1. Introduction

This Privacy Policy explains how The Timber Space PLT ("The Timber Space", "we", "us", or "our") collects, uses, stores, and protects your personal information when you visit our website at thetimberspace.com, contact us via WhatsApp or email, or book our venue and services.

We are committed to protecting your privacy and handling your personal data in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia.

By using our website or engaging our services, you consent to the practices described in this policy.

2. Information We Collect

We collect personal information in the following ways:

Information you provide directly: - Name, email address, and phone number when submitting an enquiry or booking form - Event details including date, guest count, and type of occasion - Payment information processed through our secure payment partners - Communications sent to us via WhatsApp, email, or our contact form

Information collected automatically: - Website usage data including pages visited, time spent, and browser type - Device information and IP address - Cookies and similar tracking technologies (see Section 7)

Information from third parties: - Booking and scheduling data from Calendly when you book a venue viewing - Analytics data from Google Analytics about how visitors use our website

3. How We Use Your Information

We use your personal information for the following purposes:

• To respond to your enquiries and provide venue booking services
• To process and confirm your event booking and payment
• To communicate with you about your booking, including updates and reminders
• To send venue viewing confirmations and follow-up communications
• To improve our website and services based on usage patterns
• To comply with our legal obligations under Malaysian law
• To send occasional marketing communications about our venue and services, where you have given consent

We will never sell your personal information to third parties.

4. Legal Basis for Processing

Under the PDPA 2010, we process your personal data on the following grounds:

• Contractual necessity — to fulfil a booking or service agreement with you
• Legitimate interests — to operate and improve our business, respond to enquiries, and prevent fraud
• Consent — for marketing communications and non-essential cookies
• Legal obligation — to comply with applicable Malaysian laws and regulations

5. Sharing Your Information

We may share your personal information with the following parties only where necessary:

• Service partners — caterers, photographers, decorators, and other vendors engaged to deliver services for your event, who are bound by confidentiality obligations
• Payment processors — to securely process deposits and payments
• Calendly — to facilitate venue viewing bookings
• Google Analytics — for anonymised website usage analytics
• Legal authorities — where required by law, court order, or regulatory requirement

We do not share your personal information with any other third parties without your explicit consent.

6. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes outlined in this policy, including:

• Booking and event records — 7 years from the event date, in accordance with financial record-keeping requirements
• Enquiries that did not result in a booking — 12 months from the date of last contact
• Marketing consent records — until you withdraw consent
• Website analytics data — as per Google Analytics' standard retention settings (26 months)

After the applicable retention period, your data is securely deleted or anonymised.

7. Cookies

Our website uses cookies — small text files stored on your device — to improve your browsing experience. We use the following types of cookies:

• Essential cookies — necessary for the website to function correctly
• Analytics cookies — to understand how visitors use our website (Google Analytics)
• Functional cookies — to remember your preferences and settings

You can control cookie settings through your browser preferences. Disabling certain cookies may affect website functionality. Where required by law, we obtain your consent before placing non-essential cookies.

8. Your Rights

Under the PDPA 2010 and applicable privacy laws, you have the following rights regarding your personal data:

• Right of access — to request a copy of the personal data we hold about you
• Right to correction — to request correction of inaccurate or incomplete data
• Right to withdraw consent — to withdraw consent for marketing communications at any time
• Right to limit processing — to request that we limit how we use your data in certain circumstances

To exercise any of these rights, please contact us at hello@thetimberspace.com. We will respond within 21 days of receiving your request.

9. Data Security

We take reasonable technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Secure HTTPS encryption on our website
• Restricted access to personal data within our team
• Secure third-party payment processing
• Regular review of our data handling practices

However, no method of transmission over the internet is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

10. Third-Party Links

Our website may contain links to third-party websites including Oasis Coworking (oasiskl.co), Instagram, Facebook, and WhatsApp. We are not responsible for the privacy practices of these platforms. We encourage you to review their respective privacy policies before providing any personal information.

11. Children's Privacy

Our services are intended for individuals aged 18 and above. We do not knowingly collect personal information from children under 18. If you believe we have inadvertently collected information from a minor, please contact us immediately at hello@thetimberspace.com and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The updated policy will be published on this page with a revised "Last updated" date. We encourage you to review this policy periodically.

For significant changes, we will notify you by email where we hold your contact details.