Privacy policy

Who we are

This website is run by Tun Wan Digital, based in Malaysia. In this policy, “we” means Tun Wan Digital. We follow the Personal Data Protection Act 2010.

What this website records on its own

This site sets no cookies for visitors and uses no advertising trackers. Cloudflare, our network provider, may set a technical cookie to protect the site from harmful traffic. If you choose the dark theme, that choice is stored in your browser only.

Like every web server, ours writes technical logs (IP address, page requested, time and browser type) to keep the site secure. These logs are kept only for a short period.

Visitor statistics

We count visits with Umami, analytics we host on our own server. It uses no cookies, does not build a profile of you and does not store your IP address. It records the page you viewed, the site that sent you, your country, and your device and browser type.

When you contact us

If you use the enquiry form, we receive what you type: your name, phone number or email, business name, your business’s Google Maps link, what you are interested in and your message, plus the page you sent it from. It is stored in our own content system. A copy is sent to us as a Telegram notification so we can reply quickly. Telegram processes it under its own privacy policy.

When you tap a WhatsApp button, we record the page language, the page you came from and the time of the click. We do not record your phone number or IP address at this step. If you then send a WhatsApp message, we receive your name, phone number and message. WhatsApp is operated by Meta under its own privacy policy.

Business details for drafts

To prepare a draft of your site, we use the public details of your business’s Google Maps listing, such as its name, address, opening hours, phone number and photos. The draft is shared through a private link that search engines do not index. If you do not go ahead, the draft is deleted within 30 days.

How we use it

• To reply to you and deliver the work you ask for
• Never sold, rented or shared for anyone else’s marketing
• Never added to a mailing list without your permission

How long we keep it

• Enquiries: up to 24 months after our last contact with you, then deleted.
• Drafts that do not go ahead: deleted within 30 days.
• Client records such as invoices and receipts: 7 years, as tax law requires.

Our clients’ sites

Sites we build for clients belong to those clients. Each client is responsible for data collected from visitors to their site. We only manage it on their behalf.

Your rights

You can ask what personal data we hold about you, ask us to correct it, or ask us to delete it. Send the request through the enquiry form or WhatsApp and we will respond within 21 days.

Changes

If this policy changes, the new version is published on this page. Last updated: 12 October 2026.