Privacy policy.
This policy describes the personal information Halcyon Touch Academy collects through this website, on the phone, and in person, why we collect it and how we look after it. It is written in plain English on purpose.
Last updated: 6 May 2026.
Halcyon Touch Academy (“the Academy”, “we”, “our”) is operated by Halcyon Touch Academy Sdn. Bhd., a company registered in Malaysia under registration number 202308156491 (1521844-W), with its registered studio at Suite 14-3, Menara Aspire, Jalan Sultan Ismail, 50250 Kuala Lumpur, Malaysia. We are the data controller for personal information collected through this website and our admissions process.
Who this policy applies to
This policy covers prospective students who contact us about admission, current students enrolled in any of our streams, alumni who remain on our graduate register, visitors who book a studio tour, corporate buyers who request our onsite services, and any individual who emails or calls the school.
What we collect, and why
Information you give us directly
- Name and contact details — to reply to your enquiry and to communicate with you about your application.
- Background and motivation — what you tell us about why you are considering a stream, so that we can advise you on which stream is right.
- Health considerations — only what you choose to share, and only where it is relevant to whether the stream is physically appropriate for you.
- Payment details — name, billing address and bank reference for fee instalments.
Information collected automatically by this website
- A small number of necessary cookies to keep your form submission session secure (a CSRF token in particular).
- Server-side request logs (IP address, user agent, page requested, timestamp) kept for fourteen days for security and operational reasons.
How we use what we collect
To answer your admissions enquiry. To enrol you in a stream and run that stream day-to-day. To issue receipts and certificates. To stay in light contact with our alumni for the purposes of continuing-education events and panel referrals. To meet our legal obligations under Malaysian law.
What we do not do
We do not sell or rent your personal information to anyone. We do not run programmatic advertising on this site. We do not run third-party trackers beyond what is strictly necessary for the form to work. We do not put student photographs or names on this website without an explicit signed release.
How long we keep information
- Admissions enquiries that do not become enrolments are deleted twelve months after the last contact.
- Student records for enrolled students are retained for seven years after graduation, in line with the period during which a graduate may request a confirmation of training in writing.
- Server-side logs are kept for fourteen days, then rotated.
How we protect what we hold
Personal information held electronically is stored on access-controlled systems with two-factor authentication for all administrative accounts. Paper records — primarily the printed logbooks — are held in a locked cabinet inside the studio. Access to either is restricted to the trainers and the academy administrator.
Your rights
Under Malaysia's Personal Data Protection Act 2010, you have the right to ask us what personal information we hold about you, to correct it if it is inaccurate, to request its deletion, to withdraw consent that you have previously given, and to make a complaint to the Personal Data Protection Commissioner. We will respond to any such request within fifteen working days, normally faster.
How to reach the data controller
By email: [email protected]. By phone: +6019-228 4715. By post: Suite 14-3, Menara Aspire, Jalan Sultan Ismail, 50250 Kuala Lumpur, Malaysia.
Changes to this policy
If we update this policy, we will change the “last updated” date at the top of this page and, where the change is material, notify our enrolled students by email.