Privacy Notice - Steve & Co Asia

Effective date: 19 August 2026

1. ABOUT THIS NOTICE AND WHO WE ARE

This Privacy Notice explains how Steve & Co Asia (M) Sdn. Bhd. (Company Registration No. 201101009901 (938040-K)) (“Company”, “we”, “us” or “our”) collects, records, holds, stores, uses, discloses, transfers, corrects, deletes and otherwise processes personal data in respect of commercial transactions and in connection with its commercial activities.

Unless a separate notice given at the point of collection identifies another data controller, the Company is the data controller responsible for the processing described in this Notice. Our business address is (33-35) Level 10, The Boulevard, Mid Valley City, 59200 Kuala Lumpur.

This Notice applies to https://stevecoasia.com/ and to the other collection channels expressly described below. A separate or supplementary notice may apply to a particular service, event, transaction, recruitment exercise or other activity. Where a more specific notice is given, that notice will apply to the relevant activity to the extent of any inconsistency.

This Notice is intended to provide the information required under the Personal Data Protection Act 2010 (“PDPA”). It does not form a contract, create contractual rights, expand any duty or remedy beyond applicable law, or require you to accept it as a condition of ordinary browsing. Nothing in this Notice excludes or limits an obligation that cannot lawfully be excluded or limited.

This Notice shall be made readily available in Bahasa Malaysia and English. Both versions are intended to convey the same information and choices.

2. WHO THIS NOTICE COVERS

This Notice covers personal data relating to:

visitors to our website and persons who use its functions;
persons who contact us by website form, email, telephone, messaging service, social media or another communication channel;
prospective and existing clients or customers, and their directors, officers, employees, representatives and professional advisers;
suppliers, contractors, business partners, investors, event participants and their representatives;
persons who subscribe to or receive our communications;
job applicants, referees and recruitment contacts, if recruitment data is collected through the website; and
other individuals whose personal data is lawfully provided to us in connection with the purposes stated in this Notice.

The PDPA protects personal data relating to individuals in respect of commercial transactions. It does not apply merely because information concerns a body corporate or a deceased person. However, a corporate or business record may contain personal data relating to an identifiable living director, shareholder, employee, representative, customer, supplier or other individual, in which case this Notice applies to that individual’s personal data.

Processing wholly unrelated to a commercial transaction may fall outside the PDPA. Confidentiality, contractual, employment, professional, sector-specific or other legal obligations may nevertheless apply, and nothing in this Notice determines or limits the operation of those obligations.

3. PERSONAL DATA WE MAY PROCESS

The personal data we process depends on the relevant relationship, activity and interaction. We may process the following categories of personal data to the extent that they are relevant to a purpose stated in this Notice:

identity and business profile information, such as name, title, designation, employer or organisation and professional background;
contact information, such as business or correspondence address, email address, telephone number and social-media handle;
enquiry, service and correspondence information, including form entries, subject and contents of communications, feedback, instructions, documents and attachments;
relationship and transaction information, including the services or information requested, meeting or event details, contractual and payment-related records;
marketing and preference information, including subscription, consent, communication-channel, unsubscribe and objection records;
recruitment information, where applicable, including CV, qualifications, employment history, salary-related information, references, work eligibility, photograph and information supplied during an application; and
technical and usage information, such as IP address, device and browser information, operating system, approximate location derived from IP address, referral source, pages visited, date and time, log records, cookie identifiers and interaction data.

We may combine personal data obtained from different sources where this is necessary for or directly related to a purpose stated in this Notice and permitted by law.

Free-text fields and attachments may contain information that we did not request. Please do not provide sensitive personal data unless we have specifically requested it or it is genuinely necessary for the relevant purpose. Sensitive personal data may include information concerning physical or mental health or condition, political opinions, religious beliefs or other beliefs of a similar nature, the commission or alleged commission of an offence, biometric data used or intended to be used for identification, and any other category prescribed by law.

Where we process sensitive personal data, we will obtain explicit consent unless the processing is otherwise permitted under the PDPA. We may decline, delete, return, restrict or refrain from using unsolicited information that is unnecessary, excessive, irrelevant or provided without appropriate authority.

