Privacy policy.

The data controller.

The data controller responsible for personal data collected through this Site is Infraconcrete Construction Sdn Bhd, a private limited company registered in Malaysia (CIDB G7, ISO 9001:2015). Registered office: 8B, Jalan SS22/25, Damansara Jaya, 47400 Petaling Jaya, Selangor, Malaysia. Contact: ifrconcrete@gmail.com / +60 16-428 1214.

Categories of personal data collected on this Site.

Information you provide voluntarily

• Contact form / WhatsApp enquiry data: name, email address, phone number, company name, project details, and any other information you choose to share in your message.
• Career enquiries: name, contact details, CV, work history, professional credentials.
• Brochure / document download requests: email address only (if you submit one).

Information collected automatically

• Google Analytics 4 (GA4) tracking data: IP address (anonymised by GA4 default IP anonymisation), browser type and version, device type, operating system, screen resolution, language preference, referring URL, pages visited, time on page, click events, geographic region (country / city level only, not precise location).
• Server logs: standard web server logs maintained by GitHub Pages (our hosting provider) and Fastly (our CDN), including IP address, request timestamp, requested URL, HTTP status code, user agent. These logs are retained per GitHub's and Fastly's standard policies.
• Cookies and similar technologies: see Section 04 below.

We do NOT collect: NRIC / passport numbers, bank account details, credit card information, biometric data, government identification numbers, health records, or any sensitive personal data as defined under PDPA Section 4. We do not run advertising trackers, retargeting pixels, or sell personal data to third parties.

How we use your personal data.

• To respond to enquiries: answering your WhatsApp messages, emails, or contact form submissions about our services, providing budget estimates, sharing engineering input, scheduling site visits.
• To deliver our services: if you engage us for a project, your contact details are used for project communications, contract administration, invoicing, and site coordination.
• To process career applications: reviewing your CV, scheduling interviews, conducting reference checks (with your consent), making employment offers.
• To improve the Site: aggregated GA4 analytics help us understand which pages are useful, what information visitors are looking for, and where the Site has gaps. We do not use GA4 to target advertising.
• To comply with legal obligations: tax records, contract records, statutory reporting to JKR / LLM / MOW / KKR or other government agencies, anti-money-laundering checks where applicable.
• To protect our legal interests: investigating misuse of the Site, defending against claims, responding to court orders or government investigations.

We will not use your personal data for any purpose that is incompatible with the purposes listed above without your prior consent.

Cookies, GA4, and what they do.

Google Analytics 4 (GA4)

We use Google Analytics 4 (measurement ID G-DRSYDHBKMZ) to understand visitor behaviour on the Site. GA4 places cookies in your browser to track your session, count repeat visits, and aggregate usage statistics. GA4 collects IP address (anonymised), browser fingerprint, page views, click events, and approximate geographic region. Data is sent to Google servers and processed under Google's privacy policy at https://policies.google.com/privacy.

You can opt out of GA4 tracking by installing the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout, or by blocking cookies in your browser settings, or by enabling "Do Not Track" or similar privacy modes.

Other cookies

Beyond GA4, the Site uses minimal cookies. We do not run advertising cookies, retargeting pixels, social media trackers, or behavioural advertising trackers. Your language preference (English, Bahasa Malaysia, or Chinese) may be stored in a first-party cookie or localStorage to remember your selection across visits.

Server-side logging by hosting providers

Our hosting provider GitHub Pages and CDN provider Fastly maintain standard web server logs as part of their service operation. These logs include IP address, timestamp, requested URL, response code, and user agent. Their privacy policies are at github.com/site-policy and fastly.com/privacy.

Who we share your data with.

