Privacy Policy & Cookie Notice
How Grass Stories Sdn Bhd collects, uses, and protects your personal data — in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA).
1. Introduction
Grass Stories Sdn Bhd ("Grass Stories", "we", "us", or "our") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect information about you when you visit our website at grassstories.com or engage our services.
This policy is issued in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA) and applies to all personal data processed by Grass Stories Sdn Bhd, a company incorporated in Malaysia.
Data Controller: Grass Stories Sdn Bhd
Address: Lot 1781, Jalan Piasau Utara 4, Piasau Industrial Estate, 98000 Miri, Sarawak, Malaysia
Email: sales@grassstories.com
Phone: 012-652 7719
2. Personal Data We Collect
2.1 Information You Provide to Us
When you complete our contact form, we collect the following personal data:
- Full name — to address you appropriately in our correspondence
- Email address — to respond to your enquiry and send a confirmation
- Phone number — to contact you regarding your enquiry
- Company or organisation name — to understand your business context (optional)
- Enquiry details — the service you require, estimated volume, and any additional information you choose to provide
You are not obligated to provide all information, but failure to provide required fields (name, email, phone) may prevent us from responding to your enquiry.
2.2 Information Collected Automatically
When you visit our website, we may automatically collect certain technical information, including:
- IP address — used for security logging and spam prevention
- Browser type and version
- Pages visited and time spent on each page — via Google Analytics (only if you have consented to analytics cookies)
- Referring website — how you arrived at our site
- Device type (desktop, mobile, tablet)
2.3 Information We Do Not Collect
We do not collect payment card details (we have no online payment system), government identification numbers, or any sensitive personal data (as defined under the PDPA) through this website. We do not use our website to solicit personal data from minors.
3. How We Use Your Personal Data
We use the personal data you provide for the following purposes, all of which are necessary to respond to your enquiry and provide our services:
- To respond to your enquiry — processing your contact form submission and replying by email or phone
- To send a confirmation email — acknowledging receipt of your enquiry
- To provide a service quotation — preparing and delivering a fee proposal relevant to your requirements
- To fulfil our service agreement — if you engage our services, managing your account, collections, destructions, and issuing Certificates of Destruction
- For internal record-keeping and audit — maintaining destruction records as required by applicable law
- To improve our website — using anonymised analytics data (only with your consent) to understand how visitors use our site
- To comply with legal obligations — retaining records as required under Malaysian law
Our legal bases for processing your personal data under the PDPA are: your consent (for analytics cookies), contractual necessity (for responding to and fulfilling your service enquiry), and legal obligation (for record retention).
4. Cookies & Analytics
4.1 What Are Cookies?
Cookies are small text files placed on your device by a website to enable certain functionality. They are widely used to make websites work more efficiently and to provide information to website owners.
4.2 Cookies We Use
Our website uses the following categories of cookies:
| Cookie Type | Purpose | Consent Required? |
|---|---|---|
| Essential | Session management, cookie consent preference storage (localStorage key: gs_cookie_consent) |
No — always active |
| Analytics | Google Analytics 4 (GA4) — tracks page views, user interactions, and general site usage to help us improve our website. No personally identifiable information is shared with Google. | Yes — consent required |
4.3 Google Analytics
With your consent, we use Google Analytics 4 (GA4), a web analytics service provided by Google LLC. GA4 uses cookies to collect anonymised information about how visitors use our website. This data is aggregated and does not identify individual users. IP addresses are anonymised before being sent to Google's servers.
Google's privacy policy is available at policies.google.com/privacy. You may opt out of Google Analytics across all websites by installing the Google Analytics Opt-out Browser Add-on.
4.4 Managing Your Cookie Preferences
When you first visit our website, you will be presented with a cookie consent banner. You may:
- Accept — to enable analytics cookies in addition to essential cookies
- Decline — to use only essential cookies, with no analytics tracking
Your preference is stored locally on your device and can be reset by clearing your browser's local storage or site data. You may also control cookies directly through your browser settings — consult your browser's help documentation for instructions.
Please note that declining cookies does not affect your ability to use any feature of our website.
6. Data Retention
We retain personal data only for as long as is necessary for the purposes set out in this policy, or as required by applicable law.
- Enquiry records — Retained for 3 years from the date of last contact, after which they are securely deleted.
- Active client records — Retained for the duration of the client relationship plus 7 years, in compliance with Malaysian legal requirements for business records.
- Destruction records and Certificates of Destruction — Retained for a minimum of 7 years as part of our compliance documentation.
- Website analytics data — Aggregated and anonymised; Google Analytics retains raw event data for 14 months by default.
When data is no longer required, it is securely deleted or anonymised so that it can no longer be associated with you as an individual.
7. Your Rights Under the PDPA
Under Malaysia's Personal Data Protection Act 2010, you have the following rights with respect to your personal data held by us:
- Right to access — You may request a copy of the personal data we hold about you.
- Right to correction — You may request that we correct any inaccurate or incomplete personal data.
- Right to withdraw consent — Where processing is based on your consent (e.g. analytics cookies), you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
- Right to limit processing — You may request that we limit how we use your personal data in certain circumstances.
- Right to enquire — You may contact us to enquire about what data we hold and how it is used.
Please note that certain rights may be limited where we are required by law to retain or process your data, or where your request would adversely affect the rights of other individuals.
8. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include:
- HTTPS encryption for all data transmitted between your browser and our website
- Server-side input sanitisation and validation on all form submissions
- Rate limiting on our contact form to prevent automated abuse
- Access controls limiting who within our organisation can access enquiry records
- Secure email infrastructure hosted on Malaysian-based servers (ServerFreak / cPanel)
While we take all reasonable steps to protect your data, no transmission over the internet or electronic storage system is completely secure. If you have concerns about a specific data security matter, please contact us at sales@grassstories.com.
9. Third-Party Links
Our website contains links to third-party websites and platforms, including our Facebook and Instagram pages, and WhatsApp. These external sites are governed by their own privacy policies, which we encourage you to review. We are not responsible for the privacy practices or content of any third-party website.
10. Children's Privacy
Our website and services are directed exclusively at businesses and organisations, not individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us immediately at sales@grassstories.com and we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we do, we will update the "Last updated" date at the top of this page.
We encourage you to review this policy periodically. Continued use of our website after any changes constitutes your acceptance of the updated policy. For material changes, we will make reasonable efforts to notify users via a notice on our website.
12. Contact & Data Protection Enquiries
If you have any questions, concerns, or requests relating to this Privacy Policy or how we handle your personal data, please contact us:
- Email: sales@grassstories.com
- Phone: 012-652 7719
- Post: Grass Stories Sdn Bhd, Lot 1781, Jalan Piasau Utara 4, Piasau Industrial Estate, 98000 Miri, Sarawak, Malaysia
We aim to respond to all data protection enquiries within 21 days. If you are not satisfied with our response, you have the right to lodge a complaint with Malaysia's Personal Data Protection Department (JPDP) at www.pdp.gov.my.