Definitions
This section explains key terms used in the policy to help readers understand the scope of processing activities and roles such as controller, processor and data subject.
- Personal data refers to any information that identifies or can be used to identify an individual, such as name, contact details, identification numbers, service records or communications provided to Aquarelli during service requests or via the website.
- Processing means any operation performed on personal data, whether automated or manual, including collection, storage, use, disclosure, transmission, erasure and archiving carried out to deliver services and manage customer relationships.
- User means any individual who visits the Aquarelli website, requests a quote, books an in-person assessment, or otherwise provides personal data to Aquarelli in connection with lighting installation services.
- Service refers to Aquarelli's lighting installation offerings, including site surveys, design consultation, fixture supply, electrical installation, testing and post-installation support provided in Malaysia.
- Cookies are small data files placed on a user device by the website to store preferences, support functionality and enable analytics. Aquarelli uses cookies to improve site performance and to understand usage patterns.
Data Collection and Sources
Aquarelli collects data directly from users, from automated sources while they interact with the website, and from third parties where necessary to provide services. The type and amount of data collected depend on the activity (e.g., booking a site survey versus browsing informational pages).
Data Provided by Users
When you contact Aquarelli or request services, we collect the following categories of personal data as relevant to the request and the contractual relationship.
- Identity and contact information: name, delivery and installation address, email address and phone number provided for communication and scheduling.
- Service details: information about the lighting installation requirements, property type, layout details and any notes provided during a site survey or consultation.
- Transactional information: quotes, invoices, payment references and records of payments or refunds related to Aquarelli services.
- Communications: messages platform by email, phone or contact forms used to coordinate scheduling, provide technical information or address queries.
- Identifying documentation when necessary for billing or regulatory compliance, such as business registration details for corporate clients.
- Feedback and service ratings provided voluntarily after installation or maintenance activities.
Automatically Collected Data
When users visit chromas.digital or interact with Aquarelli digital services, certain data is automatically collected to enable site functionality and security, and to analyse performance.
- Device and browser information, including user agent, screen resolution and operating system.
- IP address and approximate location data to support security and load balancing.
- Usage data such as pages visited, navigation paths, time on page and referral sources for analytics.
- Cookie identifiers and similar tracking vouchers used to maintain session state and preferences.
- Error logs and diagnostic data collected to identify and fix technical issues affecting the website.
- Interaction timestamps and metadata related to form submissions and downloads.
Data from Third Parties
Aquarelli may receive data from trusted third parties to the extent necessary for service delivery, verification, and legitimate business operations.
- Payment processors and business institutions for transaction processing and reconciliation.
- Suppliers and logistics partners when coordination of deliveries or returns is required for an installation.
- Publicly available sources or business directories used to validate corporate client information.
Purposes of Processing
Data collected by Aquarelli is used only for specific, explicit and legitimate purposes necessary to deliver services, maintain operations and comply with legal obligations.
- To provide and manage lighting installation services, including scheduling, site assessment and project follow-up.
- To process payments, issue invoices and manage accounting records.
- To communicate with users about service updates, technical instructions and appointment details.
- To maintain and improve the website, including security monitoring and performance analytics.
- To handle customer feedback, complaints and post-installation support requests.
- To perform required checks for regulatory compliance and legitimate business verification.
- To protect the rights, property and safety of Aquarelli, its users and third parties, including fraud detection.
- To retain records as required by accounting and tax regulations in Malaysia and for internal record-keeping.
Legal Bases for Processing
Aquarelli relies on appropriate legal bases for processing personal data depending on the activity and applicable law.
- Performance of a contract: processing necessary to perform services requested by the user, such as installation and maintenance.
- Legal obligation: processing required to comply with statutory obligations, accounting rules or law enforcement requests.
- Legitimate interests: processing for business operations, fraud prevention and site security where interests are not overridden by user rights.
- Consent: where required (for example, certain marketing communications or optional cookies), processing is based on user consent which can be withdrawn.
Rights Under EU Data Protection Standards
Although Aquarelli primarily operates in Malaysia, when EU data protection standards are relevant we recognise user rights and provide mechanisms to exercise them in line with applicable regulations.
- Right of access: users can request a copy of personal data we hold about them.
- Right to rectification: users may request correction of inaccurate or incomplete data.
- Right to erasure: in certain circumstances users may request deletion of personal data where retention is no longer necessary.
- Right to restrict processing: users can request restriction of processing instead of deletion in specific situations.
- Right to data portability: where processing is based on consent or contract and is automated, users may request data in a portable format.
- Right to object: users may object to processing based on legitimate interests, subject to review of the specific context.