4. HOW WE OBTAIN PERSONAL DATA

We may obtain personal data:

directly from you when you visit the website, complete a form, communicate with us, register for an event, subscribe, apply for a position or otherwise provide information;
automatically from your device through server logs, cookies and similar technologies, subject to the applicable choices and controls;
from your employer, organisation, representative, colleague, referee or another person acting on your behalf;
from our related companies or business partners where the sharing is relevant to the stated purpose;
from recruitment agencies, event organisers, professional advisers and service providers; and
from publicly available professional, corporate, regulatory, media or social-media sources.
If you provide another person’s personal data to us, you should ensure that you are authorised or otherwise legally permitted to do so and, where appropriate, direct that person to this Notice. We may request evidence of your authority where it is reasonable to do so.
Where required under the PDPA, we will provide the applicable notice as soon as practicable after first collecting personal data from another source and, in any event, before using it for a materially different purpose or disclosing it to a previously unnotified class of third party, unless an applicable statutory ground or exemption applies.

If you provide another person’s personal data to us, you should ensure that you are authorised or otherwise legally permitted to do so and, where appropriate, direct that person to this Notice. We may request evidence of your authority where it is reasonable to do so.

Where required under the PDPA, we will provide the applicable notice as soon as practicable after first collecting personal data from another source and, in any event, before using it for a materially different purpose or disclosing it to a previously unnotified class of third party, unless an applicable statutory ground or exemption applies.

5. MANDATORY AND VOLUNTARY INFORMATION

We will identify at or before the point of collection whether particular personal data is obligatory or voluntary. Fields marked as mandatory must be completed for us to process the relevant submission, request or transaction. Other information is voluntary.

The Company’s general website enquiry form presently requires the enquirer’s name, email address, contact number and enquiry message. These particulars are required so that we can identify the enquirer, understand and assess the enquiry, communicate with the enquirer and maintain an appropriate record of the communication.

If you do not provide mandatory information, we may be unable to respond to an enquiry, provide requested information, verify identity or authority, assess or enter into a proposed engagement, register you for an event, process an application, maintain website or transaction security, comply with applicable requirements or carry out the relevant service.

The consequences of not providing particular information may differ according to the relevant form, request or transaction and may be explained at the point of collection. Declining or withdrawing consent to unrelated marketing will not prevent us from responding to an ordinary enquiry or providing a service that does not depend on that consent.

6. PURPOSES AND PERMITTED PROCESSING

Subject to the PDPA, we process personal data with the data subject’s consent or where a ground, requirement or exemption under applicable law permits processing without consent. We will process personal data for a lawful purpose directly related to our activities and only where the processing is necessary for or directly related to that purpose and the personal data is adequate and not excessive in relation to that purpose.

Depending on the relevant interaction, we may process personal data for one or more of the following purposes:

receiving, verifying, assessing, prioritising and responding to enquiries, requests, proposals, instructions, applications and feedback;
taking steps at your request before entering into a contract to which you are a party and performing, administering or enforcing that contract;
providing, administering, managing, documenting, reviewing and improving our services, website, communications, events and business relationships;
conducting due diligence, conflict checks and identity or authority verification;
managing accounts, billing, collections, payments and other financial or transaction administration;
maintaining corporate, operational, accounting, tax, compliance, audit, consent, communication and other business records;
communicating with clients, customers, counterparties, suppliers, professional advisers, regulators and other persons involved in a relevant instruction, service, relationship or transaction;
sending newsletters, updates, invitations and information about our services, subject to applicable direct-marketing requirements and choices;
operating, maintaining, securing, monitoring, testing, troubleshooting, analysing and protecting our website, systems, premises, records and communications;
detecting, preventing, investigating and responding to fraud, misuse, security incidents, misconduct, unlawful activity, complaints and disputes;
recruiting, evaluating and communicating with candidates and referees, maintaining recruitment records and planning workforce requirements;
complying with legal, regulatory, professional, tax, accounting, audit, reporting, record-keeping and risk-management requirements and responding to lawful requests and processes;
administering justice, obtaining legal advice, establishing facts, preserving evidence and establishing, exercising, defending, compromising or enforcing legal rights, claims and remedies;
conducting internal administration, governance, planning, reporting, restructuring, financing, investment, merger, acquisition, disposal, sale, transfer or succession of any business, undertaking, asset or liability; and
any other purpose notified at or before collection or otherwise permitted by law.

Depending on the processing concerned, the applicable ground may include:

your consent;
the performance of a contract to which you are a party;
taking steps at your request with a view to entering into such a contract;
compliance with a legal obligation to which we are subject, other than an obligation imposed only by contract;
protection of your vital interests;
the administration of justice; or
the exercise of any function conferred on any person by or under written law.