We do not sell, rent, or trade personal data. We disclose personal data only as follows:

• Within the group: with our sister company Starwall Sdn Bhd and our parent group Panthera Group, where you have enquired about or engaged services that involve those entities (typically STRATA Geosystems supply via Starwall).
• With service providers: Google (GA4), GitHub (hosting), Fastly (CDN), our email provider, and similar processors that help us operate the Site. These processors are contractually obligated to protect your data and use it only for the stated purposes.
• With consultants and project partners: where you engage us for a project, contact details may be shared with the appointed consulting engineer, main contractor, authority (JKR / LLM / MOW / KKR), or other project participants as required for the project.
• With government and law enforcement: in response to lawful court orders, subpoenas, tax authority audits, or other legal requirements.
• In a business transfer: if Infraconcrete is acquired, merged, or its assets transferred, personal data may be transferred as part of the transaction, subject to confidentiality protections.

Data transferred outside Malaysia.

Google (GA4), GitHub, and Fastly are based outside Malaysia and may process your personal data on servers located in the United States, the European Union, Singapore, or other jurisdictions. We rely on the standard contractual protections, security measures, and privacy frameworks of these providers (such as the EU-US Data Privacy Framework, ISO 27001 certification, and SOC 2 controls). Per PDPA Section 129, by using the Site you consent to this cross-border transfer where it is necessary for the operation of the Site and the provision of our services to you.

How long we keep your data.

• Contact / enquiry data: retained for up to 3 years from last contact, then deleted or anonymised, unless a project is engaged (in which case see below).
• Project records: retained for the design life of the project plus 6 years (or longer where required by law, contract, or insurance), typically 7 to 60 years for permanent geotechnical works.
• Career application data: retained for up to 12 months after the application is closed, then deleted unless you consent to longer retention for future opportunities.
• GA4 analytics data: retained per GA4 default 14-month retention setting, after which user-level data is automatically deleted by Google.
• Server logs: retained per GitHub and Fastly default policies (typically 30 to 90 days).
• Tax and accounting records: retained for 7 years per Malaysian tax legislation.

Your rights as a data subject.

Under the Personal Data Protection Act 2010 (Malaysia), you have the following rights:

• Right to access: request a copy of the personal data we hold about you.
• Right to correct: request correction of inaccurate or incomplete data.
• Right to withdraw consent: withdraw consent for processing where consent is the legal basis. Note that withdrawing consent does not affect the lawfulness of processing before the withdrawal.
• Right to limit processing for direct marketing: require us to stop processing your personal data for direct marketing purposes (we do not currently conduct direct marketing).
• Right to data portability: receive your personal data in a structured, commonly used, machine-readable format.
• Right to lodge a complaint: file a complaint with the Personal Data Protection Commissioner of Malaysia (Pesuruhjaya Perlindungan Data Peribadi, JPDP) if you believe we have not complied with PDPA.

To exercise any of these rights, please contact us at ifrconcrete@gmail.com. We will respond within 21 days as required by PDPA, or as soon as reasonably practicable.

How we protect your data.

We take reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These include HTTPS encryption on all Site traffic, restricted access to project files within our organisation, password-protected email accounts, ISO 9001:2015 quality system controls on document handling, and regular review of our information security practices. However, no system is perfectly secure; if we become aware of a personal data breach affecting your information, we will notify you and the Personal Data Protection Commissioner where required by PDPA.

Not directed at children.

The Site is intended for property developers, engineers, contractors, quantity surveyors, government agencies, and other adult professional users. We do not knowingly collect personal data from individuals under 18 years of age. If you believe we have inadvertently collected personal data from a minor, please contact us at ifrconcrete@gmail.com and we will delete it promptly.

Updates and amendments.

We may update this privacy policy from time to time to reflect changes in legislation, our practices, or the services we provide. The "Last updated" date at the top of this policy will indicate when the policy was last revised. Material changes will be communicated by an updated dateModified field in the page metadata. Your continued use of the Site after changes constitutes acceptance of the revised policy.

Privacy enquiries.

For any questions about this privacy policy, to exercise your PDPA rights, or to raise a concern, please contact us:

• Email: ifrconcrete@gmail.com
• WhatsApp / Phone: +60 16-428 1214 or +60 12-236 2159
• Post: Infraconcrete Construction Sdn Bhd, 8B, Jalan SS22/25, Damansara Jaya, 47400 Petaling Jaya, Selangor, Malaysia

For complaints not resolved by us, you may contact the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi) at www.pdp.gov.my.

Also relevant.