Legal
Privacy Policy
Last Updated: 14 April 2025
1. Introduction
Riverstone ("we", "us", "our") is committed to protecting the personal information of individuals who interact with our programmes and website. This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights in relation to it.
This policy applies to all personal data collected through our website at riversto.site and through our programme enrolment and communication processes. Our services are delivered in Kuala Lumpur, Malaysia, and this policy is written in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA).
If you have questions about this policy, contact us at [email protected].
2. Data We Collect
2.1 Information You Provide
When you submit an enquiry form, register for a programme, or contact us directly, we may collect:
- Full name
- Email address
- Phone number (optional)
- The content of any message you send us
2.2 Information Collected Automatically
When you visit our website, we may collect technical data including:
- IP address and browser type
- Pages visited and time spent
- Referring website or source
- Device type and operating system
This is collected through cookies and analytics tools. See Section 5 for more detail on cookies.
2.3 Legal Basis for Processing
We process personal data on the following grounds under the PDPA:
- Consent: Where you have agreed to receive communications or marketing materials from us.
- Contractual necessity: Where processing is necessary to fulfil a programme enrolment or enquiry you have initiated.
- Legitimate interests: For website analytics and service improvement, where your interests do not override ours.
2.4 Data Retention
We retain personal data for no longer than necessary. Enquiry data is held for up to 24 months. Enrolment records are kept for up to 36 months after programme completion. Analytics data is typically retained for 14 months before automatic deletion.
3. How We Use Your Data
- To respond to enquiries about our programmes
- To process and manage programme enrolments
- To send programme-related communications (schedules, updates, materials)
- To send marketing communications where you have opted in
- To improve our website and understand how visitors engage with it
- To comply with legal obligations under Malaysian law
We do not use your personal data to make automated decisions or carry out profiling activities.
3.1 Data Sharing
We do not sell personal data. We may share data with:
- Service providers: Email and website hosting providers who process data on our behalf under data processing agreements
- Analytics providers: Anonymised or aggregated data shared for website performance analysis
- Legal authorities: Where required by law or a valid legal process in Malaysia
3.2 Marketing Communications
We will only send marketing communications if you have given explicit consent. You can withdraw consent at any time by contacting us at [email protected] or by following the unsubscribe link in any marketing email.
4. Data Protection Measures
- Data transmitted through our website is protected via TLS/SSL encryption
- Personal data is stored on servers with restricted access and access logging
- Internal access to personal data is limited to staff with a direct need for it
- We review our data handling practices periodically
- In the event of a data breach that affects your rights, we will notify relevant individuals and the Communications and Multimedia Commission (MCMC) as required under applicable Malaysian law
5. Cookies
Our website uses cookies to function and to understand how visitors use it. Cookies are small text files stored on your device. We use the following types:
- Essential cookies: Required for the site to function. Cannot be disabled.
- Analytics cookies: Help us understand page views and user flow. Optional.
- Marketing cookies: Used for advertising and retargeting. Optional.
- Preference cookies: Store your settings and preferences. Optional.
You can manage your cookie preferences via the consent banner when you first visit the site, or at any time through our Cookie Policy page.
6. Your Rights Under the PDPA
As a data subject under Malaysia's Personal Data Protection Act 2010, you have the following rights:
- Right to access: Request a copy of the personal data we hold about you
- Right to correction: Request that inaccurate or incomplete data be corrected
- Right to withdraw consent: Withdraw marketing consent at any time without affecting lawful processing prior to withdrawal
- Right to limit processing: Request that we limit how we use your data in certain circumstances
- Right to lodge a complaint: If you are not satisfied with how we handle your data, you may lodge a complaint with the Department of Personal Data Protection (JPDP), the relevant supervisory authority in Malaysia
To exercise any of these rights, contact us at [email protected]. We will respond within 21 working days.
7. Third-Party Links
Our website may contain links to external websites. We are not responsible for the privacy practices of those sites and encourage you to review their policies independently before providing any personal information.
8. Children's Privacy
Riverstone's programmes are designed for adults (aged 18 and above). We do not knowingly collect personal data from individuals under 18. If we become aware that data from a minor has been submitted, it will be deleted promptly. If you believe a minor has provided us with personal information, please contact us at [email protected].
9. Changes to This Policy
We may update this policy from time to time. Any significant changes will be communicated via the website or by email where we hold your contact details. The date at the top of this page reflects the most recent revision. Continued use of our services after changes are published constitutes acceptance of the updated policy.
10. Contact
For privacy-related enquiries, please contact:
Riverstone
Jalan Maarof 142, 59100 Kuala Lumpur, Malaysia
Email: [email protected]
Phone: +60 3 2274 5896