Privacy Notice

Fireas Windows & Doors ("we", "us") is the data controller for the personal data described in this notice. You can reach us at [email protected].

Our legal entity is Foshan Fireas Windows & Doors Technology Co., Ltd., with its registered address at No. 8, Dongfeng Road, Songgang, Nanhai District, Foshan City, Guangdong Province, China. This is the entity that decides how and why your personal data is used, and the entity to contact about it.

We are a business-to-business supplier of doors and windows. Our website is aimed at business customers and not at children.

(a) Information you give us. When you submit the enquiry form we collect your name, email address, and — if you choose to provide them — telephone number, country, the message you write, and the product you are asking about.

(b) Technical information. Like every website, our servers receive your IP address, the pages you request, and basic browser information (user agent). We use this to keep the site working and to protect it against abuse. Our application does not store your IP address in readable form: it is converted into a salted hash (see "Security" below). We also use the language your browser asks for, and the country reported by our CDN as a request header (we do not look at your IP address ourselves), to decide which language version of the site to open by default. Neither is stored for that purpose, and you can always switch language yourself.

(c) Statistics. If — and only if — you accept the "Statistics" category in the cookie banner, we set one first-party cookie (`uv_id`) to recognise returning visits and count unique visitors, and we also load Google Analytics 4 to see which pages are read and roughly where visitors come from. Refusing costs you nothing: the site works the same. Google Analytics is a service of Google; it sets the `_ga` and `_gid` cookies and receives your IP address and browser information, which means data is transferred outside Malaysia (see "International transfers"). It is loaded only after you accept, it is configured with IP anonymisation, and if you withdraw your consent we stop sending to it immediately and clear the cookie we control.

(d) Administrator accounts. Staff who sign in to the management area have session cookies and an account record. This part of the notice applies to them as well.

We process your personal data on these bases:

• Your consent — for the statistics cookie, and for any optional marketing communication you ask for. You may withdraw consent at any time (see "Your rights").

• To respond to your request — if you send an enquiry, we need your contact details to reply to you and to prepare a quotation.

• Legal and security requirements — records required by law, and processing necessary to prevent and investigate misuse of our systems (the audit log and security-event log described in "How long we keep it").

We do not use your data for automated decision-making or profiling, and we do not use it to send you advertising unless you have asked to receive it.

We keep the circle as small as possible. We share personal data with:

• Our hosting provider and CDN (including Cloudflare), which serve the website and, in doing so, process request data such as IP addresses on our behalf;

• Our email service provider, which delivers enquiry notifications and our replies;

• Video platforms (YouTube, Bilibili, Vimeo) — but only after you click to load an embedded video. Until you click, no request is made and no data is sent to them;

• Professional advisers and authorities, where the law requires it.

We do not sell, rent or trade personal data, and we do not pass your enquiry to unrelated third parties for their own marketing.

The operator of this website, Foshan Fireas Windows & Doors Technology Co., Ltd., is established in mainland China, and our website servers, email delivery and the staff who handle enquiries are located there too. So when you submit an enquiry, your personal data (name, email address, telephone number, country, message and any extra fields you fill in) is transferred to and processed in mainland China. This transfer is one of the things the enquiry form asks you to agree to separately.

Our servers and service providers may be located outside Malaysia (the data centres of our hosting and email providers). Where personal data is transferred outside Malaysia, we take reasonable steps to ensure it is protected to a standard at least comparable to the PDPA — for example through contractual commitments with the provider and by transferring no more data than the service requires. Following the PDPA (Amendment) Act 2024, which removed the previous whitelist regime, this assessment is our responsibility as data controller.

Where a transfer requires your consent, we ask for it; you may withdraw it at any time, although this may mean we can no longer serve your enquiry from that provider.

We keep personal data only as long as we need it. Current retention practice:

• Enquiry records — we keep enquiries so that we can follow up and evidence the commercial relationship. They are deleted automatically 12 months (365 days) after submission, together with the internal follow-up notes attached to them. You may ask us to delete yours sooner at any time; we keep a record longer only where the law requires it.

• Visit statistics — detailed records are deleted automatically after 90 days; aggregated daily counts (which no longer identify a visitor) are kept for long-term trend reporting.

• Security records — blocked-request events are deleted after 30 days; administrator audit records after 180 days.

• Sign-in attempts — deleted after 7 days.

• Backups — the most recent 7 daily backups, after which they roll off.

Under the PDPA you have the right to:

• Access the personal data we hold about you, and be told how it is used;

• Correct data that is inaccurate, incomplete or out of date;

• Withdraw your consent, with effect from that point onwards;

• Limit the processing of your data, or object to processing that causes you damage or distress;

• Request your data in a commonly used, machine-readable format (data portability, introduced by the 2024 amendment).

To exercise any of these, write to [email protected]. We answer access and correction requests within 21 days as required by the PDPA. If you are not satisfied with our response, you may complain to the Personal Data Protection Department (JPDP) of Malaysia.

You can also raise a complaint through the complaint channel on this website (the link is in the footer). We will get back to you with a first response within 7 working days.

We protect personal data with the measures that are practical for a site of this size: encrypted connections (HTTPS), a salted-hash treatment of IP addresses in our statistics and security logs (so the stored value cannot be traced back to an address by reading the database), role-based access to the management area, and an audit log of administrative actions.

No method of transmission or storage is completely secure. If we become aware of a personal data breach that meets the notification threshold, we will notify the Commissioner within 72 hours and inform affected individuals as required by the PDPA (Amendment) Act 2024.

If we appoint a Data Protection Officer (where the PDPA, as amended, requires or the Commissioner directs it), their contact details will be published here. Until then, all privacy questions and requests go to [email protected].

Please use the subject line "Privacy request" so that it reaches the right person quickly.

We may update this notice. The "last updated" date at the top always reflects the current version, and the version identifier is recorded together with cookie choices you have made — so we can tell which text you agreed to.

If a change materially affects what we do with your data, we will highlight it on the website.