 months, then deleted.
• Project records: retained for up to 7 years following project completion, for accounting and legal purposes.
• Marketing consent records: retained until you withdraw consent.

When personal data is no longer needed, it is securely deleted or anonymised.

7. Your Rights

Under the Personal Data Protection Act 2010 (Malaysia), you have the following rights regarding your personal data:

• Access — you may request a copy of the personal data we hold about you.
• Correction — you may ask us to correct inaccurate or incomplete data.
• Withdrawal of consent — where processing is based on consent, you may withdraw that consent at any time.
• Objection — you may object to processing of your personal data in certain circumstances.
• Deletion — you may request that we delete your personal data, subject to legal retention requirements.

To exercise any of these rights, please contact us using the details in Section 11. We will respond within a reasonable timeframe, and no later than 21 days.

8. Cookies

Our website uses cookies to support basic functionality and remember your cookie preferences. We do not use tracking or advertising cookies. For full details, please read our Cookie Policy.

9. Security

We take reasonable technical and organisational steps to protect your personal information from unauthorised access, alteration, or disclosure. These include secure data transmission (HTTPS), access controls, and periodic review of our data handling practices.

While we take these precautions seriously, no method of transmission over the internet is entirely without risk. If you have concerns about the security of information you have shared with us, please contact us directly.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we do, we will revise the "last updated" date at the top of this page. We encourage you to review this page periodically.

If changes are material, we will take reasonable steps to notify you — for example, by placing a notice on our website.

11. Contact Us

If you have any questions about this Privacy Policy, or wish to exercise your data rights, please contact us: