Privacy Policy

1. Data We Collect

We collect personal information only when it is necessary for programme administration, communication, or website operation. The categories of data we may collect include:

• Name and contact details (email address, telephone number) provided through our contact form or programme registration
• Enquiry or message content submitted through the contact form on our website
• Cookies and basic browsing data collected automatically when you visit our website (see Section 6 below)
• Financial and household information discussed during Private Household Review Engagements — this is treated under a separate, stricter standard described in Section 5

We do not collect sensitive personal data (such as health information, identity card numbers, or financial account numbers) through our website or contact form.

2. How and Why We Use Your Data

We use personal data collected through our website for the following purposes:

• Responding to enquiries submitted through the contact form — the legal basis is legitimate interest in communicating with prospective and current participants
• Sending programme information, session schedules, and registration confirmations — based on consent or contract performance
• Improving our website and understanding how visitors use it — based on consent for analytics cookies

We do not use personal data for direct marketing purposes without prior consent, and we do not sell or share personal data with third parties for their own marketing use.

We retain enquiry and registration data for a period of two years from the date of last contact, after which it is deleted. Programme attendance records may be retained for up to five years for administrative purposes.

3. Data Protection Measures

We take reasonable technical and organisational steps to protect personal data against unauthorised access, loss, or misuse. These include:

• HTTPS encryption for all data transmitted through our website
• Restricted access to stored personal data — only staff members who require access for programme administration are authorised to view it
• Secure deletion of data that has reached the end of its retention period
• Regular review of data handling practices to ensure ongoing compliance with PDPA 2010

In the event of a data breach that is likely to result in harm to any individual, we will notify the affected person as soon as practicable.

4. Third-Party Services

Our website may use the following third-party services, which may process data on our behalf:

• Google Analytics — to understand website usage. Data collected is anonymised and aggregated. Analytics cookies are only set with your consent.
• Google Maps — an embedded map on our homepage displays our studio location. This is served via an iframe and is subject to Google's own privacy terms.
• Cloudflare CDN — our website assets (fonts, icons) are loaded from Cloudflare and Google Fonts CDN.

We do not share your personal information with financial product providers, insurance companies, or investment platforms.

5. Household Engagement Information

Financial and household information discussed during the Private Household Review Engagement is subject to a stricter handling standard than the general personal data described above:

• Information discussed in sessions is used solely for the purpose of conducting the engagement
• No record of household financial details is retained by Sable & Co after the engagement closes and the folio is delivered to the household
• No household financial information is shared with any third party at any time
• Working notes used during the engagement are destroyed at the close of the engagement

6. Cookies

Our website uses cookies to operate correctly and, with your consent, to understand how visitors use the site. Essential cookies are always active. Analytics and preference cookies are only set if you accept them through the cookie consent notice on our homepage.

You can manage your cookie preferences at any time via our Cookie Policy page.

7. Your Rights Under PDPA 2010

Under the Personal Data Protection Act 2010, you have the following rights regarding personal data we hold about you:

• Right of access: You may request a copy of the personal data we hold about you
• Right of correction: You may request that inaccurate personal data be corrected
• Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time
• Right to limit processing: You may request that we stop using your data for a specific purpose

To exercise any of these rights, please write to us at [email protected]. We will respond within 21 days.

If you believe your rights under PDPA 2010 have not been respected, you may contact the Personal Data Protection Commissioner of Malaysia via the Ministry of Communications and Digital website.

8. Children's Privacy

Our programmes are designed for adults aged 18 and above. We do not knowingly collect personal data from persons under the age of 18. If you believe a minor has submitted personal data through our website, please contact us at [email protected] and we will remove it promptly.

9. External Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those websites and encourage you to read their privacy policies independently before providing any personal information.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. Continued use of our website or programmes after any changes constitutes acceptance of the updated policy. If changes are material, we will notify registered participants by email.