Last updated / Revised: 4 September 2026
Applies to:
- https://sionsavedbygrace.blogspot.com/
- https://www.hanseongrevival.org/
1. DATA CONTROLLER
Hanseong Revival Press, a non-commercial religious publishing ministry operating in the State of Sabah, Malaysia (North Borneo), acts as the Data Controller within the meaning of Section 4 of the Personal Data Protection Act 2010 of Malaysia, as amended by the Personal Data Protection (Amendment) Act 2024 ("PDPA"), and, where applicable to visitors from the EEA, the "controller" within the meaning of Article 4(7) of the GDPR.
Data Protection Officer / contact person:
DPO: Zion (Sion) — Hanseong Revival Press
- Email: hanseongrevivalpress@protonmail.com
2. CATEGORIES OF PERSONAL DATA PROCESSED
Category | Examples
a. Identity Data | Legal name or pseudonym, ecclesiastical or honorific title (where provided)
b. Contact Data | Email address; telephone or postal address only where you voluntarily provide them
c. Technical Data | IP address, user-agent, browser type, city-level approximate geolocation, timestamps (collected by our hosting platforms)
d. Financial Data | Masked payment instrument reference, donation quantum, transaction ID, date — only where donations are made
e. Spiritual Data | Prayer intentions and testimonies — sensitive personal data under s. 40 PDPA / Art. 9 GDPR, processed only with your explicit consent
expressly excluded: full payment card data, National Registration Identity Card (NRIC) numbers, biometric identifiers, precise geolocation.
3. LAWFUL BASES FOR PROCESSING
If you are in Malaysia (PDPA 2010, as amended)
The PDPA is principally a consent-based regime. We process your personal data on the following bases:
- Consent (s. 6 PDPA) — opt-in subscriptions and prayer/testimony submissions; withdrawable at any time;
- Performance of a contract — donation administration and provision of services you have requested;
- Legal obligation — compliance with directives of the Personal Data Protection Department (JPDP), the Malaysian Communications and Multimedia Commission (MCMC), the Inland Revenue Board (LHDN), or courts of competent jurisdiction;
- Vital interests — protection of life or safety where necessary.
If you are in the EEA, UK, or Switzerland (GDPR / UK GDPR / revFADP)
- Consent — Art. 6(1)(a);
- Contract — Art. 6(1)(b);
- Legitimate interests — Art. 6(1)(f): network security, fraud prevention, and aggregated, anonymised analytics;
- Legal obligation — Art. 6(1)(c);
- Explicit consent for special-category data — Art. 9(2)(a) (prayer intentions, testimony).
If you are in California (CCPA/CPRA)
We rely on your opt-in or implied consent consistent with Cal. Civ. Code § 1798.100 et seq., and we do not sell or share personal information as defined therein.
4. DATA SUBJECT RIGHTS
Right | PDPA (Malaysia) | GDPR (EEA/UK) | CCPA/CPRA (California)
Access | Within 21 days of request (s. 30), subject to prescribed fee | Without undue delay; within 1 month (Art. 15) | Within 45 days |
Rectification | Correction on request (s. 34) | Without undue delay (Art. 16) | Included (correction) |
Erasure / Deletion | Limited — subject to statutory retention duties (Retention Principle, s. 10) | Right to erasure, Art. 17 | Right to delete, subject to exemptions |
Restriction| Limited under PDPA | Art. 18 | Limited (right to limit use of sensitive data) |
Portability | Structured, commonly used format on request (new right, 2024 Amendment) | Art. 20 | Not applicable |
Objection / Opt-Out | Withdraw consent at any time (s. 38) | Art. 21 | "Do Not Sell or Share" (no sale occurs) |
Non-discrimination | Implicit | Art. 23 considerations | § 1798.125 |
How to submit a request:
email hanseongrevivalpress@protonmail.com with the subject line "PDPA Request" (or "GDPR Request" / "CCPA Request" as applicable). We will verify your identity via your registered email address or proof of the relevant transaction before acting.
