Privacy Policy

Calmara Desk ("we", "us", "our") is committed to handling personal data responsibly and in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA). This policy explains what information we collect, how we use it, how long we keep it, and what rights you have in relation to it.

We provide document organisation, shared calendar coordination, and extended family coordination services. The nature of our work means we sometimes encounter personal and sensitive information. This policy describes how we treat that information.

If you have questions about this policy or your data, please contact us at [email protected].

We collect personal data in the following ways:

From enquiry and contact forms

• Full name
• Email address
• Phone number (if provided)
• The content of any message you send us

From service engagements

• Names of all participating household members (as provided to us)
• Contact details for coordination purposes
• Session notes and written summaries created during our work
• Document indexes created during Paperwork Sorting Sessions
• Shared calendar contents and handover records

From website use

• Basic analytics data (page visits, browser type) via cookies — see Section 5 and our Cookie Policy
• Technical information such as your IP address

Legal basis for processing

We process personal data on the basis of: (a) your consent, given when you submit our contact form or sign our scope document; (b) the performance of a contract, where we need your data to carry out the service you have engaged us for; and (c) legitimate interests, for basic site analytics and to maintain our business records.

We use the personal data we collect for the following purposes:

• Responding to enquiries submitted through our contact form
• Delivering the service you have engaged us for (sorting sessions, calendar setup, coordination programme)
• Sending written summaries and records from sessions
• Keeping a record of referrals made during sessions
• Managing our business operations and client records
• Improving our website based on general usage patterns
• Complying with our legal obligations under Malaysian law

We do not use your personal data for marketing purposes unless you have specifically asked to receive updates from us. We do not sell, rent, or share your personal data with third parties for their own purposes.

Third-party services

We use a small number of third-party services that may process data on our behalf. These include: website analytics tools (which collect anonymised usage data) and encrypted cloud storage for document archives in the Extended Family Coordination Programme. These providers are bound by appropriate data processing agreements.

We apply the following retention periods:

• Enquiry data (contact forms): Kept for 12 months from the date of submission, then deleted.
• Session notes and written summaries: Kept for six months after the end of an engagement, then destroyed.
• Document archives (Extended Family Programme): Kept for the duration of the nine-month programme and for three months after it ends. After that, the original is destroyed; encrypted copies already transferred to client households remain with those households.
• Scope documents and signed agreements: Kept for seven years for legal compliance purposes, then securely destroyed.
• Website analytics data: Retained for 26 months on a rolling basis.

We take reasonable steps to protect the personal data we hold. These include:

• Encryption of digital documents and archives at rest
• Password-protected access to files containing client information
• Limiting access to client data to staff directly involved in the relevant engagement
• Physical destruction of paper session notes after the retention period
• Secure deletion of digital records after their retention period

In the event of a data breach involving your personal data, we will notify you and, where required, the relevant authorities, within a reasonable timeframe.

Our website uses cookies for essential functionality and basic analytics. Essential cookies are necessary for the site to work. Analytics cookies collect anonymised data about how the site is used; these can be declined using the cookie preference control that appears when you first visit the site.

We do not use advertising cookies or tracking cookies that follow you across other websites.

For full details of the cookies we use and how to manage them, please see our Cookie Policy.

Under Malaysia's Personal Data Protection Act 2010, you have the following rights in relation to the personal data we hold about you:

• Right of access: You can request a copy of the personal data we hold about you.
• Right of correction: You can ask us to correct any inaccurate personal data.
• Right to withdraw consent: Where we process your data based on your consent, you can withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
• Right to limit processing: You can ask us to stop using your data for certain purposes.
• Right to object: You can object to processing that is based on our legitimate interests.

To exercise any of these rights, please contact us at [email protected]. We will respond within 21 days. We may need to verify your identity before acting on a request.

If you are not satisfied with how we have handled your data or responded to a request, you may contact the Department of Personal Data Protection Malaysia (JPDP) at pdp.gov.my.

Our website and session materials may include links or references to other websites or public bodies. We are not responsible for the privacy practices of those sites. We encourage you to read their privacy notices before providing any personal information.

Our services are intended for adults aged 18 and over. We do not knowingly collect personal data directly from anyone under the age of 18. In some coordination arrangements, information about minor children (such as school pickup times in shared calendar work) may be included as part of the logistics being coordinated. This information is handled with the same care as all other personal data and is subject to the same retention and protection measures.

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of the page. If changes are material, we will notify active clients by email. Your continued use of our services after a policy update constitutes acceptance of the revised policy.