7. MARKETING COMMUNICATIONS

We may send advertising or marketing material directed to you through email, telephone, messaging service, social media or another channel where the applicable consent has been obtained or the communication is otherwise permitted under the PDPA. Marketing consent will not be made a condition of an unrelated enquiry or service unless the marketing is integral to the requested service.

You may require us to cease or not begin processing your personal data for direct marketing by using the unsubscribe mechanism in the communication, emailing admin@stevecoasia.com or contacting us under section 17 of the same agreement. We will act on a valid written request within a reasonable period.

We may retain a minimal suppression record, including the relevant contact details, communication channels and date of the request, to ensure that the opt-out continues to be respected. Withdrawal of marketing consent does not affect processing carried out before withdrawal or processing required or permitted on another applicable ground.

8. DISCLOSURE OF PERSONAL DATA

We may disclose personal data to the extent relevant to a purpose stated in this Notice and permitted by law. Depending on the circumstances, the classes of recipients may include:

related companies that provide shared administration, management, information-technology, finance, marketing, event, recruitment or other support, or that participate in the relevant service, relationship or transaction;
clients, customers, counterparties, business partners, event participants and other persons involved in the relevant instruction, enquiry, service, transaction or activity;
website developers and providers of hosting, domain-name services, information technology, cloud storage, email, communications, customer-relationship management, analytics, cybersecurity, backup, newsletter, event or recruitment services;
banks, payment providers, payment processors, insurers, financiers and transaction administrators;
professional advisers, including lawyers, accountants, auditors, tax advisers, consultants, investigators, experts and insurers, subject to applicable confidentiality obligations;
regulators, courts, tribunals, arbitrators, law-enforcement bodies, government authorities and other persons where disclosure is required or permitted by written law, necessary for the administration of justice, made in connection with a court order or judgment, or covered by an applicable exemption;
a prospective or actual investor, financier, purchaser, successor, assignee or transaction counterparty, and its advisers, in connection with a proposed or completed corporate or business transaction; and
another person where you have consented to, requested or authorised the disclosure.

A request from an authority, litigant or other person will not automatically be treated as authority for unrestricted disclosure. Where appropriate and legally permissible, we may assess the identity and authority of the requester, the legal or procedural basis and scope of the request, the categories of personal data requested and any available restriction, clarification or protective measure. We may disclose personal data without consent where a statutory ground or exemption permits or requires it.

Nothing in this Notice prevents disclosure necessary for the administration of justice or compliance with a court order or judgment. Where disclosed material contains unrelated, confidential or sensitive personal data, we may, where appropriate, use redaction, restricted access, confidentiality undertakings, protective orders or other safeguards. The availability and form of such safeguards will depend on the circumstances and the applicable process.

Where a provider processes personal data on our behalf, we will take reasonable steps appropriate to the circumstances to select a suitable provider, define the authorised purpose and security requirements, limit access and require compliance with applicable security obligations.

We do not disclose personal data to a third party for that third party’s own direct marketing unless the relevant individual has consented or the disclosure is otherwise permitted by law. This does not restrict a disclosure made as part of a corporate transaction, business transfer, professional engagement or other purpose permitted under this Notice.

9. TRANSFERS OUTSIDE MALAYSIA

Some of our systems, recipients or service providers may store, access or process personal data outside Malaysia. In particular, the website presently uses services supplied by Google, including Google Analytics and Google Site Kit, and Google or its service providers may process technical and usage information in countries in which they maintain facilities.

Where we transfer personal data outside Malaysia, we will do so in accordance with section 129 of the PDPA. Depending on the circumstances, we may transfer personal data where:

the destination has a law substantially similar to the PDPA or provides an adequate level of protection;
the data subject has consented to the transfer;
the transfer is necessary for the performance or conclusion of an applicable contract;
the transfer is necessary for legal proceedings, obtaining legal advice or establishing, exercising or defending legal rights;
the transfer is necessary to protect vital interests;
reasonable precautions and due diligence have been undertaken in relation to the transfer; or
another condition permitted under section 129 applies.

Where appropriate, we may use contractual, organisational or technical safeguards and conduct due diligence proportionate to the nature and risk of the transfer. The safeguards used may differ according to the recipient, destination, system and purpose.

You may contact us for further information about a material transfer affecting your personal data, subject to confidentiality, security and legal restrictions.

