1. Introduction
Red Eagle Digital Sdn. Bhd. respects your privacy and is committed to protecting your personal data in accordance with the Personal Data Protection Act 2010 (Act 709) of Malaysia, as amended by the Personal Data Protection (Amendment) Act 2024 (collectively, the “PDPA”).
This Privacy Policy, which also serves as our Personal Data Protection Notice under Section 7 of the PDPA, explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have over it.
By using our website, contacting us or engaging our services, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described here.
2. Who We Are
| Item | Details |
|---|---|
| Company name | Red Eagle Digital Sdn. Bhd. |
| Company registration no. | 202601019457 (1681554-U) |
| Registered address | No. 38, Taman Saujana Impian 3, Saujana Impian, 02600 Arau, Perlis, Malaysia |
| Telephone / WhatsApp | +60 19-673 5003 |
| [email protected] | |
| Website | https://redeagledigital.my |
In this Privacy Policy, “Red Eagle Digital”, “we”, “us” and “our” refer to Red Eagle Digital Sdn. Bhd. “You” and “your” refer to any individual whose personal data we process, including website visitors, prospective clients, clients and their representatives, job applicants and suppliers.
3. Scope and Our Role
This Privacy Policy applies to personal data collected through our website at https://redeagledigital.my, our contact and inquiry forms, WhatsApp, email, telephone, social media pages, meetings, and in the course of providing our services.
We process personal data in two different capacities:
- As a data controller. For personal data we collect for our own business purposes, such as inquiries from prospective clients, client account management, billing, recruitment and supplier management, Red Eagle Digital is the data controller.
- As a data processor. When we run advertising campaigns, lead generation, CRM and automation systems (including WhatsApp broadcasts, email drips and SMS reminders) on behalf of our client clinics, the personal data of their leads, prospective patients and patients belongs to the respective clinic. In this case, the clinic is the data controller and we act as a data processor, processing such data only on the clinic’s instructions and for the purposes agreed in our service agreement.
If you are a patient or prospective patient of one of our client clinics and wish to exercise your rights over your data, please contact the clinic directly. We will assist the clinic in responding to your request where required.
4. Personal Data We Collect
Depending on how you interact with us, we may collect the following categories of personal data:
| Category | Examples |
|---|---|
| Identity and contact data | Full name, clinic or company name, job title, email address, telephone and WhatsApp number, business address |
| Inquiry data | Package of interest, messages and information you submit through our forms, WhatsApp, email or calls |
| Business and billing data | Company registration details, billing address, invoices, payment records, service agreements |
| Account access data | Access granted to us for your advertising accounts, social media pages, Google Ads, website, CRM and analytics platforms |
| Technical and usage data | IP address, browser type, device information, pages visited, time spent, referring URL, cookie identifiers |
| Communication records | Correspondence, meeting notes, call logs and feedback |
| Recruitment data | CV, qualifications, employment history and references, if you apply for a job with us |
| Client lead and patient data (as processor) | Names, contact numbers, treatment interest, appointment details and enquiry history of leads and patients of our client clinics |
Sensitive personal data. We do not intentionally collect sensitive personal data, such as information on physical or mental health, through our website. However, lead and patient data we process on behalf of client clinics may include information relating to health or treatment interest. Such data is processed only on the clinic’s instructions, with access restricted to authorised personnel, and the clinic remains responsible for obtaining any explicit consent required under Section 40 of the PDPA.
5. How We Collect Personal Data
We collect personal data:
- directly from you, when you fill in our inquiry form, contact us by WhatsApp, email or telephone, meet us, sign a service agreement or apply for a job;
- automatically, through cookies and similar technologies when you browse our website;
- from our client clinics, when they share lead, patient or business data with us for the purpose of the services;
- from third party platforms we manage for clients, such as Meta (Facebook and Instagram) lead forms, Click-to-WhatsApp campaigns, Google Ads, TikTok and CRM systems; and
- from publicly available sources, such as company registries and business directories.
6. Obligatory and Voluntary Data
The personal data marked as required in our forms (name, email, phone number and clinic or company name) is obligatory. If you do not provide it, we may not be able to respond to your inquiry, prepare a proposal, enter into a service agreement or provide our services to you.
Any other information you provide, such as your message or selected package, is voluntary.
7. Purposes of Processing
We process your personal data for the following purposes:
- To respond to your inquiries, arrange consultations and prepare proposals or quotations.
