Privacy Policy

1. Introduction

Orrundo ("we", "us", "our") is committed to protecting the personal data of individuals who interact with our website and services. This policy explains how we collect, use, store, and protect personal information in connection with our business change advisory services, in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA).

This policy applies to visitors of our website at orrundo.pro, enquirers, and clients who engage with Orrundo in any capacity. By using our website or submitting an enquiry, you acknowledge the practices described here.

For questions about this policy, please contact us at [email protected].

2. What Personal Data We Collect

We may collect the following categories of personal data:

• Full name
• Email address
• Phone number (if provided)
• Organisation name and role (if provided)
• Correspondence and messages sent through our contact form
• Technical data including IP address, browser type, and usage data collected via cookies and analytics tools

How data is collected: We collect personal data when you submit an enquiry through our contact form, communicate with us by email or phone, or interact with our website. We also collect limited technical data automatically when you visit our website.

Legal basis for processing: We process personal data on the basis of: (a) your consent, where obtained; (b) the performance of a contract or pre-contractual steps at your request; and (c) our legitimate interest in operating our advisory practice and responding to enquiries.

Retention: Enquiry data is retained for up to 24 months unless an engagement is formalised, in which case data related to the engagement is retained for 5 years for legal and administrative purposes.

3. How We Use Personal Data

We use personal data for the following purposes:

• Responding to enquiries and assessing whether an engagement is appropriate
• Delivering agreed advisory services to clients
• Communicating about engagement progress and deliverables
• Invoicing and maintaining engagement records
• Improving our website and understanding how it is used
• Complying with legal obligations

We do not use personal data for marketing purposes without your explicit consent. You may withdraw consent for any marketing communication at any time by contacting us at [email protected].

Third-party sharing: We do not sell personal data to third parties. We may share data with service providers who assist with website hosting, analytics, or email communication — only to the extent necessary and under appropriate data processing terms. We may also disclose data where required by law or legal process.

4. Data Protection Measures

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or misuse. These include:

• Use of encrypted connections (HTTPS) for our website
• Access controls limiting who within Orrundo can access client data
• Secure storage of engagement documents and correspondence
• Regular review of our data handling practices

In the event of a data breach that may affect your personal data, we will notify you and the relevant authority in accordance with our obligations under the PDPA.

5. Cookies

Our website uses cookies to support basic functionality and to understand how visitors use the site. We categorise cookies as essential, analytics, and preference-related. You can manage your cookie preferences at any time through our Cookie Policy page.

View our Cookie Policy →

6. Your Rights Under the PDPA

Under Malaysia's Personal Data Protection Act 2010, you have the following rights regarding your personal data:

• Right of access: You may request a copy of the personal data we hold about you.
• Right of correction: You may request that inaccurate or incomplete data be corrected.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.
• Right to limit processing: You may request that we limit how we use your data in certain circumstances.
• Right to prevent processing for direct marketing: You may opt out of any marketing communications at any time.

To exercise any of these rights, please contact us at [email protected]. We will respond within 21 days. If you believe we have not handled your data appropriately, you may lodge a complaint with the Department of Personal Data Protection Malaysia (PDPD).

7. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any external sites you visit.

8. Children's Privacy

Our services are directed at businesses and professionals. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have inadvertently collected such data, we will delete it promptly.

9. Policy Updates

We may update this policy periodically to reflect changes in our practices or applicable law. When we do, we will update the "Last Updated" date at the top of this page. Continued use of our website after any update constitutes acceptance of the revised policy. For significant changes, we will take reasonable steps to notify affected individuals.

10. Contact Us

If you have any questions or concerns about this policy or how we handle your personal data, please contact: