Privacy Policy

1. Who we are

Orbistra operates as a management learning provider registered and based in Malaysia. Our principal address is Suite 9-4, Jalan Bukit Bintang, 55100 Kuala Lumpur, Malaysia. For data-related enquiries, contact us at [email protected].

2. Data we collect and how

We collect personal data through the following means:

• Enquiry and contact forms — name, email address, phone number (optional) and message content when you submit a form on this website.
• Programme enrolment — name, email, employer name, role and payment information necessary to administer a programme place.
• Cookies and analytics — usage data collected through cookies where you have given consent. See our Cookie Policy for detail.
• Email correspondence — content you send to us directly via email.

We do not collect special category data (health, ethnicity, religion, etc.) and do not ask for it.

3. Legal basis for processing

• Consent — where you have ticked a consent box or accepted our cookie notice.
• Contract — to fulfil obligations under a programme enrolment agreement.
• Legitimate interest — to respond to enquiries and administer programme operations.
• Legal obligation — where required by Malaysian law, including the Personal Data Protection Act 2010 (PDPA).

4. How we use personal data

• Responding to enquiries about programmes, scheduling and fit.
• Administering enrolment, scheduling and participant communication for programmes you are enrolled in.
• Sending programme-related communications such as session reminders, debrief access links and assessment feedback.
• Improving programme content and delivery based on aggregated, non-identified feedback.
• Complying with legal obligations.

We do not use your data for marketing communications without separate consent. We do not sell personal data.

5. Data sharing

We do not share personal data with third parties for their own marketing purposes. Limited sharing occurs in these circumstances:

• Payment processors, to handle programme fees securely.
• Hosting and email service providers, operating under data processing agreements.
• Analytics providers, where you have consented to analytics cookies.
• Where required by Malaysian law or a court of competent jurisdiction.

6. Data retention

• Enquiry data not resulting in enrolment: retained for 12 months from last contact, then deleted.
• Participant records: retained for 7 years after programme completion, as required for financial and professional records under Malaysian law.
• Analytics data: retained in aggregated form; identifiable session data deleted after 14 months.

7. Data security

Personal data is stored on servers in Malaysia or within the EEA (for providers operating under GDPR). Access is restricted to Orbistra staff who need it for programme administration. We use HTTPS for data in transit. In the event of a data breach that meets the threshold for notification under the PDPA or GDPR, we will notify affected individuals and the relevant authority within the required timeframe.

8. Cookies

This site uses cookies as described in our Cookie Policy. Analytics and marketing cookies are used only where you have given consent through the cookie notice.

9. Your rights

Under the PDPA (Malaysia) and, where applicable, the GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data (subject to retention requirements).
• Object to processing based on legitimate interest.
• Withdraw consent at any time where consent is the legal basis.
• Receive your data in a portable format (GDPR, where applicable).
• Lodge a complaint with the relevant supervisory authority — in Malaysia, the Personal Data Protection Commissioner; in the EEA, your national data protection authority.

To exercise any of these rights, write to [email protected]. We will respond within 30 days.

10. Third-party links

This website may link to external sites. Orbistra is not responsible for the privacy practices of those sites. We recommend reviewing their privacy policies before providing personal data.

11. Children

Orbistra programmes are intended for working professionals aged 18 and over. We do not knowingly collect data from individuals under 18. If we become aware that we have done so, we will delete it promptly.

12. Changes to this policy

If we make material changes to this policy, we will update the "Last Updated" date and, where the change affects participants with existing enrolments, notify them by email. Continued use of this website after a policy update constitutes acceptance of the revised terms.

13. Contact

For privacy-related questions or requests: