This notice explains what personal data we collect, why, who we share it with, how long we keep it, and the choices and rights you have. It’s written for the Personal Data Protection Act 2010, as amended in 2024 (PDPA).
1. Who we are
Hexa Partners & Technologies Sdn. Bhd. (202201046763 / 1492460-M) is the data controller (pengawal data) responsible for your personal data. In this notice, “Hexa Partners”, “we”, “us” and “our” mean that company.
- Registered address: H-16-02A, Mutiara Ville, Persiaran Bestari, Cyber 11, 63000 Cyberjaya, Selangor, Malaysia
- Our data protection officer, for privacy questions and requests: hey@hexa.partners
2. What this notice covers
It covers hexa.partners and everything you do through it:
- the free diagnostic and your report
- waitlists and our newsletter
- ESC founding membership, including payments, your member page, coaching credits, onboarding intakes, the founders’ group and the Founders’ Wall
- alumni price claims
- booking calls and sessions with us
- emails between you and us
3. What we collect
| When you… | We collect |
|---|---|
| take the diagnostic | your answers and your result (stage, region, segment and goal). These stay anonymous until you give us your email. |
| ask for your report | your email address and whether you want our newsletter |
| join a waitlist | your email address, your country and whether you want our newsletter |
| subscribe to our newsletter | your email address |
| join ESC | your email address, full name, confirmation that you live in Malaysia and are at least 18, that you agreed to our terms, and whether you want our newsletter |
| pay | Stripe collects your payment details. We receive the payment status, amounts, Stripe’s reference numbers and the country that issued your card. We never see your full card number. |
| claim an alumni price | your email address and, if you upload one, your certificate with its type, year and organiser |
| use your member page | your intake choice, your phone number if you give it for the founders’ group, and your Founders’ Wall choice, display name and city |
| book a call or coaching session | the name and email address you enter on the booking calendar, and our record of each session (date, coach and an optional note) |
| email us | your email address and what you write |
| visit the site | your country, worked out from your IP address; page statistics without cookies; the steps you take through our pages, with a session ID for that browser tab, the campaign tags in the link you followed and, once you’re a member, your member ID; and a salted hash of your IP address where we need one to stop abuse |
| agree to our terms or give a consent | the date and time, a salted hash of your IP address, and the version of the document you saw |
We don’t ask for sensitive personal data, such as health, biometric, political or religious information.
Identity numbers. If you upload an alumni certificate, black out your MyKad / NRIC number or passport number first. We reject certificates that show them, and we aren’t responsible for identity numbers you leave visible.
Most of this comes from you. Some comes from others:
- Stripe tells us whether a payment went through and which country issued your card.
- Cloudflare tells us which country your connection comes from.
- Our alumni lists come from our past courses, workshops, programmes and bootcamps, for people who agreed to hear from us. For programmes our clients ran, we don’t use their lists. We only check certificates.
4. Why we use it, and our legal basis
We use your personal data on these grounds:
| Ground | What we use it for |
|---|---|
| To perform our contract with you, or take steps you ask for before one | showing your result and sending your report; selling you ESC, taking payments, checking your card was issued in Malaysia, and giving you your founding number and member link; running your membership (releasing and tracking coaching credits, booking and recording sessions, managing intakes, service emails); checking alumni claims; replying to you, and handling refunds and complaints |
| To meet a legal duty | keeping the records we need for tax, audit, e-invoicing and the law |
| Your consent | our newsletter and the one checkout reminder; the Founders’ Wall; using your phone number to match your request to the founders’ WhatsApp group; using an alumni list you agreed to be on |
| Our legitimate interests | keeping the site secure, preventing abuse and fraud, understanding how people use our pages so we can improve them, and defending legal claims |
We also tell you when something you’re waiting for opens, such as a country, a founding seat or an item from your diagnostic result that’s coming in Release 1, our next product release. We only do this for people who have asked us to.
What we ask your consent for
We record each consent you give, with the date and the version of the notice or terms you saw. You can withdraw any consent at any time (section 10).
| Consent | What it’s for |
|---|---|
| Terms | You agree to our terms of use and purchase, our membership terms and our refund and instalment policy when you join ESC. We record the version of each. |
| Privacy notice | You confirm you’ve been given this notice when you give us your email. |
| Newsletter | Our weekly newsletter, plus the one checkout reminder. Optional and unticked by default. |
| Founders’ Wall | Showing your first name, initial and city on our public wall. Optional and off by default. |
| Founders’ group | Using the phone number you give us to match your request to the WhatsApp group. Optional. |
| Alumni lists | We only import an alumni list when the people on it agreed to hear from us. We record that basis for each list. |
If you were on one of our past course or workshop lists and agreed to hear from us, we may email you about the alumni price. Every marketing email has a working unsubscribe link.
5. What you have to give us
To join ESC, we need your email address, your full name and your confirmation that you live in Malaysia and are at least 18. Without them, we can’t sell you a membership. To send your report or add you to a waitlist, we need your email address.
Everything else is optional: the newsletter, your phone number, the Founders’ Wall, your intake choice and a certificate. Leaving them out just means you won’t get that part of the service.
6. Who we share it with
We don’t sell your personal data, and we don’t use it for advertising.