5. PROHIBITION ON SALE OR SHARING
We do not sell, lease, rent, or disclose personal data for monetary or other valuable consideration, nor for cross-context behavioural advertising, within the meaning of Cal. Civ. Code § 1798.140. We do not sell or share personal data under any applicable law.
6. COOKIES & TRACKING TECHNOLOGIES
Full details are set out in our Cookie Policy. In summary:
| Type | Purpose | Retention | Control |
Strictly necessary | Session integrity, CSRF protection, security | Duration of session | Exempt from consent |
Analytics | Anonymised, aggregate usage only | 90 days | Consent may be revoked at any time |
Functional | Preference memory (language, comment identity) | Up to 1 year | Consent may be revoked at any time |
A consent banner is deployed on first visit for EEA/UK/Swiss visitors (and elsewhere where required), in accordance with the ePrivacy Directive and platform-provider obligations.
7. SECURITY MEASURES (s. 9 PDPA / Art. 32 GDPR)
- TLS 1.3 encryption in transit; AES-256 encryption at rest (provided by our hosting platforms);
- Two-factor authentication on all administrative accounts;
- Role-based access control and least-privilege administration;
- Hosting on infrastructure operated by established providers (Google LLC for Blogger; our independent hosting provider for hanseongrevival.org);
- Breach response in accordance with s. 12B PDPA (notification to the Commissioner as soon as practicable where significant harm is caused or likely; notification of affected data subjects as required by the JPDP Data Breach Notification Guidelines) and, for EEA personal data, within 72 hours under Art. 33 GDPR.
8. INTERNATIONAL TRANSFERS
Personal data may be transferred outside Malaysia only where permitted under s. 129 PDPA as amended (in force 1 April 2025, replacing the former whitelist regime) — for example, where the destination has laws substantially similar to the PDPA or ensures an equivalent level of protection, or where another statutory condition applies.
For transfers of EEA/UK personal data, we rely on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) or the UK International Data Transfer Agreement/Addendum, as applicable. Data may be processed by our platform providers, including Google LLC (United States).
9. RETENTION SCHEDULE
Data category | Retention |
Donation records | 7 years (Inland Revenue Board / LHDN record-keeping requirements under Malaysian tax law)
Subscribers | Deleted within 30 days of unsubscribe |
Pastoral correspondence & prayer data | 90 days after resolution |
Server/security logs | 180 days (held by platform providers under their policies) |
Inactive subscriber accounts | Auto-deleted after 2 years of inactivity |
Where deletion is temporarily impossible (backup archives), data is isolated from further processing until deletion can occur.
10. SUPERVISORY REDRESS
Jurisdiction | Authority |
Malaysia | Personal Data Protection Department (JPDP), Ministry of Digital — https://www.pdp.gov.my |
EEA | Your local national data protection authority |
United Kingdom | Information Commissioner's Office — https://ico.org.uk |
California | Attorney General — https://oag.ca.gov/privacy |
11. GOVERNING LAW & JURISDICTION
- Primary governing law: the laws of Malaysia (including the PDPA 2010, as amended).
- Supplemental application: the GDPR applies to visitors from the EEA, and the CCPA/CPRA to California residents, to the extent those laws apply extraterritorially and provide stricter protections.
- Jurisdiction: the courts of Malaysia, with the Courts of Sabah (Kota Kinabalu) having convenient venue; nothing herein excludes any mandatory local jurisdiction conferred by applicable law.
12. CONTACT
Data Protection Officer: Zion (Sion) — Hanseong Revival Press
Email: hanseongrevivalpress@protonmail.com
Websites: https://sionsavedbygrace.blogspot.com/ | https://www.hanseongrevival.org/
Location: Kudat Division, Sabah, Malaysia (North Borneo)
This notice does not constitute legal advice. Your statutory rights under the PDPA 2010 (as amended) and other applicable laws prevail over any inconsistency in this document.