Privacy notice.

This notice is published by 666 Website Services ("666", "we", "us"), an independent web design & development studio operating from Setapak, Kuala Lumpur, Malaysia. We are the data controller for any information you submit through this site.

Contact for privacy matters:

• Email: 666websitepro@gmail.com
• WhatsApp: +6016-468 8686

When you order online, send us an enquiry or pay a deposit, we collect only what you give us:

• Identity & contact — your name, company or business name, email and phone / WhatsApp number.
• Project information — the package you choose, what your business does, what the website should do, language requirements, your domain, websites you like, and any files or file links you send us (logo, photos, text, documents).
• Technical data — when you submit the form, our form-relay provider receives basic technical metadata (IP address, browser user-agent, submission timestamp) for anti-spam purposes.

We use Google Analytics 4 to measure site traffic. We do not use advertising trackers or fingerprinting. Apart from the Google Analytics cookies, the only cookies in use are essential ones needed for the language toggle and form session to work.

• To reply to your enquiry — usually within 1 working day, Mon–Fri MYT.
• To prepare your order, proposal or quotation.
• To follow up with you about the project (your order, the review round, deposit and balance payments).
• To keep tax & accounting records if you go on to become a client — required under Malaysian tax law.
• To prevent spam and abuse of our forms (a hidden anti-spam field).

Your legal basis for our processing under the PDPA is your consent (you chose to submit the form) and, where you become a paying client, our contractual necessity.

We do not sell, rent, or trade your personal data. We share it only with the small set of service providers needed to actually deliver our service to you:

• Web3Forms (web3forms.com) — relays the form submission to our inbox. Processes IP + form fields. United States.
• Google (Gmail) — our business email provider for receiving and replying to your enquiry.
• WhatsApp (Meta) — only if you choose to contact us via WhatsApp.
• Stripe (stripe.com) — processes card and FPX payments for deposits and balances. We never see your full card number.
• Tally (tally.so) — hosts our file upload and review forms, including the files you upload.
• Our accountant — for project & tax records, once you become an invoiced client.
• Malaysian authorities — only if compelled by a lawful court order, LHDN audit, or PDPA Commissioner request.

Where transfers leave Malaysia (e.g. to US-based email providers), we rely on the providers' own published safeguards and your consent to use those tools. We will not transfer your data to any other party for marketing.

• Enquiries that don't become projects — kept for up to 24 months, then deleted, so we can reconnect if you come back.
• Active client projects — kept for the duration of the engagement.
• Closed client projects — financial records kept for 7 years as required by the Malaysian Income Tax Act 1967 and Companies Act 2016; project files (designs, source code) kept for 36 months after handover, then deleted.
• You may request earlier deletion at any time — see your rights below.

Under the Personal Data Protection Act 2010, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Correct — ask us to fix anything that is inaccurate or out of date.
• Withdraw consent — tell us to stop processing your data and delete what we hold (subject to our tax-record retention obligations above).
• Limit processing — ask us to restrict how we use your data while a dispute is sorted out.
• Complain — lodge a complaint with the Personal Data Protection Commissioner Malaysia (Jabatan Perlindungan Data Peribadi) if you believe we've mishandled your data.

To exercise any of these rights, email 666websitepro@gmail.com with the subject "PDPA request". We will respond within 21 days, free of charge.

All form submissions travel over HTTPS / TLS. Files and briefs are stored in access-controlled cloud inboxes, viewable only by the 666 working team. Devices are password-protected and full-disk encrypted. We sign an NDA on request, free of charge, before you share commercially sensitive material.

No system is perfectly secure. If a data breach occurs that is likely to affect you, we will notify you and the Commissioner without undue delay.

This site and our services are intended for businesses and adults. We do not knowingly collect data from anyone under 18. If you believe a minor has submitted personal data to us, please email us and we will delete it.

We use essential cookies / local storage for things like remembering your chosen language (EN / 中文), and Google Analytics 4 cookies to measure site traffic. We do not run advertising cookies or cross-site trackers. You can clear them at any time from your browser settings without breaking the site.

We may update this notice from time to time — for example, when we change a service provider or when Malaysian privacy law is amended. The "Last updated" date below always reflects the current version. Material changes will be highlighted on this page for at least 30 days.