Privacy Policy.

01 Who we are

Thezhen Creative Sdn Bhd is a creative and digital marketing agency based in Kuala Lumpur, Malaysia. For the purposes of the PDPA, we are the "data user" responsible for your personal data collected through this website and our services.

• Company: Thezhen Creative Sdn Bhd
• Address: B-5-8 Plaza Mont Kiara, 50480 Kuala Lumpur, Malaysia
• Email: hello@thezhen.com
• Phone / WhatsApp: +60 12-317 2059

02 What personal data we collect

We only collect data that is relevant to providing and improving our services. This may include:

• Contact details — your name, business name, email address, and phone number, e.g. when you submit our contact form or message us on WhatsApp.
• Project information — details you share about your business, goals, budget, and the services you are interested in.
• Communications — records of your enquiries, correspondence, and feedback.
• Technical & usage data — IP address, browser type, device information, and pages visited, collected automatically through cookies and similar technologies.

If you provide us with personal data about other individuals (for example, your colleagues or staff), you confirm that you have informed them and obtained their consent for us to process it as described here.

03 How we collect your data

• Directly from you — through our website forms, WhatsApp, email, phone calls, or meetings.
• Automatically — through cookies, analytics tools, and server logs when you browse our website.
• From third parties — such as referrals, or platforms you authorise us to access on your behalf (e.g. advertising or messaging accounts).

04 How we use your data

We process your personal data for the following purposes:

• To respond to your enquiries and provide quotations.
• To deliver, manage, and improve the services you engage us for.
• To communicate with you about your project, including updates and reports.
• To process payments and maintain our business records.
• To send you relevant updates or marketing communications, where you have consented (you may opt out at any time).
• To comply with our legal and regulatory obligations.

05 Disclosure of your data

We do not sell your personal data. We may share it only where necessary, with:

• Service providers who support our operations (e.g. hosting, payment processing, and software platforms), bound by confidentiality obligations.
• Platforms you authorise us to manage on your behalf, such as Google Ads, Meta (Facebook/Instagram), or WhatsApp Business / WATI.
• Authorities or regulators, where required by law or to protect our legal rights.

06 Third-party tools & platforms

To deliver our services we use reputable third-party tools, each governed by their own privacy terms. These may include Google (Ads & Analytics), Meta, and WATI / the WhatsApp Business Platform. When we manage these platforms on your behalf, your use of them is also subject to their respective terms and privacy policies.

07 Cookies

Our website uses cookies and similar technologies to keep the site working, understand how it is used, and improve your experience. You can control or disable cookies through your browser settings, though some features of the site may not function properly as a result.

08 Data retention

We retain your personal data only for as long as necessary to fulfil the purposes set out in this Policy, to maintain our business and accounting records, or to comply with legal obligations. When data is no longer needed, we will take reasonable steps to securely delete or anonymise it.

09 How we protect your data

We apply reasonable physical, technical, and organisational measures to protect your personal data against loss, misuse, and unauthorised access, alteration, or disclosure. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10 Storage & international transfer

Some of the platforms and service providers we use may store data on servers located outside Malaysia. Where your personal data is transferred abroad, we take reasonable steps to ensure it continues to be protected to a standard consistent with the PDPA.

11 Your rights under the PDPA

Subject to the PDPA, you have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate, incomplete, or outdated data.
• Withdraw your consent to our processing of your data.
• Limit the processing of your data, including for marketing purposes.

To exercise any of these rights, please contact us using the details below. We may need to verify your identity before responding.

12 Children's privacy

Our website and services are intended for businesses and individuals aged 18 and above. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.

13 Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The latest version will always be published on this page with an updated "Last updated" date.

14 Contact us

This Privacy Policy is provided for general informational purposes and does not constitute legal advice. We recommend having it reviewed by a qualified legal professional to ensure it fully meets your specific business and regulatory requirements.