10. COOKIES AND SIMILAR TECHNOLOGIES

Our website uses or may use cookies, pixels, tags, local-storage technologies and similar identifiers to operate the website, remember preferences, maintain security, analyse traffic and performance and, where applicable, support advertising or marketing. These technologies may constitute personal data where they relate directly or indirectly to an identified or identifiable individual.

The website presently uses Google Analytics through Google Site Kit and Google tagging technology. Google Analytics may collect information including IP address, device and browser information, approximate location, referral source, pages visited, date and time, interactions and cookie or device identifiers. We use this information to understand website usage and performance and to improve the website and its content.

Technologies strictly necessary to provide a requested function, maintain security or operate the website may operate without an optional-cookie consent. Blocking those technologies through browser or device settings may affect the availability or operation of the relevant function.

Where consent is required for an optional analytics, advertising, profiling or marketing technology, that technology will be activated only after the applicable choice has been obtained. You may manage available choices through the website’s cookie-preference tool and your browser or device settings.

Withdrawal of an optional-cookie consent does not affect processing carried out before withdrawal and may not remove information already stored by a third-party provider, although future deployment through our website will be adjusted in accordance with the recorded choice where technically practicable.

Further information concerning the principal cookies and similar technologies used by the website, including their provider, purpose, category and duration, may be provided through the website’s cookie-preference tool or Cookie Policy.

11. RETENTION

We retain personal data for as long as reasonably necessary for the relevant purpose or as required or permitted by law. The applicable retention period may take into account:

the nature and sensitivity of the personal data;
the relevant relationship, instruction, service or transaction;
legal, regulatory, professional and contractual requirements;
applicable limitation periods;
actual or potential complaints, disputes, investigations or proceedings;
accounting, taxation, audit and reporting requirements;
security, fraud-prevention and business-continuity requirements;
applicable backup, archive and system-log cycles; and
the need to establish facts, preserve evidence or exercise, defend or enforce legal rights.

Different records may therefore be retained for different periods, and a record may be retained after the immediate relationship or transaction ends where an applicable reason remains. We are not obliged to retain personal data indefinitely or solely because an individual may wish to obtain it in the future.

We may retain consent, withdrawal, objection, unsubscribe and complaint records for as long as reasonably necessary to demonstrate compliance and continue respecting the relevant instruction.

Where personal data is no longer required, we will take reasonable steps to destroy, permanently delete, de-identify or anonymise it, subject to applicable law and technical limitations affecting secure backups, archives and system logs. Information in a backup may remain until the backup is overwritten or retired in the ordinary course, provided that access and further use remain appropriately restricted.

12. SECURITY AND PERSONAL DATA BREACHES

We take practical technical and organisational measures appropriate to the nature of the personal data, the processing and the harm that could result from loss, misuse, modification, unauthorised or accidental access or disclosure, alteration or destruction. Those measures may include access controls, authentication, confidentiality requirements, system maintenance, secure storage or transfer, backups, monitoring and incident-response arrangements, to the extent actually implemented and appropriate to the circumstances.

Security measures reduce risk but cannot eliminate it. No website, internet transmission, electronic communication, system or storage method is completely secure, and we do not guarantee absolute security or uninterrupted availability.

Where a data processor processes personal data on our behalf, we will require security measures appropriate to the relevant processing and applicable obligations.

If we have reason to believe that a personal data breach has occurred, we will investigate and take reasonable steps to contain, mitigate and remediate it. We will notify the Personal Data Protection Commissioner as soon as practicable where required under the PDPA. If the breach causes or is likely to cause significant harm to an affected individual, we will notify that individual without unnecessary delay, subject to applicable law and any lawful restriction on notification.

13. ACCURACY OF PERSONAL DATA

We take reasonable steps to ensure that personal data is accurate, complete, not misleading and kept up to date, having regard to the purpose for which it is processed. In doing so, we may rely on information supplied by you, your authorised representative, your employer or organisation, a professional adviser, a regulator, an official record or another apparently authoritative source.

We are not responsible for an inaccuracy resulting from incomplete, incorrect, misleading or outdated information supplied to us where we have taken reasonable steps in the circumstances.

Please notify us promptly if your information changes or if you believe that personal data we hold about you is inaccurate, incomplete, misleading or outdated. We may require appropriate supporting evidence before changing an official, transactional, disputed or otherwise material record.

