Privacy Policy

The Workshop collects the following personal data categories:

• Identity data: full name, as provided at intake or via the website contact form.
• Contact data: email address and telephone number.
• Service data: watch description, calibre reference, fault description, and condition photographs taken at intake. This data relates to the watch, not the person, but may be associated with a customer record.
• Transaction data: service fees paid and invoice records retained for legal and accounting purposes.
• Technical data: IP address, browser type, and pages visited when using the website. Collected via cookies and analytics services where consent has been given.

Data is collected directly from the customer at intake, through the website contact form, or via email or telephone enquiry. No data is collected from third parties without the customer's knowledge.

Legal basis for processing: contract performance (servicing the watch), legitimate interest (responding to enquiries, maintaining business records), and consent (website analytics and marketing cookies, where applicable).

Retention periods: Customer contact data and service records are retained for seven years after the service is completed, in accordance with standard accounting and legal record-keeping obligations under Malaysian law. Website analytics data is retained for up to 26 months. Enquiry data not resulting in a service engagement is deleted after 12 months.

Personal data is used for the following purposes:

• Providing and managing the requested watch repair or assessment service.
• Communicating about the status of a service engagement, including scope changes and collection arrangements.
• Issuing invoices and processing payments.
• Maintaining service records that may be referenced in future engagements.
• Responding to enquiries submitted via the website or by telephone.
• Improving the website through aggregated, anonymised analytics data.

The Workshop does not use personal data for unsolicited marketing communications. No personal data is sold or transferred to third parties for commercial purposes.

Third-party disclosure: Personal data is shared with the off-site dial restoration specialist only where the customer has elected dial restoration work, and only to the extent necessary to carry out that work (typically: the customer's first name and a watch reference number). The specialist operates under a confidentiality arrangement with the Workshop.

The Workshop uses the following measures to protect personal data:

• Website served over HTTPS with current TLS configuration.
• Customer records stored on access-controlled systems.
• Physical intake records held on premises with restricted access.
• Email communications with the Workshop are handled via a managed mail service with encryption in transit.

In the event of a data breach that poses a risk to customer rights, affected customers will be notified within a reasonable timeframe and the matter reported to the relevant authority as required under Malaysian PDPA provisions.

The website uses cookies to function and, where consent is given, to analyse usage patterns. Cookie categories used:

• Essential cookies: required for the website to operate. Cannot be disabled.
• Analytics cookies: collect anonymised usage data to help the Workshop understand which pages are useful. Active only with visitor consent.
• Preference cookies: remember visitor settings such as cookie consent status.

Cookie preferences can be managed at any time via the Cookie Policy page.

Under Malaysia's Personal Data Protection Act 2010, and where applicable under other data protection frameworks, you have the following rights:

• Right of access: to request a copy of personal data held about you.
• Right of correction: to request correction of inaccurate personal data.
• Right to withdraw consent: for data processed on the basis of consent (e.g. analytics cookies). Withdrawal does not affect data already processed.
• Right to object: to the processing of personal data for direct marketing (the Workshop does not engage in direct marketing, but this right is noted for completeness).
• Right to limit processing: in certain circumstances.

To exercise any of these rights, contact the Workshop in writing at [email protected] or by post to 142 Jalan Burma, 10050 Georgetown, Penang. Requests will be responded to within 21 days.

Complaints regarding data handling may be directed to the Department of Personal Data Protection Malaysia (JPDP) at pdp.gov.my.