Privacy Policy

SORIS is operated by Gabriel Yee. This policy explains what personal data SORIS collects through sorisorigin.my, why, and what rights the visitor has over it, in accordance with Malaysia’s Personal Data Protection Act 2010 (as amended by the Personal Data Protection (Amendment) Act 2024).

What SORIS collects

• Name, email address, phone number and business details submitted through the contact form or audit request form
• Messages sent via WhatsApp
• Basic website usage data, if analytics tools are installed

Why SORIS collects it

• To respond to inquiries or audit requests
• To provide quotes and deliver contracted services
• To send updates about the engagement, if the visitor becomes a client

SORIS does not use data for purposes beyond these without asking first.

Who SORIS shares it with

• Third-party tools used to operate, including email provider, WhatsApp Business, hosting provider and analytics tools
• SORIS does not sell personal data to anyone

Where data is stored

Some tools SORIS uses (such as Google, WhatsApp and Cloudflare) may store or process data outside Malaysia. By using the contact channels, the visitor consents to this transfer, consistent with PDPA requirements for cross-border data transfer.

How long SORIS keeps it

Contact form submissions from non-clients are retained for 12 months. Client data is retained for the duration of the engagement plus six years for accounting and legal purposes.

Visitor rights

Under the PDPA, the visitor has the right to:

• Request access to the personal data SORIS holds
• Request correction of inaccurate data
• Withdraw consent for SORIS to use the data
• Lodge a complaint with the Personal Data Protection Commissioner if the data has been mishandled

Data breach notification

In the event of a personal data breach, SORIS will assess and, where required under the amended PDPA, notify the Personal Data Protection Commissioner within 72 hours and affected individuals as soon as practicable.