Version: 2.0
Effective date: 30 September 2026
Last updated: 30 September 2026
Kawa Flow PLT, trading as KawaModel.com, provides a range of services for members and non-members. These include digital and physical products, membership services, educational resources, courses, workshops, events and future offerings.
We respect your privacy and comply with applicable data protection laws, including:
- the Malaysian Personal Data Protection Act 2010 (PDPA), as we are a Malaysian business;
- the UK General Data Protection Regulation (UK GDPR), as we offer services to individuals in the UK;
- the EU General Data Protection Regulation (EU GDPR), as we offer services to individuals in the EU; and
- the Data (Use and Access) Act 2025 (DUAA), which amends aspects of the UK data protection framework.
This Privacy Policy explains how we collect, use, share, store and protect your personal data when you use our website, services, programmes, events and online community, and the rights you may have in relation to your personal data.
Company name: Kawa Flow PLT
Registered address: 11 Tingkat Nakhoda 2, Taman Teluk Air Tawar, 13050 Butterworth, Malaysia
Privacy contact: flow [at] kawamodel.com
Person responsible for data protection: The Managing Partner (contactable via the email above)
Depending on how you interact with us, we may collect and process:
- your name;
- your email address;
- your address;
- your phone number;
- your date of birth, if provided;
- your business name;
- your professional status, such as whether you are a student, qualified professional or hold another relevant designation;
- your country of residence;
- financial and transaction information, including billing information (payment card information is processed securely by our payment processor, Stripe);
- information about your use of our website, services, programmes and online community;
- technical information, such as your IP address, browser details, page visits, navigation paths, time zone and device information;
- your marketing and communication preferences;
- information you provide through contact forms, emails, applications, competitions, surveys or feedback forms;
- records of orders, purchases, registrations, programme participation and membership activity;
- information you provide through your account, community profile, posts, comments and other contributions;
- information associated with online events and sessions, which may include your display name, image, voice, contributions, chat messages, questions, recordings and transcripts;
- records relating to community moderation, complaints, disputes or enforcement of our Terms and Community Guidelines.
We do not generally seek to collect special category personal data or criminal offence data. However, you may provide special category data to us where this is relevant to a specific purpose, such as requesting an accessibility adjustment, or you may choose to disclose such information when participating in an event, community or other service. We ask you not to provide sensitive personal information about yourself or others unless it is necessary. Where we process special category personal data, we will do so only where we have an appropriate lawful basis and condition under applicable data protection law.
We use your personal data only where we have a lawful reason to do so. Depending on how you interact with us, we may use your data:
- To provide products, programmes, events and membership services, including processing registrations and purchases, providing access to digital content and the Kawa Community, administering participation and issuing certificates. We generally rely on contractual necessity where this is necessary to provide something you have registered for or purchased.
- To administer our community and services, including managing accounts, responding to enquiries and support requests, maintaining security, handling complaints and moderating Community activity. We generally rely on contractual necessity or our legitimate interests in administering, supporting, securing and protecting our services and Community, depending on the circumstances.
- To deliver and learn from events and educational activities, which may include recording sessions, producing transcripts, managing chat and questions, providing replays or learning resources where applicable, and identifying themes, questions and learning to help develop our educational content and services. We generally rely on contractual necessity or our legitimate interests in administering our events, understanding participant needs and developing our educational services, depending on the purpose of the particular activity.
- To administer applications and accessibility arrangements, including scholarship applications and requests for reasonable adjustments or other support. We generally rely on contractual necessity or our legitimate interests in administering applications and providing appropriate support, depending on the circumstances. Where you voluntarily provide health, disability or other special category personal data for the purpose of requesting accessibility arrangements or support, we generally rely on your explicit consent as the additional condition for processing that information.
- To communicate with you, including sending information necessary to administer services, programmes, events or memberships you have registered for, and sending marketing communications where permitted by applicable law and your communication preferences.
- To improve and develop our services, including analysing usage, feedback, questions and other contributions to understand needs, improve our services and educational content, and support future planning. We generally rely on our legitimate interests in understanding how our services are used and improving and developing our educational services and resources.
- To operate and protect our website and systems, including analytics, troubleshooting, fraud prevention and security. We generally rely on our legitimate interests in operating, securing and improving our systems and, where applicable, consent for cookies or similar technologies.
- To meet legal, regulatory, accounting and tax requirements, where processing is necessary to comply with a legal obligation.
Where we rely on consent, you may withdraw that consent at any time. Where we rely on legitimate interests, we consider whether those interests are proportionate and whether your rights and interests override them.
We may use AI-assisted functionality provided through our technology platforms to support activities such as transcription, summarisation and identification of themes or insights. We remain responsible for how personal data is used through these tools.
We do not carry out solely automated decision-making that produces legal or similarly significant effects concerning you.
We may collect personal data:
- Directly from you, for example when you sign up, make a purchase, register for an event or programme, create an account, complete a form, participate in our services, or contact us.
- Automatically, through cookies and similar technologies when you use our website and online services.
- Through service providers and platforms we use to deliver our services, for example where information about payments, activity or interactions is generated or returned through those services.
We may send you marketing communications where:
- you have consented to receive them;
- the soft opt-in applies, where we obtained your contact details in connection with the sale or negotiation for the sale of our products or services, you were given an opportunity to opt out, and the marketing relates to our own similar products or services; or
- you are a business contact at a corporate organisation and we are permitted to contact you for relevant business-to-business marketing, generally relying on legitimate interests where personal data is involved.
You can opt out of marketing communications at any time by using the unsubscribe link in an email or contacting our Helpdesk.
