Privacy Policy

1. Introduction

Escapement Lab ("we", "us", "our") operates from 14A Lebuh Pantai, 10300 George Town, Penang, Malaysia, providing watch repair and servicing. This policy explains what personal data we collect, why we collect it, how we use it, and what your rights are under Malaysia's Personal Data Protection Act 2010 (PDPA).

By using this website or submitting an enquiry form, you acknowledge that you have read this policy. If you have questions, contact us at [email protected].

2. What Data We Collect

We collect only what is necessary to respond to your enquiry and carry out service work:

• Contact details: name, email address, phone number (if provided).
• Enquiry content: the description you send of your watch and the concern you've noticed.
• Service records: intake condition notes, work carried out, parts used, and handover documentation.
• Website usage data: page views and session data collected via analytics cookies, if you have consented to them.

3. How We Collect Data

• The enquiry form on this website (name, email, phone, message).
• In-person at the workshop during intake.
• Automatically via analytics cookies (only if consent is given via the cookie banner).

Legal basis for processing: Consent (enquiry form submission and cookie acceptance); legitimate interest (maintaining workshop service records); contractual necessity (carrying out the agreed service).

4. How We Use Your Data

• To respond to your service enquiry and confirm the programme, price, and timeline.
• To carry out the agreed repair or servicing work and document its progress.
• To contact you if something unexpected is found during the job that requires your decision.
• To send a collection notification when the piece is ready.
• To maintain a service history record for warranty and future-service reference.
• To improve this website using aggregated analytics data (if consented).

We do not use your data for marketing communications unless you explicitly request to be contacted about future service reminders. We do not sell your data to any third party.

5. Data Sharing

Your data is not sold or traded. We share data only in limited circumstances:

• Parts suppliers: where a complication restoration requires ordering specific components, the make and model of the watch may be shared with a parts supplier to confirm availability. No personal identifying information is shared in this context.
• Analytics services: aggregated, anonymised usage data may be processed by Google Analytics if you have consented to analytics cookies. Google's own privacy policy governs that processing.
• Legal obligations: where we are required by Malaysian law to disclose data to regulatory or enforcement authorities.

6. Data Retention

• Enquiry data where no service follows: deleted within 6 months of the last communication.
• Service records (intake notes, work carried out, handover documentation): retained for 3 years from the date of collection, to support any warranty discussion or follow-up service.
• Analytics data: retained for 14 months (Google Analytics default), then automatically deleted.

7. Data Protection Measures

• Website traffic is served over HTTPS (TLS encryption in transit).
• Workshop service records are stored in password-protected systems with access limited to workshop staff.
• Paper intake forms are stored in a locked cabinet on the premises and are not photographed or emailed externally.
• In the event of a data breach that affects your rights or freedoms, we will notify you and the relevant authority within 72 hours of becoming aware of it, where technically feasible.

8. Cookies

We use essential cookies for basic site function and, with your consent, analytics cookies to understand how pages are used. No marketing or advertising cookies are placed. Full details are in our Cookie Policy.

9. Your Rights Under Malaysia's PDPA 2010

Under the Personal Data Protection Act 2010 and as applicable, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Withdraw consent for processing where consent is the legal basis (this does not affect processing already completed).
• Request deletion of your data, subject to our legal obligations and legitimate interest in retaining service records.
• Object to processing of your data for certain purposes.
• Lodge a complaint with the Personal Data Protection Commissioner of Malaysia if you believe your rights have been breached.

To exercise any of these rights, email [email protected] from the address you used when contacting us. We will respond within 21 days.

10. Third-Party Links

This website may contain links to external resources. We are not responsible for the privacy practices of any third-party website and encourage you to read their policies independently.

11. Children

This website is not directed at persons under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has submitted data through our site, please contact us and we will delete it promptly.

12. Policy Updates

We may update this policy from time to time. The "Last Updated" date at the top of this page will reflect any changes. We will note material changes prominently on the homepage for 30 days after the revision.

13. Contact

Data Controller: Escapement Lab
14A Lebuh Pantai, 10300 George Town, Penang, Malaysia
Email: [email protected]
Phone: +60 4 261 8734