Providers who process data for us (data processors, pemproses data). They may use personal data only on our instructions, to run our service:
| Provider | What they do for us |
|---|---|
| Cloudflare | Hosts the site, protects it from abuse (including Turnstile checks on forms), gives us page statistics without cookies, and privately stores alumni certificates |
| Neon | Hosts our database |
| Resend | Sends our service emails |
| Brevo | Holds our newsletter list and sends the newsletter |
Companies that are controllers in their own right for their own purposes, such as security and preventing fraud, under their own privacy policies:
| Company | What they do |
|---|---|
| Stripe | Takes payments and runs instalment plans, refunds and the customer portal |
| Runs our email (Google Workspace) and our booking calendars (Google Calendar) | |
| Meta (WhatsApp) | Runs the founders’ group. When you join, WhatsApp handles your phone number, profile and messages under its own terms. Depending on the group’s settings, other members may see your phone number and name. |
We may also share personal data:
- with coaches who deliver your sessions for us
- with our professional advisers, such as our lawyer and accountants
- with authorities, when the law requires it
7. Transfers outside Malaysia
Some of our providers store or process personal data outside Malaysia. This is where we understand it is held:
| Provider | Where |
|---|---|
| Neon (our database) | Singapore |
| Resend (service emails) | Tokyo, Japan, and the United States |
| Cloudflare (hosting, security, certificate storage, page statistics) | A worldwide network; the page you see is served from a data centre near you |
| Stripe (payments) | The United States, Singapore and other countries. Stripe, not us, handles your card or bank details |
| Brevo (newsletter) | The European Union (France and Germany) |
| Google (email and calendars) | A worldwide network of data centres |
| Meta (WhatsApp) | The United States, Ireland and Singapore |
We transfer data outside Malaysia only where:
- you have consented to it, or
- it’s necessary to perform our contract with you, or
- we’ve taken reasonable steps to make sure the provider protects it to a standard like the PDPA’s, including through the data protection terms in our agreements with them
8. Cookies, browser storage and email tracking
We don’t use cookies to track you. Our page statistics come from Cloudflare Web Analytics, which doesn’t use cookies or follow you across other sites. That’s why there’s no cookie banner. Cloudflare may set cookies that are strictly needed to protect the site from attacks.
We use your browser’s own storage, not cookies, for two things:
- saving your diagnostic answers, so a page reload doesn’t lose them
- a session ID for the current tab and the campaign tags in the link you followed, so we can count how many people move through each step
You can clear this storage at any time in your browser settings.
Private pages, such as your report and member page, don’t load page statistics or any third-party scripts.
Newsletter emails. Brevo may record whether you open a newsletter email and which links you click. We use this only to see what’s useful. You can stop it by unsubscribing, or by blocking images in your email app.
9. How long we keep it
- Orders, payments, invoices, consent records and our audit log: 7 years, for tax and audit.
- Member records (your profile and session logs): while you’re a member and for 6 years after your membership ends, because that is how long a claim can be brought.
- Coaching session notes and your diagnostic data once linked to your email: up to 2 years after your membership ends, or we make them anonymous sooner.
- Email addresses that are never confirmed, and unfinished checkouts: deleted after 30 days.
- Alumni certificates: deleted 90 days after our decision. We keep the decision itself. A claim we haven’t decided within 30 days is closed and its certificate deleted.
- Founders’ Wall entries: removed as soon as you turn it off or your membership ends.
- Emails we queued to an address that was never confirmed: deleted with it.
- Anonymous diagnostic answers: kept for statistics.
- IP addresses: we never store them as they are. Where abuse checks need one, we keep only a salted hash.
For anything not listed, we keep it while you’re a member or subscriber, or while we need it for the purpose we collected it for. Then we delete it or make it anonymous.
10. Your rights and choices
Under the PDPA you can:
- ask for a copy of the personal data we hold about you
- ask us to correct it if it’s wrong, incomplete or out of date
- withdraw your consent at any time
- ask us to stop processing that is likely to cause you damage or distress
- stop direct marketing: use the unsubscribe link in any email, or email us
- ask for data portability: get the personal data you gave us in a structured, commonly used, machine-readable format, or ask us to send it to another controller, where this is technically possible
Some choices you can make yourself on your member page, such as turning off the Founders’ Wall.
To make a request, email hey@hexa.partners from the address we have for you. We may ask you to confirm who you are before we act. We reply within 21 days. We don’t charge a fee for requests by email.
Our audit log can’t be edited, so we can show what happened and when. It refers to your member ID rather than your name or email. Correcting or deleting your data doesn’t change those log entries.
If you withdraw a consent we need to run your membership, such as your agreement to our terms, we may not be able to keep providing it. Service emails about your membership and payments aren’t marketing, so we send them while you’re a member.
11. How we protect it
- Private links keep their secret part after the “#” sign, which browsers don’t send to servers. We store only a scrambled (hashed) copy of each link’s secret.
- Private pages tell search engines not to list them, and don’t pass the page address to other sites.
- Our back office is open only to our own staff, behind a separate sign-in.
- Alumni certificates are stored privately.
- Every public form is protected by Cloudflare Turnstile and limits on how often it can be used.
- We have data protection terms with the providers who process data for us.
If there’s a data breach. If a breach of personal data is likely to cause you significant harm, we’ll tell the Personal Data Protection Commissioner and the people affected, as the law requires.
12. Age
Our service is for people aged 18 and over. We don’t knowingly collect personal data about anyone under 18. If we find that we have, we’ll delete it straight away. If you think a child has given us their data, email hey@hexa.partners.
13. Changes to this notice
We may update this notice. The version and the date it takes effect are shown on this page. When you give consent, we record which version you saw. If a change affects how we use your personal data, we’ll tell you and, where the law requires, ask for your consent again.
14. Language
This notice is available in English and Bahasa Malaysia, as the PDPA requires. If the two versions don’t agree, the English version applies, as far as the law allows.
15. Questions and complaints
Email hey@hexa.partners with any question or complaint about your personal data. You can also complain to:
Jabatan Perlindungan Data Peribadi (JPDP), the Personal Data Protection Department Aras 6, Kompleks KKD, Lot 4G9, Persiaran Perdana, Presint 4, 62100 Putrajaya, Malaysia Website: www.pdp.gov.my · Email: aduan@pdp.gov.my