Privacy Policy

1. Introduction

rafflesi ("we", "us", "our") operates the website at rafflesi.club and provides watch repair and restoration services from 88 Lebuh Chulia, 10200 George Town, Pulau Pinang, Malaysia. This policy explains how we collect, use, and protect personal information provided to us through this website and through our studio services.

This policy applies to information collected via web enquiry forms, email correspondence, and in-studio intake records. We are committed to handling personal data in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia.

2. Data We Collect

When you submit a web enquiry or visit the studio, we may collect:

• · Name and contact details (email address, telephone number)
• · A description of the watch piece and the service requested
• · Postal address, if a piece is sent by mail
• · Payment records (receipt data only; card details are not stored by us)

Our website may also collect standard server logs including IP addresses and browser type via analytics tools. This data is not linked to individual identities.

Legal basis: Data collected through enquiry forms is processed on the basis of your consent. Data collected in connection with a service transaction is processed as necessary to fulfil a contract. Server log data is processed on the basis of our legitimate interest in maintaining website security and performance.

Retention: Enquiry data is held for 24 months from the date of last contact. Service records associated with a completed repair are retained for five years for warranty and documentation purposes, then securely deleted.

3. How We Use Your Data

• · To respond to your service enquiry or booking request
• · To provide and document the watch repair or inspection service
• · To contact you about the status of your piece during service
• · To issue receipts and maintain studio records
• · To improve the website based on anonymised usage data

We do not sell personal data. We do not use personal data for advertising profiling. We do not send unsolicited marketing communications — any follow-up from us relates only to service-related matters.

4. Data Protection Measures

Website data is transmitted over HTTPS. Studio records are stored in locked cabinets and password-protected systems accessible only to rafflesi staff. Access is restricted to individuals who require the information to perform their duties.

In the event of a data breach that is likely to result in a risk to your rights, we will notify affected individuals within a reasonable timeframe and take appropriate remedial steps.

5. Cookies

This website uses cookies to support basic functionality and to understand how pages are used. You can review and manage your cookie preferences at any time via our Cookie Policy page. Essential cookies cannot be disabled as they are required for the website to function.

6. Your Rights

Under the PDPA 2010, you have the right to:

• · Request access to the personal data we hold about you
• · Request correction of inaccurate data
• · Request erasure of data where retention is no longer necessary
• · Withdraw consent to processing where consent is the legal basis
• · Object to processing based on legitimate interests
• · Lodge a complaint with the Department of Personal Data Protection Malaysia

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days.

7. Third-Party Links

This website may contain links to external websites. We are not responsible for the privacy practices of those sites. We recommend reviewing the privacy policy of any third-party site you visit.

8. Children's Privacy

Our services are not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has submitted data through this website, please contact us and we will remove it promptly.

9. Policy Updates

We may update this policy from time to time. Material changes will be indicated by a revised "Last Updated" date at the top of this page. Continued use of this website following an update constitutes acceptance of the revised policy.