Cookies and Tracking Technologies
Aquarelli uses cookies to enable core site functionality and to collect analytics data that supports site improvement. Users may choose cookie preferences where offered.
Types of cookies used include essential cookies for session management, preference cookies to store language or display settings, analytics cookies to measure site use, and third-party cookies that support embedded content or services.
Cookies fall into categories: essential, performance/analytics, functionality and targeting. Essential cookies are required for basic site operation; others are optional and can be managed by the user.
Users can manage cookie preferences via the website cookie banner or through browser settings to block or delete cookies. Disabling certain cookies may affect site functionality.
For more detail, see the Cookie Policy available on chromas.digital/cookie-policy.
Data Sharing and Disclosure
Aquarelli does not sell personal data. Data may be shared with third parties only as necessary for service delivery and legal compliance, under appropriate confidentiality terms.
- Service providers and subcontractors engaged for installations, such as electrical contractors and logistics partners.
- Payment processors and banks to complete transactions and refunds.
- Regulatory bodies or law enforcement when required by law.
- Professional advisors such as auditors or legal advisers under confidentiality obligations.
- Analytics and hosting providers who process data on behalf of Aquarelli under data processing agreements.
- Third parties when explicit consent to share is provided by the user for specific purposes.
International Transfers
When data is transferred outside Malaysia, Aquarelli ensures that appropriate safeguards are in place such as contractual protections or transfers to jurisdictions with adequate data protection standards. Transfers occur only when necessary for service provision or legal compliance.
Safeguards include standard contractual clauses, data processing agreements and technical measures such as encryption. Recipients are vetted for security and compliance with Aquarelli's data protection requirements.
Data Retention
Aquarelli retains personal data only as long as necessary for the purposes described, to meet contractual and legal obligations and to resolve disputes or enforce agreements.
Account and client records are retained for a period consistent with regulatory requirements for business records in Malaysia, typically no less than the statutory tax and accounting retention period.
Communications and service correspondence are retained for the duration necessary to provide support and maintain a record of transactions, subject to periodic review.
Technical logs and analytics data are retained for a limited timeframe used for security monitoring and service improvement, then anonymised or deleted.
When retention periods expire or data is no longer required, Aquarelli removes or anonymises personal data in a secure manner unless further retention is required by law.
Security Measures
Aquarelli employs industry standard organisational, technical and physical measures to protect personal data against unauthorised access, loss or disclosure. Security controls are reviewed periodically and updated according to risk assessments and technological developments.
- Access controls and role-based permissions limiting data access to authorised personnel.
- Encryption of sensitive data in transit and where appropriate at rest, alongside secure backup procedures.
- Regular security assessments, software updates and monitoring to detect and respond to incidents promptly.
User Rights
Users may exercise their data protection rights by contacting Aquarelli using the details provided. Requests will be handled in accordance with applicable law and after appropriate identity verification.
- Access your personal data and receive a copy of information held about you.
- Request correction of inaccurate or incomplete data.
- Request deletion of personal data where retention is no longer lawful or necessary.
- Request restriction of processing in certain situations.
- Object to processing based on legitimate interests, subject to review.
- Request data portability where applicable for automated processing based on consent or contract.
- Withdraw consent at any time for processing activities based on consent, without affecting processing carried out prior to withdrawal.
- Lodge a complaint with a supervisory authority if you consider your rights have been infringed; Aquarelli will provide assistance where appropriate.
Data Subject Rights
You may submit requests to access, correct, or delete personal data collected by Aquarelli. Requests should specify the type of data and the action requested. We will verify the identity of the requester before processing to protect personal data from unauthorized disclosure.
[email protected]
Aquarelli aims to respond to verifiable requests within 30 calendar days of receipt. Complex requests may require additional time; you will be informed if an extension is necessary.
Marketing Communications
We may send marketing or promotional materials about lighting services and updates from Aquarelli if you opt in. Communications will include clear instructions for changing your preferences at any time.
To stop marketing emails, use the unsubscribe link in the message or contact our privacy team. Processing of unsubscribe requests may take up to 7 business days.
Children's Privacy
Aquarelli does not knowingly collect personal information from children under 16 without parental consent. If we become aware that we have collected such data without authorization, we will take reasonable steps to delete it.
Third-Party Links
Our site may include links to third-party websites. Aquarelli is not responsible for the privacy practices or content of those sites. Review the privacy policies of any third-party site you visit.
Changes to This Policy
We may update privacy practices to reflect changes in law, technology, or business operations. Material changes will be published on the Aquarelli website with an updated effective date.
