Privacy Policy

Kawa Flow PLT trading as KawaModel.com

Last updated: 7 July 2026

1. About Us and Introduction

Kawa Flow PLT trading as KawaModel.com provides a range of services for our members, and some services for non-members. This includes digital and physical products, membership services, educational resources including courses, workshops, events, and future offerings.

We respect your privacy. We comply with applicable data protection laws, including:

• The Malaysian Personal Data Protection Act 2010 (PDPA) – as we are a Malaysian business;
• The UK General Data Protection Regulation (UK GDPR) – as we offer services to individuals in the UK;
• The EU General Data Protection Regulation (EU GDPR) – as we offer services to individuals in the EU;
• The Data (Use and Access) Act 2025 (DUAA) – which refines UK GDPR requirements.

By using our website and services, you acknowledge that your data will be processed as described in this policy.

2. Contact Details

• Company name: Kawa Flow PLT
• Registered address: 11 Tingkat Nakhoda 2, Taman Teluk Air Tawar, 13050 Butterworth, Malaysia
• Privacy contact email: flow [at] kawamodel.com
• Data Protection Officer: The Managing Partner (contactable via the email above)

3. What Personal Data We Collect

We may collect and process the following data about you:

• Your name
• Your email address
• Your address
• Your phone number
• Your date of birth (if provided)
• Your business name
• Your professional status (e.g., student, qualified professional, or other relevant designation)
• Your country of residence
• Financial details (payment card info, billing address – processed securely by our payment processor, Stripe)
• Data about your use of our website and services
• Technical data (IP address, browser details, page visits, navigation paths, time zone, device info)
• Marketing and communication preferences
• Information from contact forms, emails, competitions, or surveys
• Records of orders, purchases, and membership activity

We do not collect sensitive data (health, race, religion, sexual orientation, political opinions, trade union membership, biometric/genetic data) or criminal records.

4. How We Use Your Data and Our Lawful Grounds

Purpose	Data Involved	Lawful Ground (UK/EU GDPR)	PDPA Basis
Operate waiting list	Name, email, country, professional status	Consent	Consent
Process digital goods purchases	Name, email, financial data	Contract	Contractual necessity
Manage membership access	Name, email, login, usage	Contract	Contractual necessity
Reply to enquiries	Name, email, message	Legitimate interests	Legitimate interests (with notice)
Marketing to existing customers / business contacts at legal entities (including limited companies, LLPs, universities, registered charities, and other incorporated bodies)	Email, name, professional status	Legitimate interests	Legitimate interests
Marketing to individuals, sole traders, and partners in partnerships	Email	Consent	Consent
Website analytics & security	Technical data, IP, cookies	Legitimate interests	Legitimate interests
Tax/accounting records	Transaction data	Legal obligation	Legal obligation
To improve our services, content, and member support	Usage data, preferences	Legitimate interests	Legitimate interests
Market research and analytics	Usage data, preferences	Legitimate interests	Legitimate interests

We do not carry out automated decision-making or profiling.

5. How We Collect Your Data

• Directly from you – when you sign up, purchase, register, fill forms, or email us.
• Automatically – via cookies and similar technologies.
• From third parties – analytics providers, payment processors, and platform providers (e.g., GoHighLevel, Stripe).

6. Marketing Communications

We send marketing emails only where:

• You have given consent; or
• You have previously purchased from us (soft opt-in) and not opted out; or
• You are a contact at a legal entity (including limited companies, LLPs, universities, registered charities, and other incorporated bodies) and we rely on legitimate interests for B2B marketing.

You may opt out at any time via the "unsubscribe" link in any email or by emailing flow [at] kawamodel.com

Opting out of marketing does not stop service-related emails (e.g., order confirmations, membership updates).

7. Data Protection Complaint Handling Procedure

We are committed to resolving any concerns you may have about how we handle your personal data.

• How to complain: Email flow [at] kawamodel.com with "Data Protection Complaint" in the subject line, or use our website complaint form.
• Acknowledgement: We will acknowledge your complaint within 30 days of receipt.
• Investigation: We will investigate without undue delay and keep you informed of progress.
• Outcome: We will tell you the outcome and any actions taken.

We keep records of all complaints and their resolutions.

