Privacy Policy

This Privacy Policy explains how the Buddha Dhamma Fellowship Association Kuching (“BDFA”, “we”, “us”) collects, uses, discloses and protects your personal data, in line with the Personal Data Protection Act 2010 of Malaysia (“PDPA”). It applies to this website, bdfa.org.my, and to the personal data you give us when you register for an event, contact us, or take part in our activities.

BDFA is a society registered with the Registrar of Societies, Malaysia (Reg. No. PPM-019-13-11071995), located at Buddha Dhamma Centre, No. 301, Lorong Keranji 4F4, Tabuan Desa, 93350 Kuching, Sarawak.

What personal data we collect

“Personal data” means information that identifies you or relates to you, as defined in the PDPA. Depending on how you interact with us, we may collect:

• Contact and identity details — your name, mobile number, email address, age and gender.
• Event registration details — your emergency contact’s name, relationship and mobile number; your meditation experience; your availability; and your reasons for joining.
• Sensitive personal data — medical conditions, injuries, mental-health considerations and dietary requirements or allergies that you choose to tell us about when registering for a retreat or event. This is sensitive personal data under the PDPA, and we ask for it only so that we can look after you safely.
• Payment confirmation — if you pay an event fee by bank transfer after your place is confirmed, the transfer confirmation you send us, which may show your name, bank, account number and the amount paid.
• Messages — anything you write to us through the contact form, by email or on WhatsApp.
• Technical data — when you visit the website, your IP address, browser and device type, the pages you view and how you reached them, collected through cookies and analytics (see Cookies and analytics below).

We do not collect payment card details, and no payment is taken when you register. Event fees are paid by bank transfer or in person once a place is confirmed; we use any transfer confirmation only to match your payment to your registration and to process any refund.

How we collect it

• Directly from you, when you fill in a registration or contact form on this website, write to us, or speak to a committee member.
• Automatically, through cookies and analytics tools when you browse the website.
• Occasionally from third parties, such as a family member registering on your behalf or a teacher’s organisation co-hosting an event.

Giving us your personal data is voluntary. If you choose not to provide certain information, we may not be able to accept your registration or respond to your request.

How we use it

We use personal data for the following purposes:

• to process and respond to your event registration, including selecting participants where places are limited;
• to contact you about the event you registered for — confirmations, schedules, changes and reminders;
• to keep you safe during an event and to cater for dietary needs, using the health and dietary information you provide;
• to contact your emergency contact if you are unwell or in an emergency during an event;
• to respond to enquiries and messages;
• to keep records of our activities, as a registered society is required to do;
• to understand how the website is used and to improve it;
• to let you know about future BDFA activities, if you have asked us to; and
• to comply with the law and with requests from authorities.

By giving us sensitive personal data (health or dietary information), you consent to us using it for the safety and catering purposes described above. We will not use it for any other purpose.

Who we share it with

We do not sell personal data. We may share it with:

• Committee members and volunteers who organise the event or handle enquiries, on a need-to-know basis.
• Teachers or facilitators leading an event, where information about your experience or health is relevant to guiding you safely.
• Service providers that process data on our behalf so that this website and our forms work — currently Tally.so (online forms), Google (Analytics, Maps and email), Cloudflare (website hosting) and Meta (WhatsApp). Each acts under its own privacy policy and security commitments.
• Authorities, where the law requires it or to protect the rights, property or safety of BDFA, our members or others.

Data transferred outside Malaysia

Our service providers store data on servers that may be located outside Malaysia. Where personal data is transferred outside Malaysia, we take reasonable steps to ensure it is protected to a standard comparable with the PDPA, including by choosing providers with recognised security and privacy practices.

Cookies and analytics

This website uses Google Analytics to help us understand how visitors use it — which pages are read, how long they stay, and roughly where visitors come from. Google Analytics sets cookies (such as _ga and _ga_*) that assign an anonymous identifier to your browser; it does not tell us who you are. IP addresses are truncated before being stored.

You can opt out of Google Analytics by installing Google’s browser opt-out add-on, or block cookies in your browser settings. The website will still work.

Some pages embed third-party content — registration forms from Tally.so, maps from Google Maps and recordings from YouTube. These providers may set their own cookies when the embedded content loads, under their own policies. YouTube recordings are embedded in privacy-enhanced mode and do not set cookies until you press play.

How long we keep it

• Event registrations, including health and dietary information and any payment confirmations, are kept until the event has finished and any refunds or follow-up are complete, and are deleted within 12 months after the event unless you ask us to keep you informed of future activities. Basic payment records may be kept longer as part of the society’s accounts.
• Contact form messages and emails are kept for as long as needed to deal with your enquiry, and then for our records for no longer than 2 years.
• Analytics data is retained by Google Analytics for 14 months in aggregated form.
• We may keep some records for longer where the law or our constitution requires it.

Security

We keep personal data on services protected by access controls and encryption, limit access to committee members who need it, and do not circulate registration lists beyond the organising team. No transmission over the internet is completely secure, so we cannot guarantee absolute security, but we take reasonable steps to protect the data we hold.

Your rights

Under the PDPA you may:

• Access the personal data we hold about you;
• Correct it if it is inaccurate, incomplete or out of date;
• Withdraw your consent to our use of your data, or limit how we use it — for example, ask us not to contact you about future activities;
• Ask us to delete data we no longer need.

To exercise any of these rights, write to us at contact@bdfa.org.my or by post to the address above. We may need to confirm your identity before acting on a request. We will respond within 21 days, as the PDPA requires, and will tell you if there is a reason we cannot comply.

Children

Our events and this website are intended for adults. If you are under 18, please ask a parent or guardian to register on your behalf or to give their consent before you send us personal data.

Language

This policy is issued in English. If it is translated and there is any difference between versions, the English version prevails.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed. Continued use of the website or our services after a change means you accept the updated policy.

Contact

Buddha Dhamma Fellowship Association Kuching Buddha Dhamma Centre, No. 301, Lorong Keranji 4F4, Tabuan Desa, 93350 Kuching, Sarawak, Malaysia Email: contact@bdfa.org.my