Legal

Privacy notice

Last updated 12 August 2026. This notice describes how APIPipeline Grid Advisory handles personal data in Malaysia.

Controller

APIPipeline Grid Advisory, A 579 Jalan Sultan Azlan Shah Utara, Taman Tasek Baru, Ipoh, Perak, 31400, Malaysia. Email engagements@apipipelinegrid.digital, telephone +60 30548-9530.

What we collect

From an enquiry form or email: your name, organisation, email, telephone if given, the engagement you have in mind, and the message. During an engagement we may see names and user identifiers that appear inside the invoice application (approvers, clerks, vendor contacts) because they are part of the audit trail. We do not seek extra personal data beyond what the examination requires.

Why we use it

To reply to enquiries, to carry out the engagement you requested, to invoice, to keep professional records, and to meet legal duties in Malaysia. We do not sell personal data and we do not use it for advertising networks.

Legal basis under PDPA 2010

Enquiry data is used to take steps at your request toward a possible engagement. Engagement data is used to perform the contract and to meet record-keeping and professional obligations. Where consent is asked (for example, the enquiry checkbox), you may refuse; we then cannot reply through that form.

Sharing

We share data with professional advisers who assist us (for example, an accountant) under confidentiality, with banks for payment of our invoices, and with authorities if Malaysian law requires it. Findings letters go to the organisation that engaged us. We do not use overseas marketing platforms for this site’s forms.

Retention

Unsuccessful enquiries are kept up to 24 months. Engagement files, including sampling worksheets, are kept for seven years after the close meeting unless a longer period is required by law or by a dispute. You may ask for access or correction by writing to the email above, subject to PDPA exceptions (for example, where disclosure would reveal another person’s data or privileged advice).

Security

Practice files are limited to the examiners on the engagement. Production access to your invoice application is used only during the engagement and is not copied wholesale onto portable media. No method of transmission is perfect; we will tell you if we become aware of a breach affecting your personal data as required by applicable law.

This website

Server logs may record technical addresses and pages requested, used only to keep the site working. Cookie preference storage is described in the cookie notice.

Complaints

Write to us first. You may also contact the Personal Data Protection Commissioner in Malaysia.