- To enter into, manage and perform our service agreement with you, including onboarding, campaign setup, content production, reporting and account management.
- To run, monitor and optimise advertising campaigns, lead management systems and automation on behalf of our client clinics.
- To issue invoices, process payments, manage collections and keep accounting and tax records.
- To communicate with you about our services, updates, performance reports and changes to our terms.
- To operate, maintain, secure and improve our website, including analysing how visitors use it.
- To evaluate job applications and manage recruitment.
- To send you marketing communications about our services, where you have consented or where permitted by law.
- To prevent fraud, investigate misuse and protect our rights, property and safety.
- To comply with legal and regulatory obligations, court orders and requests from government authorities.
- For any other purpose directly related to the above.
8. Consent
We process your personal data based on your consent. You give your consent when you submit our inquiry form, contact us, browse our website with cookies enabled, sign our service agreement or continue to use our services after being given this Privacy Policy.
You may withdraw your consent at any time by writing to us using the contact details in Section 19. Withdrawing consent will not affect processing that took place before the withdrawal, but it may mean we can no longer provide some or all of our services to you.
9. Direct Marketing
We may send you newsletters, promotions, case studies and information about our services by email, WhatsApp, SMS or telephone. Under Section 43 of the PDPA, you have the right to ask us to stop processing your personal data for direct marketing at any time.
To opt out, reply “STOP” to our WhatsApp or SMS, click the unsubscribe link in our emails, or write to us. We will act on your request within a reasonable time.
10. Disclosure of Personal Data
We do not sell or rent your personal data. We may disclose it, only to the extent necessary, to the following classes of third parties:
| Recipient | Why we share |
|---|---|
| Our employees and authorised personnel | To provide services, on a need-to-know basis and under confidentiality obligations |
| Advertising and social media platforms (Meta, Google, TikTok) | To run, target and measure campaigns you or your clinic have authorised |
| Technology and cloud service providers | Website hosting, content delivery and security, email, cloud storage, CRM, messaging (including WhatsApp Business), automation and analytics tools |
| Professional advisers | Lawyers, auditors, accountants, tax agents and company secretaries |
| Payment and banking institutions | To process payments and refunds |
| Client clinics | To deliver leads and reports that belong to them, where you are their lead or patient |
| Government and regulatory authorities | Where required by law, court order or a lawful request, including the Personal Data Protection Commissioner, LHDN, police and the courts |
| A buyer or successor | In a merger, acquisition, restructuring or sale of all or part of our business, subject to equivalent protection |
All service providers who process personal data on our behalf are required to protect it, keep it confidential and use it only for the purposes we specify.
11. Data We Process for Client Clinics
When we act as a data processor for a client clinic:
- we process lead and patient data only on the clinic’s documented instructions and for the purposes of the agreed services;
- we do not use such data for our own marketing or share it with other clients;
- we apply security measures in line with the Security Principle under Section 9 of the PDPA;
- we notify the clinic without undue delay if we become aware of a personal data breach affecting its data, so that the clinic can meet its notification obligations; and
- at the end of the engagement, we return or delete the clinic’s data as agreed, unless retention is required by law.
12. Transfer of Personal Data Outside Malaysia
Some of our service providers, including advertising platforms, cloud hosting, email and messaging services, store or process data on servers located outside Malaysia. As a result, your personal data may be transferred to and processed in other countries.
Where we transfer personal data outside Malaysia, we do so in accordance with Section 129 of the PDPA and the Commissioner’s guidelines on cross-border personal data transfer. We take reasonable steps to ensure the recipient country has laws substantially similar to the PDPA, or that the data will be protected at a level at least equivalent to the PDPA, for example through contractual safeguards with the service provider.
13. Cookies and Tracking Technologies
Our website uses cookies and similar technologies to make it work properly, remember your preferences, keep it secure and understand how visitors use it. We may also use analytics and advertising tools, such as Google Analytics, Google Ads tags and the Meta Pixel, to measure the performance of our own marketing.
| Type | Purpose |
|---|---|
| Strictly necessary | Core website functions, security and form submission |
| Performance and analytics | Counting visits, traffic sources and page performance |
| Functional | Remembering your choices and display settings |
| Advertising | Measuring ad performance and showing relevant ads on other platforms |
You can block or delete cookies through your browser settings. Blocking some cookies may affect how the website works. Where required, we will ask for your consent before placing non-essential cookies.