8. Subject Access Requests (SARs)

You have the right to request access to your personal data.

• Deadline: We will respond within one month of receiving your request.
• Clarification: If we need further information to locate the data you are seeking, we will contact you promptly.
• Reasonable searches: We are only required to conduct searches that are reasonable and proportionate given the circumstances.
• Identity verification: We may ask for ID to ensure we do not disclose your data to the wrong person.

To make a SAR, please use our form

9. International Data Transfers

We are based in Malaysia but use service providers located in the United States (GoHighLevel for our platform, Stripe for payments). This means your personal data may be transferred out of Malaysia to the United States.

Under Malaysian PDPA 2010, Section 129: Data transfers outside Malaysia are restricted unless certain conditions are met. We rely on:

• Consent (Section 129(3)(a)) – you explicitly consent to this transfer by using our services and agreeing to this policy; and
• Contractual necessity (Section 129(3)(b)) – the transfer is necessary for us to provide the services you request (e.g., processing your payment, delivering digital goods, hosting your membership account).

Under UK/EU GDPR: We ensure appropriate safeguards for data transferred outside the UK/EU by:

• Using processors who provide Standard Contractual Clauses (SCCs) approved by the European Commission; and
• Using processors who adhere to the UK Addendum to the SCCs and/or the EU-US Data Privacy Framework, where applicable.

We have Data Processing Agreements (DPAs) in place with all our third-party processors.

10. Disclosures of Your Personal Data

We may share your data with:

• GoHighLevel (USA) – platform and hosting provider.
• Stripe (USA) – payment processor.
• Analytics providers – to understand website usage.
• Professional advisers (lawyers, accountants) – where necessary.
• Government authorities – where required by law.

All third parties must respect your data and process it only on our instructions and in accordance with the law.

11. Data Security

We have implemented technical and organisational measures to protect your data from loss, unauthorised access, alteration, or disclosure. Access is limited to personnel with a business need. We have breach notification procedures in place.

12. Data Retention

We retain your data only as long as necessary:

• Tax/accounting purposes: Six (6) years after you cease being a customer (as required by Malaysian tax law).
• If you request deletion, we will delete or anonymise your data, except where legal obligations require longer retention.
• Where deletion is not possible (e.g., for system consistency), we will permanently anonymise your data.

13. Cookie Policy

We use cookies and similar technologies to enhance your experience, analyse usage, and support our marketing efforts. We apply the EU standard requiring consent for all non-essential cookies. You can manage your preferences via our cookie banner or browser settings.

For full details, see our Cookie Policy.

14. Your Legal Rights

Under UK GDPR, EU GDPR, and Malaysian PDPA, you have the following rights (with some jurisdictional variations):

• Informed: You have the right to be informed about how we handle your personal data. This privacy notice fulfils that right.
• Access: You have the right to ask for a copy of the personal data we hold about you, the purposes for which we are using it, and to check we are handling it lawfully.
• Rectification: You have the right to ask us to correct or update any inaccurate or incomplete data.
• Erasure (right to be forgotten): You have the right to ask us to delete your personal data. This is not an absolute right – we may have justifiable reasons for declining (e.g., legal retention obligations).
• Restriction: You have the right to request that we restrict processing of your data in certain circumstances.
• Object: You have the right to object to processing based on legitimate interests (including marketing).
• Portability: You have the right to receive your data in a structured, commonly used, and machine-readable format.
• Withdraw consent: Where processing is based on consent, you may withdraw at any time.

To exercise these rights, email flow [at] kawamodel.com, we will respond within one month (subject to reasonable searches and verification).

15. External Links

Our website may contain links to external websites. If you follow a link to another website, this privacy notice no longer applies. Your browsing and interaction on any other website is subject to that website's own rules and policies. We encourage you to review their privacy notices before providing any personal data.

16. Complaint to the Supervisory Authority

If you are not satisfied with how we handle your data, please contact us first so we can resolve your concern. You also have the right to lodge a complaint with your local data protection authority.

We will cooperate fully with any investigation. However, as a small organisation, we cannot register separately with every authority worldwide. If you have concerns, please contact us directly so we can help.

17. Changes to This Policy

We may update this policy to reflect changes in law or our practices. The current version is always available on our website. Material changes will be notified via email or website notice.