Legal

Privacy notice and terms of use

These cover the susten.my website only. Client data handling under a service contract, and data from our energy management system, are governed separately by the contract with that client.

Scope: susten.my Version: 1.0 Effective date: July 2026
01

Who we are

Susten Sdn Bhd (Company No. 202001038622 / 1394943-U) is a Malaysian energy services company with its registered address at Level 10, Menara Shell, 211 Jalan Tun Sambanthan, 50470 Kuala Lumpur. For any question about personal data, contact hello@susten.my or +60 3 2779 4333.

02

What this website collects

This website sets no cookies, runs no advertising trackers, and does not profile visitors. You can read every page on it without giving us anything.

03

The enquiry and request forms

The forms on this site — the funded-audit enquiry, the eligibility checker and the credentials pack request — do not transmit anything to a server. The eligibility checker runs entirely in your browser and records nothing at all. The enquiry forms compose a message in your own email client, which you then choose to send or discard.

In practice that means we receive your information the same way we would receive any email you chose to write us, and not before you press send.

04

What we do with what you send us

We use the information in your enquiry to:

  • assess whether your building is likely to qualify for a grant-funded energy audit;
  • prepare and respond to your enquiry, including by phone or email;
  • assess a credentials pack request against who we release that material to; and
  • keep a record of the enquiry and our correspondence about it.

We do not sell personal data, and we do not use enquiry details for unrelated marketing without asking you first.

05

Who we share it with

Our own team, on a need-to-know basis, and our email and productivity provider (Microsoft 365), which processes correspondence on our behalf. We disclose personal data to regulators or authorities only where required by law.

06

How long we keep it

Enquiries that do not lead to an engagement are kept for up to 24 months and then deleted. Where an enquiry becomes a client relationship, records are retained for the duration of the contract and for a further seven years afterwards, to meet Malaysian statutory record-keeping requirements.

07

How we protect it

Correspondence is held within our Microsoft 365 environment with access restricted to those who need it, and accounts are removed when someone leaves.

08

Where your information is processed

Our email and productivity tools are provided by Microsoft 365, and our website is served by Cloudflare. Both operate international networks, so your correspondence may be processed or stored on servers outside Malaysia.

The Personal Data Protection Act places conditions on transferring personal data abroad. Where that happens we rely on the contractual and technical safeguards these providers offer, and we limit such transfers to what is necessary to correspond with you and run this site.

09

If something goes wrong

If personal data we hold is lost or disclosed without authorisation, and the breach is notifiable under the Personal Data Protection Act, we will notify the Personal Data Protection Commissioner and any affected individuals within the timeframes the law requires.

10

Your rights

Under the Personal Data Protection Act 2010, and subject to its conditions and exceptions, you may:

  • ask for access to the personal data we hold about you;
  • ask us to correct it if it is inaccurate, incomplete or out of date;
  • withdraw consent to processing, including any marketing; and
  • limit processing for direct marketing purposes.

To exercise any of these, email hello@susten.my. We may need to verify your identity first. You may also complain to the Personal Data Protection Commissioner of Malaysia.

11

Data from our energy management system

The energy management system primarily processes building and equipment data — temperatures, pressures, flow rates, power consumption, equipment status — which is generally not personal data. Where it processes personal data, such as named user accounts for a client's facilities staff, that is governed by our contract with that client rather than by this website notice.