Privacy Policy

1. Information We Collect

When you book a session or interact with us, we may collect:

• Contact details — name, email address, phone/WhatsApp number.
• Booking details — event date, event type, package selected, venue/event location, and special requests.
• Payment information — processed securely via our payment gateway. We do not store your full card or bank details on our servers.
• Media — photos and videos captured during your session, where applicable.

Fields marked as required on our forms are obligatory — we need them to process your booking, and we cannot provide the service without them. Other fields are voluntary.

2. How We Use Your Information

• To process and manage your booking, contract, and payment.
• To communicate with you about your session, gallery delivery, and reminders.
• To deliver your photos and videos.
• To improve our services and respond to enquiries.
• To comply with legal, tax, and accounting obligations.

3. Disclosure to Third Parties

We only share your data where necessary to provide our services, including with:

• Payment processors to handle transactions.
• Email service providers to send booking confirmations and reminders.
• Cloud infrastructure providers that host our application and database.
• Crew members assigned to your shoot, limited to details needed to do their job.
• Advertising and analytics providers, which receive a securely hashed (one-way encrypted) version of your contact number so we can measure which adverts led to genuine enquiries. They cannot recover your number from it, and it is never shared in readable form.

We do not sell or rent your personal data to anyone.

4. Cross-Border Transfer of Data

Our systems rely on reputable cloud providers, and some of your data may be processed or stored on servers located outside Malaysia — including Singapore (our primary database and application region) and the United States (email and certain Google services). Where data is transferred outside Malaysia, we take reasonable steps to ensure it remains protected to a standard consistent with the PDPA.

5. Data Storage & Security

Your data is stored on secure, access-controlled cloud infrastructure. We apply row-level access controls so that your records are only accessible to authorised studio staff. While we take reasonable measures to protect your data, no method of transmission or storage is completely secure.

6. Data Retention

We retain booking and financial records for as long as necessary to fulfil our services and meet legal/tax obligations — generally up to seven (7) years for financial and tax records, in line with Malaysian tax record-keeping requirements. Delivered galleries may expire after a stated period; please download your files before then.

7. Your Rights

Under the PDPA, you have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Withdraw consent or limit how we process your data (this may affect our ability to deliver services).

To exercise these rights, contact us using the details below.

8. Data Breach Notification

In the event of a personal data breach that is likely to cause significant harm, we will take prompt steps to contain it and will notify the Personal Data Protection Commissioner and affected individuals where required under the PDPA and its amendments.

9. Staff & Crew Data

We also process personal data of our staff and crew (such as bank account and identification details) for payroll and engagement purposes. This data is access-restricted to authorised personnel and retained only as long as needed for employment, payment, and legal obligations.

10. Contact Us

For any questions about this Privacy Policy, to exercise your rights, or to reach our data protection contact:
Email: hello@tulipsfilm.com.my
Phone: 0103252008