Privacy Notice

1. Who we are

This Privacy Notice explains how Storming Solutions ("we", "us", "our") collects, uses, discloses and protects your personal data in accordance with the Personal Data Protection Act 2010 ("PDPA") of Malaysia and applicable guidance issued by the Personal Data Protection Commissioner.

• Business: Storming Solutions (202003118468 (TR0213947-W))
• Location: Kuala Lumpur, Malaysia
• Contact for privacy matters: hello@stormingsolutions.com

We provide website development and AI visibility (SEO/AEO/GEO) services. This notice applies to our website, enquiry forms, reports and related communications.

2. The personal data we collect

Depending on how you interact with us, we may collect:

• Identity and contact data — name, email address, phone number, and the company or organisation you represent.
• Business and website data — your website URL, business details, and publicly available company information you provide or ask us to analyse.
• Communication data — messages you send us by form, email or messaging apps (e.g. WhatsApp), and our replies.
• Technical and usage data — see Section 6 (Cookies and website analytics).

We collect personal data directly from you when you submit a form, contact us, or engage our services.

3. Sensitive personal data

We do not generally require or intentionally collect sensitive personal data as part of our ordinary services. Please do not provide sensitive personal data to us unless it is necessary for the services we provide.

4. Why we collect and use your personal data

We use your personal data to:

• respond to your enquiries and provide quotations;
• deliver our services and produce your reports;
• communicate with you about your project or account;
• keep records for accounting, tax and legal purposes; and
• send you marketing communications only where you have opted in (see Section 14).

5. Whether providing data is obligatory

Providing the personal data we request is voluntary. However, if you do not provide the information needed to respond to your enquiry or deliver a service (for example, a contact email or your website URL), we may be unable to assist you or complete the work.

6. Cookies and website analytics

Our website uses cookies and similar technologies. These fall into the following categories:

• Strictly necessary cookies — required for the website to function properly. These are always active and do not require your consent.
• Analytics cookies — help us understand how our website is used so we can improve it (for example, Google Analytics). These may collect technical data such as IP address, browser type, device information and pages visited.
• Advertising and remarketing cookies — may be set by advertising and marketing platforms that we use from time to time to measure the performance of our campaigns and, where applicable, show relevant advertising to people who have visited our website. These may include technologies such as the Meta (Facebook/Instagram) Pixel, Google Ads, LinkedIn Insight Tag, or similar technologies provided by other advertising platforms.

You can control or delete cookies at any time through your browser settings, including refusing or removing analytics cookies, although disabling some cookies may affect how our website functions. Where we use advertising or remarketing cookies, we will ask for your consent before they are set. Strictly necessary cookies do not require consent.

7. Use of artificial intelligence (AI)

We may use AI-assisted tools to help analyse websites and prepare reports. Where we process only business or public information (for example, a website URL or publicly available company information), this generally does not involve your personal data.

Where personal data is processed using third-party AI or other technology providers, we will take reasonable steps to ensure that such providers process personal data only for authorised purposes and in accordance with applicable data protection requirements.

AI-generated outputs may contain inaccuracies and should not be relied upon as legal, financial or professional advice. We review outputs before relying on them in our work for you.

8. Disclosure of your personal data

We do not sell your personal data. We may share it with the following categories of third parties, only as necessary to operate our business and deliver our services:

• hosting and infrastructure providers;
• website analytics providers;
• advertising and remarketing platforms (which may include Meta, Google, LinkedIn, or similar providers);
• email delivery providers;
• messaging platform providers (e.g. WhatsApp / Meta);
• AI or other technology providers (see Section 7); and
• professional advisers, or authorities where required by law.

Where these parties process personal data on our behalf, we take reasonable steps to require them to keep it confidential and secure.

9. Overseas transfer of personal data

Some of our service providers may process personal data outside Malaysia. Where we transfer or permit personal data to be processed outside Malaysia, we will take reasonable steps to ensure that the transfer is carried out in accordance with applicable requirements of the PDPA and applicable guidance issued by the Personal Data Protection Commissioner.

10. Data security

We apply appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction. No method of transmission or storage is completely secure, but we work to protect your data using reasonable safeguards.

11. Data breaches

If we become aware of a personal data breach, we will assess and respond to the breach in accordance with applicable Malaysian data protection laws, including any applicable requirements to notify the Personal Data Protection Commissioner and affected individuals.

12. Data retention

We keep your personal data only for as long as necessary for the purposes set out in this notice, after which it is normally reviewed and deleted, unless a longer retention period is required or permitted by law (for example, for tax, accounting, or legal obligations).

13. Your rights

Under the PDPA, you have the right to:

• Access — request a copy of the personal data we hold about you;
• Correction — request that we correct inaccurate or incomplete data;
• Withdrawal of consent — withdraw any consent you previously gave;
• Objection to direct marketing — ask us to stop sending you marketing;
• Data portability — request that your data be transmitted to another data controller, where this right applies under the PDPA and its amendments;
• Complaints — raise a concern about how we handle your data; and
• Deletion — request deletion of your data, subject to our legal obligations to retain certain records.

To exercise any of these rights, contact us using the details in Section 19.

14. Direct marketing

We will only send you marketing communications where you have expressly opted in. You can withdraw your consent at any time — every marketing message includes an opt-out, or you can contact us directly.

15. Children

Our services are directed at businesses and are not intended for children. We do not knowingly collect personal data from children.

16. Confidentiality

We treat the information you share with us as confidential and use reasonable technical and organisational measures to protect it, disclosing it only as described in this notice or as required by law.

17. Data Protection Officer

Where required under applicable Malaysian data protection laws, we will appoint a Data Protection Officer and provide the relevant contact details through this Privacy Notice or our website.

18. Changes to this notice

We may update this notice from time to time. The latest version will always be available on our website, with the "Last updated" date shown at the top.

19. How to contact us

For any questions about this notice, or to exercise your rights, contact us at:

• Storming Solutions (202003118468 (TR0213947-W))
• Email: hello@stormingsolutions.com
• Location: Kuala Lumpur, Malaysia

20. Governing law

This notice is governed by the laws of Malaysia, including the Personal Data Protection Act 2010.