Privacy Policy

1. Who We Are

The data controller is Gradient Yard, located at Jalan Tun Razak 128, 50400 Kuala Lumpur, Malaysia. For data-related enquiries, contact us at [email protected].

Our processing of personal data is conducted in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA), which governs the handling of personal data in commercial transactions.

2. Data We Collect

We collect personal data in the following circumstances:

• Enquiry forms: name, email address, phone number (optional), and the content of your message.
• Enrolment: name, email address, phone number, and payment-related data processed through our payment provider. We do not store full card details.
• Website usage: browser type, pages visited, session duration, and referral source, collected through cookies and analytics tools if you have consented to their use.

Legal basis for processing: Enquiry data is processed on the basis of your consent (submitting the form). Enrolment data is processed to fulfil the contract of enrolment. Analytics data is processed on the basis of consent, collected via cookie controls.

Retention: Enquiry data is retained for up to 12 months after the enquiry is resolved or the relevant intake closes. Enrolment data is retained for as long as is required under Malaysian law (typically 7 years for financial records) and then deleted. Analytics data is retained per the terms of the analytics service used, typically no more than 26 months.

3. How We Use Personal Data

• Responding to enquiries about tracks and intakes.
• Administering enrolments, including sending session details, exercise materials, and completion records.
• Processing payments through our payment provider.
• Improving the website and course materials using aggregated analytics data.
• Complying with legal obligations under Malaysian law.

We do not use personal data for marketing without your explicit consent. We do not sell personal data to third parties.

4. Data Sharing

We share personal data with third parties only where necessary:

• Payment processing: your payment data is handled by our payment provider under their own privacy terms.
• Analytics: aggregated, anonymised usage data may be processed by analytics tools we use to understand site performance. This data does not identify individual users.
• Legal requirements: we may disclose data where required by law, court order, or government authority in Malaysia.

For team programmes, the employer receives capability summaries for their participants. These are the defined outputs of the programme. No other participant data is shared with employers without the individual's consent.

5. How We Protect Personal Data

• Data transmitted to and from this website uses TLS encryption.
• Access to personal data is restricted to staff who need it to perform their role.
• Our systems are reviewed periodically for security vulnerabilities.
• In the event of a data breach that is likely to result in harm, we will notify affected individuals and the relevant authority as required under the PDPA.

6. Cookies

This website uses cookies. Essential cookies are required for the site to function. Optional cookies (analytics, marketing, preference) are used only with your consent, which you can provide or withdraw at any time using the cookie controls at the bottom of the homepage.

See our Cookie Policy for a full description of the cookies used and how to manage them.

7. Your Rights

Under the Personal Data Protection Act 2010, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate personal data.
• Withdraw consent for processing where consent is the legal basis, without affecting the lawfulness of processing before withdrawal.
• Request deletion of your personal data, subject to our legal obligations to retain certain records.
• Object to processing where we are relying on legitimate interest as the legal basis.

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days. If you believe your data has been handled incorrectly, you may lodge a complaint with Malaysia's Department of Personal Data Protection (JPDP).

8. Third-Party Links

This website may contain links to external sites. We are not responsible for the privacy practices of those sites. We recommend reading their privacy policies before submitting personal data to them.

9. Children's Privacy

Our services are intended for individuals aged 18 and above. We do not knowingly collect personal data from anyone under 18. If you believe a minor has submitted data through our site, contact us at [email protected] and we will remove it.

10. Updates to This Policy

We may update this policy periodically. Changes will be posted on this page with a revised effective date. Continued use of the site after changes are posted constitutes acceptance of the updated policy.