Privacy Policy

1. Introduction

Ironwood Lai (referred to as "we", "us", or "our") is a retail strategy consultancy operating from Suite 12A, Menara Landmark, Jalan Penang, 10000 George Town, Penang, Malaysia. We are committed to handling any personal information you share with us carefully and responsibly.

This Privacy Policy explains what personal data we collect when you use our website or contact us about our services, how we use it, and what rights you have over it. Our services are directed at business owners and professionals in the retail sector — we do not offer services to the general public in a consumer capacity.

This policy applies to all personal data we process in connection with our website at ironwoody.club and our consultancy services. If you have questions, contact us at [email protected].

2. Data We Collect

We collect a limited set of personal data, primarily when you contact us through the enquiry form on our website or when we conduct a consultancy engagement with you.

2.1 Website enquiry form

• Full name (required)
• Email address (required)
• Phone number (optional)
• Message content (optional)

2.2 Consultancy engagements

During a consultancy engagement, we may receive additional business information including your business name, address, and operational details. This information is used solely to carry out the agreed scope of work.

2.3 Website analytics

We may use analytics tools that collect anonymised data about how visitors use our website, including pages viewed and general geographic location. This does not identify individuals. See our Cookie Policy for more detail.

3. How We Use Your Data

We use the personal data we collect for the following purposes:

• To respond to your enquiries and discuss potential engagements
• To deliver the retail advisory services you have engaged us for
• To send you information about our services where you have asked for it
• To maintain records of completed engagements for quality and legal purposes
• To improve our website based on anonymised usage information

We do not sell, rent, or share your personal data with third parties for their own marketing purposes. We do not use your data for automated decision-making.

4. Legal Basis for Processing

We process your personal data under the following bases, consistent with Malaysia's Personal Data Protection Act 2010 (PDPA):

• Consent: when you submit an enquiry form, you consent to us contacting you
• Contract performance: when we deliver a consultancy engagement you have paid for
• Legitimate interests: maintaining records of past engagements and improving our services
• Legal obligation: retaining financial records as required under Malaysian law

5. Data Retention

We retain personal data for no longer than is necessary for the purpose it was collected:

• Enquiry form data from contacts who did not become clients: deleted after 6 months
• Client engagement records: retained for 7 years for legal and accounting purposes
• Analytics data: retained in anonymised form only

6. Data Protection Measures

We take reasonable precautions to protect your personal data from unauthorised access, disclosure, or loss. These include:

• Use of HTTPS on our website for encrypted data transmission
• Restricting access to personal data to staff directly involved in your enquiry or engagement
• Secure storage of digital records with access controls
• Prompt notification to affected individuals in the event of a data breach, as required by applicable law

7. Cookies

Our website uses cookies for basic functionality and, where you consent, for analytics purposes. For full information about which cookies we use and how to manage them, please see our Cookie Policy.

8. Your Rights

Under the Malaysia Personal Data Protection Act 2010 (PDPA), you have the following rights in relation to your personal data:

• Access: to request a copy of the personal data we hold about you
• Correction: to request that inaccurate data be corrected
• Withdrawal of consent: to withdraw consent for processing where consent is the legal basis
• Restriction: to request that we limit how we use your data in certain circumstances
• Complaint: to lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP)

To exercise any of these rights, email us at [email protected]. We will respond within 21 days.

9. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any external site you visit through a link on our website.

10. Children's Privacy

Our services and website are directed exclusively at adults (18 years and over) operating retail businesses. We do not knowingly collect personal data from anyone under 18. If you believe a minor has submitted personal data to us, please contact us at [email protected] so we can delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. Continued use of our website or services following any change constitutes your acknowledgement of the updated policy.

12. Contact

If you have any questions about this policy or how we handle your data, please contact: