Privacy policy

Data controller: winsym.ai (operated by Karim Azzaoui), Kuala Lumpur, Malaysia. Contact: hello@winsym.ai.

What we collect

Enquiries. When you send an enquiry or join a waitlist, we collect your name, work email, and — if you provide them — company, phone number, team size, the topic you are interested in and your message. We record the page you came from and the time you gave consent.

Student accounts. If you are enrolled in a course, we store your name and email, the courses you are enrolled in, the lessons you complete, coaching sessions scheduled for you, and certificates issued to you. Your employer may receive attendance and completion information where this is required for an HRD Corp claim.

Certificates. Each certificate has a verification code. Anyone with the code can confirm your name, the course and the date of completion on our verification page.

Analytics. We use Vercel Web Analytics (aggregated, cookieless) and record anonymous page events such as button clicks. We do not use advertising cookies.

Why we process it

To reply to your enquiry, prepare proposals and HRD Corp documentation, deliver courses and coaching, track learning progress and issue certificates. Legal basis under the GDPR: consent, performance of a contract and legitimate interest. Under Malaysia's PDPA: processing necessary to supply the services you requested.

Where data is stored

Data is stored with Supabase (database and authentication) and served via Vercel. Booking data is processed by Cal.com and email notifications by Resend. These providers may store data outside Malaysia under appropriate safeguards. We do not sell personal data.

Retention

Enquiries: up to 24 months after our last contact, unless a client relationship continues. Student records and certificates: for as long as the certificate must remain verifiable and HRD Corp record-keeping requires, then deleted or anonymised. You may request earlier deletion where no legal obligation applies.

Your rights

You may request access to, correction of, or deletion of your personal data, withdraw consent, or object to processing by emailing hello@winsym.ai. Malaysian residents may contact the Personal Data Protection Department; EU and UK residents may lodge a complaint with their local supervisory authority.

Changes

We update this policy when our practices change. The version referenced when you gave consent applies to that submission.