14. Data Security
We take reasonable technical and organisational measures to protect personal data from loss, misuse, modification, unauthorised or accidental access or disclosure, alteration or destruction, in line with the Security Principle of the PDPA. These measures include:
- access controls, so that only authorised personnel can access personal data on a need-to-know basis;
- secure, password-protected accounts with two-factor authentication where available;
- encrypted connections (HTTPS) on our website;
- confidentiality obligations for our employees and service providers; and
- regular review of access rights to client advertising accounts and systems.
No method of transmission over the internet or electronic storage is completely secure. While we work hard to protect your data, we cannot guarantee absolute security.
15. Personal Data Breach
If we become aware of a personal data breach involving data for which we are the data controller, we will notify the Personal Data Protection Commissioner as soon as practicable, in accordance with Section 12B of the PDPA and the Commissioner’s guidelines on data breach notification. Where the breach causes or is likely to cause significant harm to you, we will also notify you without unnecessary delay.
Where the breach involves data we process for a client clinic, we will notify the clinic promptly and support it in managing the breach.
16. Retention of Personal Data
We keep personal data only for as long as necessary to fulfil the purposes in this Privacy Policy, or as required by law.
| Type of data | Retention period |
|---|---|
| Inquiries that do not lead to an engagement | Up to 2 years from the last contact |
| Client, contract, billing and accounting records | 7 years after the end of the relevant financial year, as required under the Companies Act 2016 and the Income Tax Act 1967 |
| Lead and patient data processed for client clinics | For the duration of the engagement, then returned or deleted as agreed with the clinic |
| Job applications (unsuccessful) | Up to 1 year |
| Cookie and analytics data | According to the settings of the relevant tool, generally up to 26 months |
When personal data is no longer needed, we will securely delete, destroy or anonymise it.
17. Your Rights
Subject to the PDPA and any exemptions it provides, you have the following rights:
| Right | What it means |
|---|---|
| Access (Section 30) | Ask whether we hold your personal data and request a copy of it |
| Correction (Section 34) | Ask us to correct personal data that is inaccurate, incomplete, misleading or not up to date |
| Withdraw consent (Section 38) | Withdraw your consent to our processing of your personal data |
| Prevent processing likely to cause damage or distress (Section 42) | Ask us to stop processing that causes, or is likely to cause, substantial and unwarranted damage or distress |
| Prevent direct marketing (Section 43) | Ask us to stop using your personal data for direct marketing |
| Data portability (Section 43A) | Ask us to transmit your personal data to another data controller of your choice, where technically feasible and compatible in data format |
To exercise any of these rights, write to us using the contact details in Section 19. We may need to verify your identity before acting on your request, and may charge a fee for data access requests as permitted under the PDPA and its regulations. We will respond to access and correction requests within 21 days of receiving them, or inform you of the reasons if we are unable to do so.
You also have the right to lodge a complaint with the Personal Data Protection Commissioner, Jabatan Perlindungan Data Peribadi, if you believe your personal data has been processed in breach of the PDPA.
18. Children and Third Party Websites
Our website and services are intended for businesses and individuals aged 18 and above. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
Our website may contain links to third party websites and platforms, such as WhatsApp, Facebook, Instagram, TikTok and Google. We are not responsible for the privacy practices of these third parties. Please read their privacy policies before providing your personal data to them.
19. Contact Us and Data Protection Officer
If you have any questions, requests or complaints about this Privacy Policy or our handling of your personal data, please contact our Data Protection Officer:
Data Protection Officer
Red Eagle Digital Sdn. Bhd.
No. 38, Taman Saujana Impian 3, Saujana Impian, 02600 Arau, Perlis, Malaysia
Email: [email protected]
Telephone / WhatsApp: +60 19-673 5003
Please use the subject line “Personal Data Request” so we can route your request quickly.
20. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in the law, our services or our practices. The updated version will be posted on this page with a new “Last updated” date. Where the changes are significant, we will take reasonable steps to notify you. Your continued use of our website or services after the update means you accept the revised Privacy Policy.
21. Language
In accordance with Section 7(3) of the PDPA, this Privacy Policy is provided in English and Bahasa Malaysia. If there is any inconsistency between the two versions, the English version shall prevail.