Privacy Policy Summary

Definitions

This section defines terms used throughout the privacy policy to ensure clarity about data handling practices and user rights.

Purposes of Processing

We process personal data for specific purposes that enable service provision, account management, communications and legal compliance. Processing is limited to what is necessary and proportionate.

• To administer program enrollment and deliver course materials, sessions and mentorship.
• To process payments, refunds and invoices in coordination with payment partners.
• To communicate important updates, schedules and administrative notices to participants.
• To manage user accounts, verify identities and provide customer support.
• To analyze usage patterns and improve program content, platform features and user experience.
• To detect, prevent and respond to fraud, misuse or security incidents affecting our services.
• To comply with legal obligations, regulatory requests and to exercise legal rights.
• To obtain feedback and conduct research that informs continuous improvement of our program offerings.

Legal Bases for Processing

We rely on applicable legal grounds to process personal data, including contractual necessity, legitimate interests, consent where required, and legal obligations.

• Contractual necessity to fulfill obligations arising from program enrollment and paid services.
• Legitimate interests for security, fraud prevention, platform improvements and business operations, balanced against user rights.
• Consent for optional features such as marketing communications and certain analytics where required by law.
• Compliance with legal obligations such as tax, accounting and regulatory reporting in relevant jurisdictions.

Data Subject Rights

Where applicable, individuals have rights to access, correct, restrict and delete personal data, as well as to object to processing and request data portability. We provide straightforward channels to exercise these rights.

• Right to access: request a copy of personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of personal data where processing is no longer necessary or lawful.
• Right to restrict processing: request temporary limitation of processing in specific circumstances.
• Right to object: object to processing based on legitimate interests or for direct marketing.
• Right to portability: request a structured, commonly used, machine-readable copy of your data for transfer.

Cookies and Tracking

Our site uses cookies and similar technologies to enable essential functions, measure performance and provide personalized settings. You can manage cookie preferences via your browser and available consent controls.

Types include essential cookies for site functionality, analytics cookies for usage measurement and preference cookies to remember display settings.

Essential, Analytics, Preferences and Marketing categories may be used with user consent where required by law.

You may manage cookie settings in your browser or through any consent management tool presented on the website. Disabling non-essential cookies may affect some features.

Read our Cookie Policy

Data Sharing and Disclosure

We share personal data only with service providers and partners when necessary to deliver services or comply with legal obligations, and under contractual safeguards to protect your information.

• Service providers who support program delivery such as hosting, payment processing and communication platforms.
• Professional advisors and auditors where required for legal, tax or compliance purposes.
• Third parties involved in legal processes or to protect rights, safety and property.
• Authorized subcontractors acting on our instructions under data protection agreements.
• Aggregated or anonymized data that does not identify individuals may be shared for research or reporting.
• Authorities or bodies when disclosure is required by law or to respond to lawful requests.

International Data Transfers

Personal data may be transferred to service providers outside Malaysia. Where transfers occur, we implement appropriate safeguards such as standard contractual clauses or rely on jurisdictions offering adequate protection.

Safeguards include contractual commitments, encryption, access limitations and regular vendor assessments to ensure data protection standards are met.

Data Retention

We retain personal data only as long as necessary to fulfill the purposes outlined, to meet legal obligations or to resolve disputes. Retention periods vary by data category and purpose.

Account and enrollment records are retained for the duration of active participation and for a reasonable period thereafter to support administration and compliance.

Communications and support correspondence are retained for operational needs, dispute resolution and service improvement for a defined period aligned with business practices.

System logs and technical records are retained for security monitoring and diagnostic purposes for a limited period determined by operational needs.

When data is no longer necessary, we securely delete, anonymize or aggregate it in accordance with our retention schedules and legal requirements.

Security Measures

MindMOrbit employs administrative, technical and physical measures to protect personal data against unauthorized access, loss or misuse. Security controls are periodically reviewed and updated in line with evolving risks.

• Access controls and role-based permissions to limit who can process personal data.
• Encryption of data in transit and at rest where appropriate and supported by industry-standard protocols.
• Regular security assessments, patch management and incident response procedures to address vulnerabilities promptly.

Your Rights

You may exercise certain rights with respect to your personal data. We aim to respond to requests in a timely manner and provide guidance on the required verification steps.

• Access personal data we hold about you and receive a copy in a readable format.
• Request correction of inaccurate or incomplete data.
• Request deletion of data when processing is no longer necessary or lawful.
• Object to processing based on legitimate interests or for direct marketing.
• Request restriction of processing in defined circumstances.
• Request data portability where applicable to receive a machine-readable copy of personal data.
• Withdraw consent to processing where consent was the legal basis, without affecting processing prior to withdrawal.
• Lodge a complaint with an appropriate supervisory authority if you believe your rights have been breached.

How to Submit a Rights Request

To exercise any privacy rights, contact us at [email protected] or send a written request to our office at 11, Jalan Esfahan, 50100 Kuala Lumpur, Federal Territory of Kuala Lumpur, Malaysia. We may require identity verification and will respond within a reasonable timeframe in accordance with applicable law.

[email protected]

Requests related to access, correction, deletion or portability of personal data will be reviewed and responded to within a reasonable timeframe, typically within 30 days of receipt. In complex cases we will inform the requester if additional time is required and provide an estimated completion date.