Key points

• We collect only what we need to respond, deliver work, run operations, and keep things secure.
• We do not sell personal data.
• You can request access/correction and opt out of direct marketing.

Personal data we collect

Depending on how you use our Services, we may collect:

1. Information you provide
   • Name, email, phone number, company/role
   • Enquiries, briefs, timelines, budgets (if shared), messages and call/meeting notes
   • Materials you provide for projects (e.g., logos, images, brand assets, copy, guidelines)
2. Business and billing information
   • Billing information, invoice details, payment status
3. Marketing and events (optional)
   • Newsletter sign-ups, preferences, RSVPs
4. Website/device data
   • IP address, device/browser info, pages viewed, approximate location (city/country), cookie identifiers

How we use personal data

We use personal data to:

• communicate with you and respond to enquiries;
• prepare quotations, onboard clients, and deliver our branding/marketing services;
• manage operations (billing, records, administration)
• improve our Services (analytics, troubleshooting, quality control);
• maintain security, prevent abuse/fraud, and protect our rights; and
• send updates/marketing where permitted (you can opt out anytime).

We process personal data only where there is a valid purpose and an appropriate basis (including consent, service delivery, and legal/compliance needs). (This mirrors how major platforms explain “what we collect” and “why we collect it.” )

When we share personal data

We do not sell personal data.

We may share personal data on a need-to-know basis with:

• our staff and authorised contractors/collaborators (confidentiality required);
• service providers (hosting, cloud storage, email/CRM, collaboration tools);
• production partners (printing, photo/video vendors) where needed for your project;
• advertising/analytics platforms only if you request/authorise campaign work (e.g., Meta/Google/TikTok/LinkedIn);
• professional advisers (legal/audit/accounting); and
• regulators/authorities where required by law.

Client-provided lists and third-party data

If you provide personal data of others (e.g., customer lists, leads, staff/attendee lists), you confirm you have provided the required notices and obtained any necessary consents under PDPA.

Where we process such data on your instructions (e.g., campaign execution), you remain responsible as the data controller, and we act as a service provider within the agreed scope.

International transfers

Some of our tools/vendors may store or process data outside Malaysia. Where this happens, we take reasonable steps to apply safeguards consistent with PDPA expectations.

Security

We use reasonable organisational, technical, and physical safeguards to protect personal data. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Retention

We keep personal data only as long as needed for the purposes above, then delete or anonymise it, unless we must keep it longer for legal, tax, audit, dispute-resolution, or operational reasons.

Cookies and analytics

We use cookies and similar technologies to operate the website, remember preferences, understand usage, and improve performance. You can control cookies via browser settings and any cookie tools we provide. (This approach aligns with common cookie disclosures used by major websites.)

Your rights and choices

Subject to PDPA and applicable exemptions, you may:

• request access to your personal data;
• request correction of inaccurate/incomplete data; and
• withdraw consent / opt out of direct marketing at any time.

To make a request, email wearebrandfolks@gmail.com

We may verify your identity and may require information necessary to process your request.

Third-party links

Our website may link to third-party sites. Their privacy practices are governed by their own policies, and we are not responsible for them.

Changes to this Notice

We review this privacy policy on a regular basis to ensure that it is up-to-date with our use of your personal information, and compliant with applicable data protection laws. We reserve the right, at our discretion, to revise this privacy policy at any time. The updated privacy policy will be posted on our website. You are encouraged to review this privacy policy from time to time.