Privacy Notice

You are trusting us with something personal — the moment you're marking, and sometimes the name of the person you're marking it for. We treat that information the way we treat a stone left in our care: privately, deliberately, and only for the purpose you gave it to us.

This notice explains what we collect, why, and what you can ask us to do about it. It is issued in accordance with Malaysia's Personal Data Protection Act 2010 ("PDPA").

1. Who we are

VANA Fine Jewellery is operated by Lineage by Vana Fine Sdn Bhd (Company No. 1451032-D), a private fine jeweller based at Liberty ARC @ Ampang UKAY, Kuala Lumpur, Malaysia. In this notice, "we", "us" and "our" refer to that company. We are the data user responsible for your personal data.

2. What we collect

Information you give us directly

• Through our consultation form: your full name, phone or WhatsApp number, email address, the type of jewellery you're interested in, and — if you choose to tell us — the occasion you're marking.
• Through our guide request form: your email address.
• Through WhatsApp, email, telephone or in person: anything you choose to share while we talk, including budget range, preferences, sizing, and details of any existing or inherited piece you'd like us to work with.

Information collected automatically

• Standard technical data your browser sends to our web server, such as IP address, browser type, and the pages you visited. This is recorded in ordinary server logs.

Our gemstone quiz

The quiz on our website runs entirely in your own browser. Your answers are not transmitted to us or stored on our servers. If you choose to press the WhatsApp button at the end, a message containing your result is drafted for you — but nothing is sent to us until you press send yourself.

3. Why we collect it

• To respond to your enquiry and arrange a private consultation
• To advise you on stones, designs and pricing, and to prepare quotations
• To design, produce, size, deliver and service your jewellery
• To send you the complimentary guide you requested
• To keep a record of pieces we have made for you, so we can offer care, servicing and advisory over the years — and so that we recognise you when you return
• To send occasional updates about new pieces or events, only if you have agreed to receive them
• To keep proper business records and to comply with Malaysian law

We do not sell your personal data. We do not rent, trade or share it with advertisers.

4. Is providing your data obligatory?

Providing your name and a means of contacting you is necessary — without it we cannot arrange an appointment or reply to you. Everything else, including the occasion and your budget, is entirely voluntary. You are welcome to withhold it, and we will still help you.

5. Who we may share it with

Your data stays with Wayne and Emily wherever possible. Where it must go further, it goes only to:

• Craftsmen, setters and workshops engaged to produce or service your piece — and only the details they need to do the work
• Gemmological laboratories where a stone requires independent certification
• Couriers and delivery services, where a piece is being sent to you
• Our service providers, including our web host and email provider
• Professional advisers, regulators or authorities, where we are required to disclose by law

A note about WhatsApp

WhatsApp is our main way of speaking with clients. Please be aware that WhatsApp is operated by Meta Platforms, and your use of it is governed by Meta's own privacy terms, not ours. Messages you send us travel through Meta's systems. If you would prefer not to use WhatsApp, you are very welcome to contact us by email or telephone instead.

Transfers outside Malaysia

Some of our service providers — including our email and messaging providers — store data on servers outside Malaysia. Where that happens, we take reasonable steps to ensure your data receives a comparable level of protection.

6. Cookies and analytics

Our website does not use advertising or tracking cookies. We load fonts and styling libraries from third-party networks (Google Fonts and a stylesheet CDN), which may receive your IP address as a normal part of delivering those files. If we introduce website analytics in future, we will update this notice before doing so.

7. How long we keep it

• Enquiries that don't proceed: up to two years, in case you return to the conversation
• Client and commission records: kept for as long as we may reasonably need to service or advise on the piece, and to satisfy Malaysian record-keeping and tax obligations
• Marketing consent records: until you withdraw consent, plus a short period to evidence that withdrawal

When data is no longer needed for these purposes, we delete it or render it anonymous.

8. How we protect it

Our website is served over an encrypted HTTPS connection. Access to client records is limited to Wayne, Emily, and any staff who genuinely need it to do their work. We ask our service providers to maintain appropriate safeguards. No system is ever perfectly secure, but we take the protection of your data seriously and review our practices as the business grows.

9. Your rights

Under the PDPA, you have the right to:

• Access the personal data we hold about you
• Correct it where it is inaccurate, incomplete or out of date
• Withdraw your consent to our processing it, including for marketing
• Limit how we process it, including asking us to stop contacting you
• Ask us to delete data we no longer have a lawful reason to keep

To exercise any of these, contact us using the details below. We will respond within 21 days. We may need to verify your identity first, so that we are not disclosing your information to someone else. A small fee may apply to a formal data access request, as permitted under the PDPA.

Withdrawing consent will not affect anything we have already lawfully done, and where you are an existing client we may still need to retain certain records to meet our legal obligations.

10. Children

Our services are directed at adults. We do not knowingly collect personal data from anyone under 18 without the consent of a parent or guardian. If you believe a child has given us their data, please contact us and we will remove it.

11. Changes to this notice

We may update this notice from time to time. The date at the top always reflects the current version. Where a change materially affects how we use your data, we will take reasonable steps to tell you.

12. How to contact us

If you are not satisfied with how we have handled your personal data, you may lodge a complaint with the Personal Data Protection Commissioner, Department of Personal Data Protection Malaysia (Jabatan Perlindungan Data Peribadi).