Privacy Policy

Crestix Studio is a creative and marketing agency based in Malaysia. We operate the website at crestix.studio. For the data described here, we decide what is collected and why, which makes us the data controller.

Registered name:

Crestix Studio

SSM registration no:

202603122661 (AS0514675-A)

You can reach us at hello@crestix.studio or on +60 17-438 8038.

This notice covers personal data we handle for our own purposes: visitors to this website, people who enquire about our services, and our clients and suppliers.

It does not cover personal data we handle on a client’s behalf during a paid engagement. When we run ads or build a site for a client, that client decides what happens to the data and their own privacy notice applies. If we contacted you on a client’s behalf and want to know who holds your data, email us and we will tell you.

We only receive personal data when you choose to send it. That happens when you email us, call or message us on +60 17-438 8038, or message us on WhatsApp. In practice we usually end up holding your name, email address, phone number, company name, and whatever you tell us about the project.

Our servers also keep short technical logs (IP address, pages requested, date and time, browser type, referring site) to keep the site running and protect against abuse. We do not use those logs to build a profile of you.

If you send us a file containing other people’s personal data, we use it only for the work you asked for, never add those people to our own marketing, and delete it on the schedule in section 9.

We do not collect your name from browsing alone, your precise location, biometric data, payment card details, or any sensitive category of personal data through this website.

We use your data to reply to your enquiry, to carry out work you have engaged us for, to send invoices and keep accounting records, and to keep the website secure.

Under the PDPA we rely on your consent when you contact us or agree to receive marketing, and on the performance of a contract with you for client work. Where we contact a business first, we take publicly listed business contact details from a company website or public directory. Tell us to stop and we will remove you.

This is the authoritative list. Sections 6 and 7 both refer back to it. When we switch something on, we change this table and the date at the top of this page in the same release.

Active as at 24 August 2026: the Meta Pixel.

If we switch on any further tool, we will name it in this table before it goes live.

The Meta Pixel is running, so Meta sets advertising cookies in your browser. Section 5 is the authoritative list of what is on. Our hosting and CDN providers may also set strictly necessary cookies to deliver and secure the site. If we later switch on any further tool, it will set its own cookies and we will say so here first. You can clear or block cookies in your browser settings at any time.

As at 24 August 2026, the Meta Pixel runs on every page of crestix.studio. Section 5 is the authoritative list.

We advertise on Facebook and Instagram, and the pixel measures whether those ads work. It loads when you open a page and sends Meta a PageView event together with your IP address, browser and device details, and the page you are on. We may also add Meta’s Conversions API, which sends similar information to Meta from our server rather than from your browser; that is not switched on yet and section 5 will say so when it is.

This means:

• We use pixels, cookies and similar technologies supplied by third parties, including Meta Platforms, Inc., to collect information from this website.
• Those third parties, including Meta, use that information to provide measurement services to us and to target and deliver ads to you on their platforms and elsewhere.
• If we ever upload a customer list to create a Meta Custom Audience, we will only include people who have given us their details directly and have not asked us to stop, the list is hashed before it reaches Meta, and you can ask us to exclude you at any time by emailing us.

Meta’s own privacy policy is at facebook.com/privacy/policy.

WhatsApp is one of our main contact channels, and it involves a third party, so it gets its own section.

Every WhatsApp button on this site is a link to wa.me, which Meta operates. Clicking it contacts Meta’s servers and opens WhatsApp with a message pre-filled, so Meta receives your IP address and device information even if you never send the message. We have set those links so Meta is not told which page of our site you clicked from. Nothing reaches us until you press send yourself. If you would rather not contact Meta’s servers at all, email or call us instead.

If you do message us, we receive your WhatsApp number, your profile name and picture if you have set one, and what you send. Messages are end-to-end encrypted so Meta cannot read their content, but Meta does process information about the exchange under its own privacy policy, which we do not control.

We share personal data only with the providers that run our business:

• Vercel, which hosts this website (United States)
• Cloudflare, which provides DNS and CDN (United States)
• Sanity, which stores website content (European Union)
• Meta, if you contact us via WhatsApp, and for advertising once section 7 applies
• Our email provider, for correspondence

We never sell your personal data. Because these providers are outside Malaysia, your data is transferred abroad. We rely on the contractual protections in each provider’s data processing terms, and we take reasonable steps to ensure the data is treated to a standard comparable with the PDPA.

We may also disclose data where the law requires it, or to establish or defend a legal claim.

Enquiries that do not become projects are kept for up to 24 months, so we can pick up a conversation if you come back. Client project records and the accounting records that go with them are kept for 7 years, as Malaysian tax and companies legislation requires. Server logs are kept for a short period by our hosting providers. You can ask us to delete your data sooner, and we will unless the law requires us to keep it.

Access to enquiry and client data is limited to the people at Crestix Studio who need it. Our providers hold the data on encrypted infrastructure, and the site is served over HTTPS. No system is perfectly secure, but if a breach affects your personal data we will notify you and the Commissioner where the PDPA requires it.

Under the PDPA you can ask us to:

• give you a copy of the personal data we hold about you
• correct it if it is wrong or out of date
• stop using it for direct marketing, which we will action at no cost
• limit how we process it
• delete it, where we are not required to keep it

Email hello@crestix.studio and we will respond within 21 days. If you are not satisfied, you may complain to the Personal Data Protection Commissioner of Malaysia.

Separately from anything we do, you can control how Meta targets you in Facebook Ad Preferences, and how Google targets you in My Ad Center. Most browsers also let you block third-party cookies.

To be removed from our own marketing, email us and we will action it.

Our services are aimed at businesses. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us data, email us and we will delete it.

If we change this notice we will update the date at the top. Where a change materially affects how we use your data, we will make that clear rather than change it quietly.

This notice is published in English. A Bahasa Malaysia version is available on request by emailing us.