1.0 General information

1.1 This website is owned and operated by KOY_LAB /ARCHITECTS, a professional architectural consultancy practice based in Malaysia (hereinafter referred to as “the Practice”, ”we”, ”our”, ”us”).

1.2 The Practice operates as a specialised design entity. This Privacy Policy applies to the collection and processing of personal data across our professional operations and digital platforms.

1.3 This policy (the ”Privacy Policy”) explains which personal data we collect about you when you visit our website (the ”Website”), when and why we collect the personal data, how we use them, the conditions of our disclosure to third parties, as well as how we secure the stored personal data.

1.4 Please read the Privacy Policy thoroughly in order to understand how we process your personal data in accordance with the Malaysian Personal Data Protection Act 2010 (PDPA).

2.0 Data controller

2.1 When using our Website, we are the data user (the entity that has control over or authorises the processing of personal data) with respect to your personal data, unless specifically mentioned in this policy.

3.0 Personal data we collect about you

3.1 Career inquiries
We offer you the opportunity to apply for a position at the Practice through our Website or direct digital channels. As part of any recruitment process, we collect and process the following information:
a) Cover letter, CV, work samples (portfolio), and contact information, which typically include your name, address, email, telephone no., and a picture of you.
b) Details of your qualifications, skills, experience, and employment history.
Our processing of the above-mentioned personal data takes place on the grounds of the PDPA general principle, as the processing is necessary in order to take steps at the request of the data subject prior to entering into a contract of employment or internship.

3.2 Contact information about your as a customer or cooperation partner
In order to conduct professional architectural consultancy, we may process personal data about you. The type of data processed depends on the nature and context of our work. We typically collect and process general contact information such as your email address, job position, telephone number, and professional CV.
Our processing of the above-mentioned personal data takes place on the grounds of the PDPA, as the processing is necessary for the performance of a professional service contract or in order to take necessary steps prior to entering into a contract.

3.3 Inquiries from you
When you send an inquiry to us through email or via the Website, we collect and process your contact information and other information related to your inquiry. Our processing of your data is based on our legitimate interest in responding to your inquiry effectively.

4.0 Security

4.1 All your personal data are stored on secure servers located in Malaysia and/or through secured cloud-based infrastructure. We ensure that any service providers used to host this data maintain security protocols that align with our professional standards.

4.2 We have implemented appropriate technical, organisational, and physical measures to ensure a high level of protection for your personal data. These measures are designed to prevent accidental or unlawful destruction, loss, alteration, and unauthorised disclosure or access, in strict accordance with the security principle and security standards prescribed under the PDPA.

4.3 Despite our efforts to maintain a secure environment for the Website, you should be aware that no method of transmission over the Internet or electronic storage is completely secure. Therefore, while we strive to protect your personal data, the Practice cannot guarantee its absolute security, and you should always take necessary safeguards on your own equipment and network.

5.0 Duration of storage

5.1 We will store your personal data until these are no longer necessary for us to process. In certain situations, it may be difficult to envisage an exact period, but the below paragraphs list our periods for the processing of your personal data.
5.1.1 Career Inquiries Until 1 year after you have submitted the information and documents in accordance with professional recruitment standards in Malaysia.
5.1.2 Contact information about you as a customer or cooperation partner Until 7 years after the completion of a project or the conclusion of a professional engagement, in accordance with the Limitation Act 1953 and professional indemnity requirements.

5.2 Inquiries from you Until 12 months after completion of processing.

5.3 If we have reason to store your personal data as part of the protection of our legitimate interests, including for example legal disputes, we reserve our right to store your personal data for an extended period and minimum until the legal dispute has been determined.

6.0 Your rights

6.1 Your right of access
You are at any time entitled to submit a written request to receive information regarding our processing of your personal data. This includes details on the information we have registered about you, the purpose of processing, and the categories of recipients to whom the data may be disclosed.
You are entitled to receive a copy of the personal data we process about you. In accordance with the PDPA, we are entitled to charge a prescribed fee to cover administrative costs for such requests. Requests must be sent in writing to our official email address along with sufficient documentation to verify your identity.

6.2 Your right to rectification
You have the right to have inaccurate or incomplete personal data rectified by us without undue delay. If you become aware of errors in the information we maintain, we urge you to contact us in writing so that we may update our records.

6.3 Your right to withdraw consent
You are at any time entitled to withdraw your consent to our processing of your personal data. Please be aware that if you withdraw your consent, we may still be entitled to continue processing your data if there is another legal basis for doing so, such as the fulfillment of an ongoing contract or legal obligation. We will inform you if such circumstances apply.

6.4 Your right to prevent processing
You have a right to request that we cease or not begin processing your personal data if the processing is causing, or is likely to cause, substantial and unwarranted damage or distress to you or another person.

6.5 Your right to prevent processing for direct marketing
You have a right to instruct us in writing to cease or not begin processing your personal data for the purposes of direct marketing.

6.6 Your right to deletion
While the PDPA does not explicitly use the term "right to erasure" in the same manner as the GDPR, we comply with the retention principle, which requires us to destroy or permanently delete personal data once it is no longer necessary for the purpose for which it was processed. You may request the deletion of your data if you believe the processing purpose is no longer valid or you have withdrawn your consent.

6.7 Your right to complain
If you wish to lodge a complaint regarding our processing of your personal data, please contact us via our official email address.
If we are unable to resolve your concern, you may lodge a formal complaint with the supervisory authority in Malaysia. The supervisory authority is the Department of Personal Data Protection (JPDP), Ministry of Digital, Level 6, Complex E, Federal Government Administrative Centre, 62607 Putrajaya, Malaysia.

7.0 Changes

7.1 We reserve the right to update or amend this Privacy Policy from time to time to reflect changes in our professional practices or legal requirements. If such changes are substantial, we will notify you via our Website or via email, provided we have your contact details on record.

7.2 The latest version of the Privacy Policy will always be available on our Website. We encourage you to review this policy periodically to stay informed about how we are protecting your personal data.

Last updated on April 2026.