Privacy notice

This notice explains how Modern Influence Sdn Bhd, a company incorporated in Malaysia ("Modern Influence", "we", "us"), collects, uses, shares and protects personal data through this website, its forms and our related communications.

We are the data controller (data fiduciary under India's Digital Personal Data Protection Act 2023) for the personal data described here. We apply one standard of protection, modelled on the GDPR, to everyone whose data we handle, and it is designed to meet Malaysia's Personal Data Protection Act 2010 as amended in 2024, India's Digital Personal Data Protection Act 2023, the UAE's Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and Australia's Privacy Act 1988 and Australian Privacy Principles.

Where we deliver services to a client under contract, the client's own data is governed by that contract and, where we act as a processor, by the client's instructions. This notice covers the data we handle for our own purposes.

Contact and enquiry forms: your name, work email address, company, job title if you give it, phone number, country, the service or business line you are interested in, an optional budget band and timeline, your message, and a record of the consent you gave and when.

Request an audit: the same contact details, plus the area of concern you describe and your preferred time for a call.

Hardware quote requests: your contact details, company, country, an optional tax identification number for the company, delivery city, timeline, the items and quantities you add, and any notes.

Orion AI access requests and the invitation-only Orion area: your contact details and the reason for your request; if you receive an access code, the code issued to you, when and from which IP address it was used, the pages you viewed, how much of the tour video you watched, and, where requested, your acceptance of a non-disclosure agreement with a timestamp.

Early-access lists, Academy and event enquiries: your contact details and the programme or product you are interested in.

Technical data: IP address, browser type, device and operating system, pages requested and timestamps, recorded in security and server logs. Analytics data is collected only if you consent (see our cookie notice).

Correspondence: the content of emails and messages you send us and our replies.

Please do not send us sensitive personal data, such as health, biometric or financial account details, through the website. We do not ask for it and our forms are not designed for it.

To respond to your enquiry, prepare a proposal or quote, and take steps you ask for before entering into a contract. Basis: your consent, given on the form, and the steps necessary to enter into a contract with you or your organisation.

To provide and manage access to the invitation-only Orion area, keep it secure, and understand which content invitees find useful so we can follow up. Basis: your consent when you request or use an access code, and our legitimate interest in protecting confidential material and running our business.

To send you news, insights and event invitations. Basis: your separate, opt-in consent only. You can withdraw it at any time using the unsubscribe link or by writing to us.

To keep the website and our systems secure, detect abuse and investigate incidents. Basis: our legitimate interest in security and, where applicable, legal obligations to protect data.

To measure how the website is used, in aggregate. Basis: your consent through the cookie banner.

To comply with law, respond to lawful requests from authorities, and establish or defend legal claims. Basis: legal obligation and legitimate interest.

Where a law we are subject to requires consent, we rely on consent. Where India's DPDP Act applies, we process your data on the basis of your consent or a legitimate use permitted by that Act. We do not use your personal data for decisions based solely on automated processing that have legal or similarly significant effects on you, and we do not sell personal data.

Service providers that process data on our behalf under written contracts: website hosting and content delivery, customer relationship management, email delivery, video hosting for the Orion area, privacy-friendly analytics (only with consent), and IT and security services. They may use the data only to provide their services to us.

Our delivery teams and, where you engage us for a service that needs one, a delivery partner, under confidentiality and data protection terms.

Professional advisers such as lawyers, auditors and insurers, under a duty of confidentiality.

Authorities, regulators and courts, where the law requires it or to protect rights, property or safety.

A buyer or successor of all or part of our business, subject to equivalent protections, if we reorganise or are acquired.

We are based in Malaysia and serve clients in Malaysia, India, the UAE and Australia. Our website and business systems are hosted primarily in data centres in the Asia-Pacific region, and some of our service providers and delivery teams operate in other countries, including India. Your data may therefore be transferred outside the country in which it was collected.

When we transfer personal data across borders we take the steps each applicable law requires: under Malaysia's PDPA, we transfer only where the destination has substantially similar law or an adequate level of protection, or another statutory condition applies; under India's DPDP Act, we do not transfer to any country the Government of India has restricted; under the UAE PDPL, we rely on an adequate level of protection or appropriate safeguards; and under Australian Privacy Principle 8, we take reasonable steps to ensure overseas recipients handle the data consistently with the Australian Privacy Principles.

The safeguards we use include contractual data protection clauses, vendor due diligence, encryption in transit and at rest, and access controls. You can ask us for more information about the safeguards that apply to your data.

Enquiries, audit requests and quote requests that do not lead to an engagement: 24 months from our last contact with you, then deleted or anonymised.

Orion access requests and Orion area activity: for the life of your access code plus 12 months.

Marketing preferences and consent records: for as long as we rely on the consent and for up to 6 years afterwards, so we can show what you agreed to and honour your opt-outs.

Security and server logs: up to 12 months, unless needed for longer to investigate a specific incident.

Client and contract records: for the life of the relationship and then for the period required by tax, company and other laws, typically 7 years.

Analytics: aggregated statistics only; no individual profiles are kept.

When a retention period ends we delete or anonymise the data, unless the law requires us to keep it longer.

We protect personal data with measures appropriate to the risk, including encryption in transit and at rest, access restricted to people who need it, multi-factor authentication for staff, logging and monitoring, secure development practices and vendor due diligence. Access codes for the Orion area are stored only in hashed form.

No system is completely secure. If you believe your interaction with us is no longer secure, please contact us immediately.

Depending on the law that applies to you, you have the right to: access the personal data we hold about you; correct inaccurate or incomplete data; have your data erased; withdraw consent at any time (this does not affect processing already carried out); object to or restrict certain processing, including direct marketing; receive your data in a portable format or have it transmitted to another controller where technically feasible; and, under India's DPDP Act, nominate another person to exercise your rights in the event of death or incapacity and use our grievance redressal process.

To exercise any right, email [email protected]. We will verify your identity before acting, and may ask for information to do so. We respond within 21 days where Malaysia's PDPA applies, and in any case within 30 days. If a request will take longer or we cannot comply, we will tell you why. We do not charge a fee unless the law allows it and the request is manifestly unfounded or excessive.

If you are not satisfied with our response, you may complain to the relevant authority: in Malaysia, the Personal Data Protection Commissioner; in India, the Data Protection Board of India once you have used our grievance process; in the UAE, the UAE Data Office; and in Australia, the Office of the Australian Information Commissioner. We would appreciate the chance to resolve your concern first.

We maintain a documented process to detect, contain, assess and record personal data breaches. Where a breach meets the threshold set by applicable law, we notify the relevant regulator within the required time, for example the Personal Data Protection Commissioner in Malaysia as soon as practicable and within 72 hours, the Data Protection Board of India, the UAE Data Office, and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.

If a breach is likely to cause you significant harm or to result in a high risk to you, we will tell you without undue delay, explain what happened and what data was involved, and describe the steps we have taken and the steps you can take to protect yourself.

Our website and services are intended for organisations and their professional staff. They are not directed at anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

For any privacy question, request or complaint, contact our data protection officer and grievance officer at [email protected], or write to Modern Influence Sdn Bhd, Malaysia, marked for the attention of the Data Protection Officer.

We will update this notice when our practices or the law change. The date at the top shows when it was last updated. If we make a material change, we will highlight it on the website and, where we have your email address and the change affects you, tell you directly.