14. YOUR RIGHTS

Subject to the PDPA and the requirements, procedures, limitations and exceptions applicable to each request, you may:

request access to personal data we hold about you;
request correction of personal data that is inaccurate, incomplete, misleading or not up to date;
withdraw consent to processing that is based on consent by written notice, subject to the consequences of withdrawal;
require us to cease or not begin processing where the statutory conditions concerning unwarranted substantial damage or substantial distress are satisfied;
require us to cease processing personal data for direct marketing; and
request direct transmission of your personal data to another data controller by written notice given through electronic means, subject to technical feasibility, compatibility of data format and the other applicable requirements governing data portability.

The PDPA does not provide an unrestricted right to require deletion, object to all processing, obtain every document containing your name or prevent disclosure required or permitted by law. A request may be refused, limited, deferred or made subject to conditions where the PDPA or another applicable law permits or requires this.

Withdrawal of consent does not affect processing carried out before withdrawal. We may continue processing where another statutory ground, requirement or exemption applies. Withdrawal may prevent us from continuing an activity, transaction or service that depends on the withdrawn consent.

Withdrawal of consent does not require us to erase information that must or may lawfully be retained, including for legal, regulatory, professional, tax, accounting, audit, security, evidential, dispute, suppression-record or record-keeping purposes.

We may request information reasonably necessary to verify your identity, authority and the scope of the request. Verification will be proportionate to the nature and sensitivity of the requested information. We may require an authorised representative to provide evidence of authority.

We will handle a valid request within the periods and according to the procedures prescribed by applicable law. Where required, we will give written reasons for refusing or limiting a request. Any fee permitted by law may be required before we process an access request.

15. CHILDREN’S PERSONAL DATA

The website is not directed at persons under 18 years of age and is not intended to collect their personal data directly.

A person under 18 should not submit personal data through the website unless a parent, guardian or person with parental responsibility has authorised the submission and any required consent has been validly provided. Where consent is required for a minor’s personal data, we will obtain it from the appropriate parent, guardian or person with parental responsibility in accordance with applicable law.

If we learn that a minor’s personal data has been collected without an appropriate basis, we may restrict the processing, seek appropriate authorisation, return or delete the information, or take another step appropriate to the circumstances and our legal, professional, regulatory, record-keeping or evidential obligations.

16. THIRD-PARTY WEBSITES AND EMBEDDED CONTENT

Our website may contain links to websites, platforms or services operated by third parties or may display content supplied by them. Once you choose to visit, activate or interact with a third-party service, that third party may independently collect or process personal data under its own terms and privacy information.

We are not responsible for a third party’s website, content, availability, security or privacy practices. A link, integration or reference does not by itself amount to our endorsement of that third party or its practices. You should review the applicable third-party privacy information before providing personal data or activating embedded content.

17. REQUESTS, ENQUIRIES AND COMPLAINTS

To exercise a right, ask a question or make a complaint about our processing of personal data, contact:

Steve & Co Asia (M) Sdn. Bhd.
Email: admin@stevecoasia.com
Telephone: +6017 557 7911
Postal address: (33-35) Level 10, The Boulevard, Mid Valley City, 59200 Kuala Lumpur

If the Company appoints a Data Protection Officer, enquiries for the Data Protection Officer may be sent through the same contact details unless separate details are published.

Please provide your name, contact details, the nature and scope of the request and enough information for us to identify the relevant records. Do not send a complete identity document unless specifically requested through an appropriate channel.

We may correspond with you to clarify the request, verify identity or authority, locate the relevant records, obtain any fee permitted by law or explain an applicable limitation. We may retain a record of the request, correspondence, verification, decision and action taken.

If you remain dissatisfied, you may make a complaint to the Personal Data Protection Commissioner through the official channels published at www.pdp.gov.my. This Notice does not determine or limit any complaint, enforcement or other process available under applicable law.

18. CHANGES TO THIS NOTICE

We may amend this Notice from time to time to reflect changes in our processing, services, website, systems, providers, business, legal requirements or applicable guidance. The current version and effective date will be published on the website.

An amendment may take effect when published, except to the extent that applicable law requires prior notice, a further choice or fresh consent. Where appropriate, a material change will be brought to the attention of affected individuals. Continued browsing does not by itself constitute consent where consent is legally required.

You should review the current version periodically. Earlier versions may be retained for legal, audit and record-keeping purposes.