Opting out of marketing does not stop communications necessary to provide or administer something you have registered for, purchased or joined, such as order confirmations, event information, access instructions, programme updates, membership or account information, or important service notices.
We are committed to resolving concerns about how we handle your personal data.
You can make a data protection complaint by emailing flow [at] kawamodel.com with “Data Protection Complaint” in the subject line, or by using our Helpdesk form and selecting the option 'Data Protection Complaint'.
We will acknowledge your complaint within 30 days, investigate it without undue delay, keep you appropriately informed, and tell you the outcome. We will keep appropriate records of complaints and how they were resolved.
For individuals in the UK, this procedure reflects the complaint-handling requirements introduced by the Data (Use and Access) Act 2025. We apply the same general process to data protection complaints from individuals elsewhere where appropriate.
You have the right to request access to personal data we hold about you.
We will normally respond without undue delay and within one month, subject to any extensions or adjustments permitted by applicable data protection law. We may ask you for information reasonably necessary to verify your identity or clarify the information you are seeking, and we will carry out reasonable and proportionate searches for relevant personal data.
You can make a subject access request using our Helpdesk form and selecting 'Subject Access Request' or by contacting us at flow [at] kawamodel.com.
Kawa Flow PLT is based in Malaysia and uses service providers that may process personal data in other countries, including the United States. This means your personal data may be transferred and processed outside your country of residence.
Where personal data is transferred outside Malaysia, we do so in accordance with the Malaysian Personal Data Protection Act 2010 and applicable requirements for cross-border transfers. Depending on the circumstances, we may rely on appropriate protections in the destination country, contractual necessity, consent where required, or another permitted basis, and take reasonable precautions to protect personal data.
Where UK or EU data protection law applies, we use appropriate safeguards for international transfers where required. These may include recognised adequacy arrangements or approved contractual safeguards, such as the European Commission's Standard Contractual Clauses and applicable UK transfer mechanisms.
We also take appropriate steps when selecting and using service providers that process personal data on our behalf.
We may share personal data where necessary with:
- HighLevel, which provides our website, customer relationship management, communications, community and other platform services;
- Stripe, which provides payment processing and related services;
- analytics and other technology service providers used to operate, secure and understand the use of our website and services;
- professional advisers, such as lawyers and accountants, where necessary; and
- regulators, government authorities, courts or other parties where disclosure is required or permitted by law.
Where another organisation processes personal data on our behalf, we require appropriate data protection and security arrangements. Some recipients may process personal data for their own purposes as independent controllers, in which case their own privacy terms also apply.
We use appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration, disclosure or other unlawful processing.
Access to personal data is limited to people who need it for legitimate business purposes. We also maintain procedures for responding to suspected personal data breaches and will make notifications where required by applicable law.
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including to meet legal, accounting, tax, contractual, security and dispute-resolution requirements.
Retention periods vary depending on the type of information and how it is used. In particular:
- Financial and transaction records are generally retained for at least seven years where required by Malaysian tax and accounting law.
- Event recordings, transcripts and chat are retained according to the purpose of the particular event. Temporary recordings and related source material are deleted when no longer required, while recordings intentionally provided as learning resources or programme content may be retained for as long as they form part of the relevant service or resource.
- Community content, such as posts and comments, may remain as part of the Community after a member leaves where appropriate, although account and profile information will be handled separately.
- Significant moderation and enforcement records are normally retained for three years, or longer where reasonably necessary for an ongoing complaint, dispute or legal matter.
Other personal data is retained only for as long as reasonably necessary for the relevant purpose, after which it is deleted or anonymised where appropriate.
If you ask us to delete your personal data, we will consider your request in accordance with applicable data protection law. We may need to retain some information where there is a legal requirement or another lawful reason to do so.
We use cookies and similar technologies to operate our website, understand how it is used, improve your experience and, where applicable, support our marketing activities.
Where required by applicable law, we obtain consent before using non-essential cookies. You can manage your preferences through our cookie banner and, where applicable, your browser settings.
For more information about the cookies we use and your choices, see our Cookie Policy.
Depending on the data protection law that applies to you and the circumstances, you may have rights to:
- Be informed about how we collect and use your personal data.
- Access personal data we hold about you.
- Correct inaccurate or incomplete personal data.
- Request deletion of your personal data in certain circumstances.
- Restrict processing of your personal data in certain circumstances.
- Object to processing, including the right to object to direct marketing.
- Data portability, where applicable.
- Withdraw consent at any time where we rely on your consent for processing. Withdrawal does not affect processing that was lawful before consent was withdrawn.
You can exercise your rights by contacting our Helpdesk or flow [at] kawamodel.com. We will respond in accordance with the requirements and timescales of applicable data protection law and may ask for information reasonably necessary to verify your identity.
These rights are not absolute and may vary depending on your location, the applicable law and the circumstances of the processing.
Our website and services may contain links to external websites. If you follow a link to another website, this Privacy Policy does not apply to that website. Your use of external websites is subject to their own privacy practices and policies, and we encourage you to review their privacy notices before providing personal data.
If you have concerns about how we handle your personal data, we encourage you to contact us first via our Helpdesk so that we have an opportunity to address them.
You may also have the right to lodge a complaint with the data protection or supervisory authority responsible for data protection in your country or region.
Making a complaint to us does not affect your right to complain to an appropriate data protection authority.
We may update this Privacy Policy from time to time to reflect changes in law, our services or how we process personal data. The current version and date of the latest update will be available on our website.
Where a change materially affects how we use your personal data, we will take appropriate steps to bring it to your attention before the new processing begins, where required by applicable law.