Privacy · PDPA 2010

Privacy page

Last updated 02 September 2026.

This page tells you how Brands With Purpose Sdn. Bhd. treats personal data when you visit https://brandswithpurpose.life/, write to the George Town studio, or work with us on purpose-led brand strategy. It is written under the Malaysian Personal Data Protection Act 2010. It is meant to be read in ordinary sentences. It is not legal advice addressed to your organisation.

The organisation

The person responsible for this site and for personal data collected through it is Brands With Purpose Sdn. Bhd. Our public address is Suite 12-A, Menara Boustead Penang, 39 Jalan Sultan Ahmad Shah, 10050 George Town, Pulau Pinang, Malaysia. Telephone +60 4-227 5390. The studio mailbox is hello@brandswithpurpose.life. Privacy letters should go to privacy@brandswithpurpose.life. Hours are Monday to Friday, 09:00–18:00 MYT (Asia/Kuala_Lumpur).

We provide professional communications services from Penang: purpose-led brand strategy, campaign architecture, creative direction and channel planning. We are a brand studio. We are not a bank, a licensed financial planner, or an issuer of investment products. Personal data is used to answer people who write to us and to carry out work they have asked us to do — not to decorate a public scoreboard.

People we may know by name

We handle data about visitors to these pages, people who send a conversation through the form, people who email hello@brandswithpurpose.life, people who telephone +60 4-227 5390, and people whose names appear in an engagement (for example a marketing lead listed in a kickoff note). If you send us someone else’s details, you are responsible for having a proper basis to do so.

What arrives in our hands

From the conversation form we collect name, email address, the message, the MYT time of sending, and the fact that PDPA consent was given. The form includes a decoy field named website2 which people should leave blank; if it is filled we treat the posting as automated and we do not send mail, though the visitor still sees a thank-you state. We do not ask for identity-card numbers, payroll files or payment-card numbers on this website.

From email and telephone we keep what you choose to tell us: typically name, organisation, role, a number to call back, and the content of the talk. From the website, a host may keep ordinary server logs (IP address, browser, path, time). From cookies we store a preference record as described on the cookie page. From Google Maps on the conversation page, Google may collect data as a third-party embed; see the maps paragraph below.

During an engagement we may hold brand materials, sitting notes, and names of people who attend. Those papers are confidential working files, not a public case study. We do not publish named-client result pairs on this site.

Why we use the data

We use personal data to keep the website running; to receive and answer notes sent through the form to hello@brandswithpurpose.life; to arrange sittings at Menara Boustead Penang; to write proposals and engagement letters; to deliver purpose-led brand strategy and campaign architecture; to invoice and keep accounts as Malaysian law requires; to keep the site and mailbox reasonably safe; and to answer rights requests. We do not sell personal data. We do not attach a newsletter form to the cookie tray. We do not feed enquiry text into a public model.

Conversation-form posts are the usual way new personal data arrives. The processor at /send.php lives on this domain only. The recipient mailbox is hello@brandswithpurpose.life — the same address in the colophon. A copy is not forwarded to an outside shared inbox. Reply-To is the visitor’s email so we can answer on the same thread.

Bases

Where the PDPA 2010 asks for consent, we ask for it. The conversation form includes an unticked consent box (consent_pdpa). Sending the form without that box ticked does not create a stored note. Consent can be withdrawn by writing to privacy@brandswithpurpose.life; withdrawal does not un-send a note already answered, but it will stop further optional use.

We also use data where it is needed to take steps you have asked for before a contract, and where it is needed to perform professional work you have engaged us to do. We use some data to meet accounting and tax duties. We use a little technical data to keep the site and mailbox safe. Where we rely on a legitimate interest (for example, remembering who we already answered so we do not duplicate a proposal), we keep the record short and weigh it against your rights.

How long we keep it

Enquiry records from the form, email and telephone are kept for as long as needed to handle the conversation and, if an engagement follows, for the life of that engagement plus a working archive of up to twenty-four months unless a longer period is required for accounts or a dispute. Cookie preference (key bwp_consent) is stored for 12 months, which is the real window this studio uses. Server logs follow the host’s ordinary rotation. If you ask us to delete data we will, unless we must keep a record to meet a legal duty or to establish, exercise or defend a claim.

Your rights

You may ask to see personal data we hold about you and ask us to correct data that is inaccurate, incomplete, misleading or not up to date. You may withdraw consent where processing rests on consent. You may ask us to stop a purpose you no longer agree with, subject to the PDPA 2010 and any competing legal duty. Write to privacy@brandswithpurpose.life and give us enough to find the record. We may need to check we are speaking to the right person. We aim to answer within a reasonable time in MYT working hours.

Cookies

This site uses a first-party preference cookie named bwp_consent with a 12-month life. It remembers whether you chose Allow all, Reject, or a custom maps choice. Necessary operation of the pages (serving HTML, sending a conversation) does not depend on advertising cookies; we do not run an advertising pixel here. Details, button labels (Allow all / Reject / Choose) and vendor notes live on the cookie page. The tray is a JavaScript widget, separate from the conversation form.

Google Maps embed

The conversation page includes a Google Maps embed showing a pin at Menara Boustead Penang, 39 Jalan Sultan Ahmad Shah. When that iframe loads, Google may collect technical data such as IP address, browser type, and interaction with the map, according to Google’s own notices. That collection is Google’s processing. If you reject embeds in the cookie tray, we still print the address, telephone and email so you can reach us without the iframe. You may also open the address in your own maps application. Visitors who prefer not to load Google’s embed can read the address block only.

Who else might see it

We share personal data with the web host and email host that make this domain work; with professional advisers when required; and with authorities if Malaysian law requires it. We do not keep a marketplace of buyers. If an engagement needs a specialist collaborator, we will say so in the proposal before their mailbox sees your note. International transfers, if any, are limited to hosting and email infrastructure; we still treat the PDPA 2010 as the governing privacy statute for this studio.

Looking after the files

We use HTTPS-ready hosting, mailbox access controls, and a processor that does not print mail-server errors to visitors. Rate limiting (five conversations per fifteen minutes from a given address) reduces automated noise. The decoy field reduces bot posts. No website can promise perfect safety. If we become aware of a breach that Malaysian law requires us to describe, we will follow that duty.

Young people

These pages are written for founders, marketing leads and brand managers. They are not directed at children. We do not knowingly collect personal data from children through the conversation form.

The authority

The Personal Data Protection Department (Jabatan Perlindungan Data Peribadi, JPDP) and the Personal Data Protection Commissioner administer the PDPA 2010 in Malaysia. If you are not satisfied with our reply, you may contact JPDP. We would rather mend an issue directly: write first to privacy@brandswithpurpose.life.

Revisions

We will update this page when our processing changes. The date at the top is the last revision. Material changes will be reflected here. Later visits follow the revised page. Historic notes remain governed by the page in force when they were sent, unless the law requires otherwise.

Change log

02 September 2026 — first publication of this page for the George Town studio site, covering conversation-form posts to hello@brandswithpurpose.life, email and telephone enquiries, cookies (bwp_consent, 12 months), and the Google Maps embed on the conversation page.

How to write

Privacy: privacy@brandswithpurpose.life. Studio: hello@brandswithpurpose.life. Post: Suite 12-A, Menara Boustead Penang, 39 Jalan Sultan Ahmad Shah, 10050 George Town, Pulau Pinang, Malaysia. Telephone +60 4-227 5390, Monday to Friday 09:00–18:00 MYT. If you prefer to speak in person, begin a conversation first so the table at Menara Boustead Penang is free.