Privacy Policy

1. Introduction

Corvid Labs operates this website and the cohort-based courses offered through it. This policy describes the personal data we collect, why we collect it, how long we keep it, who may access it, and the rights you have under applicable Malaysian data protection law, particularly the Personal Data Protection Act 2010 (PDPA). If you have questions about this policy, write to us at [email protected].

2. Data We Collect

We collect the following categories of personal data:

• Contact information: Name, email address and, if provided, telephone number — collected through our contact and enquiry form.
• Course-related data: Submissions, problem set responses, mentor call notes and written feedback associated with your participation in a cohort.
• Technical data: IP address, browser type, pages visited and session duration, collected through analytics software.
• Cookie data: Preferences stored locally and session identifiers. See Section 6 and our Cookie Policy for detail.

We do not collect payment card data directly. Any payment processing is handled by our payment processor and is subject to their separate privacy policy.

3. Legal Basis and Purpose

We process personal data on the following grounds under the PDPA:

• Contract performance: Processing your enrolment, delivering course materials, providing feedback on submissions and managing your participation in a cohort.
• Consent: Sending programme updates or information about future cohorts where you have indicated agreement to receive such communications.
• Legitimate interest: Operating our website, responding to enquiries, detecting fraudulent or abusive use, and improving our courses based on aggregate feedback.
• Legal obligation: Retaining records as required by Malaysian law, including tax and business records for a minimum of seven years.

4. Retention Periods

• Enquiry and contact form data: retained for 12 months from the date of last contact, or until you ask us to delete it.
• Course participation data (submissions, feedback, completion records): retained for five years after the cohort ends to allow us to respond to questions about completion records.
• Financial and transaction records: retained for seven years in accordance with Malaysian statutory requirements.
• Analytics data: retained in aggregated form for up to 24 months.

5. Data Sharing

We share personal data only in the following circumstances:

• Service providers: Third-party providers who support our operations — hosting, email delivery, payment processing and analytics. These providers are contractually required to process data only as instructed and to maintain appropriate security standards.
• Analytics: We use web analytics software that may process IP addresses and browsing behaviour in aggregated or pseudonymised form.
• Legal requirements: Where we are required to disclose data by law or to a regulatory authority.

We do not sell personal data to third parties. We do not share submission or course materials data for any commercial purpose.

6. Cookies

This website uses essential cookies to support basic functionality and optional analytics cookies to understand how the site is used. You can manage your preferences through the cookie banner on the homepage or on our Cookie Policy page. Rejecting optional cookies does not affect your ability to use the site or enrol in a programme.

7. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction. These include encrypted transmission (TLS), access controls on systems holding personal data and periodic review of security practices. In the event of a data breach that is likely to result in a risk to individuals, we will notify affected persons and the relevant authority in accordance with applicable requirements.

8. Your Rights

Under the Personal Data Protection Act 2010 (Malaysia), you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Withdraw consent where processing is based on consent
• Object to processing carried out on the basis of legitimate interest
• Request erasure of data where there is no lawful basis for continued retention
• Request that we restrict processing while a complaint is under consideration
• Lodge a complaint with the Department of Personal Data Protection Malaysia

To exercise any of these rights, email [email protected] with a description of your request. We will respond within 30 days. We may ask you to verify your identity before processing the request.

9. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies. A link does not constitute an endorsement of a site's data handling.

10. Age Restriction

Our courses are intended for individuals aged 18 and above. We do not knowingly collect personal data from persons under 18. If we become aware that we have collected data from a minor without appropriate consent, we will delete that data promptly.

11. Changes to This Policy

We may update this policy from time to time. The date at the top of the page reflects when the current version was last revised. For enrolled participants, material changes will be communicated by email. Continued use of the website or continued participation in a programme after a change becomes effective constitutes acceptance of the revised policy.

12. Contact

Data controller: Corvid Labs, 33 Jalan Burma, 10050 George Town, Pulau Pinang, Malaysia.

For privacy-related enquiries: [email protected]

For general enquiries: +60 4-899 3742 or [email protected]