Personal Data Protection Notice

Issued under the Personal Data Protection Act 2010 (the "Act") by Jubilant Profile Sdn. Bhd. ("we", "us", "our").

The Soho Suites KLCC, 20 A2-8-3, Jalan Perak, Kuala Lumpur City Centre, 50450 Kuala Lumpur, Malaysia

This notice tells you what personal data we collect, why we use it, who we share it with and what rights you have in relation to it.

Personal data we collect

You may be asked to provide your name, company name, address, country, telephone number and email address. Where you book a session or a course, we also collect the information needed to arrange the appointment, including health information. How we handle health information is set out separately below.

We collect this data from:

• forms you complete on our website;
• your purchases of our goods and services;
• messages you send us through our social media accounts and messaging channels;
• events we organise.

Health information

Some of our sessions use the contact protocol, in which a bowl is placed on the body, and some combine it with the acoustic protocol, in which the bowls stand around the body. To choose the right protocol for you, we ask in advance about matters such as pregnancy, a pacemaker or any other implanted device, epilepsy or recent surgery.

Health information is sensitive personal data under the Act. We process it only with your explicit consent, which we ask for separately at the time you book — it is not covered by the general consent described below. We use it solely to select and adjust your session, never for marketing, and we delete it once it is no longer needed for that purpose. You are not obliged to give it; if you prefer not to, we will offer you the acoustic format, for which it is not needed.

Why we use it

We use your personal data to:

• keep internal records;
• supply the goods and services you have asked for;
• communicate with you about your order or appointment;
• improve our products and services;
• operate and improve this website;
• prevent fraud and keep our systems secure;
• produce aggregate statistics about how our products and website are used;
• send you offers and news, where you have consented to receive them;
• arrange invitations and registration for our events;
• meet our obligations under Malaysian law, including the Companies Act 2016.

Who we share it with

We disclose personal data only to the extent needed for the purposes above, and only to:

• companies within our group;
• delivery and logistics providers;
• payment processors;
• analytics, security and fraud prevention providers;
• professional advisers and auditors;
• authorities, where we are required by law to do so.

We do not sell your personal data. Where a recipient is outside Malaysia, we take reasonable steps to ensure your data receives a comparable level of protection.

Accuracy

It is your responsibility to make sure that the personal data you give us is accurate, complete and up to date. We are not responsible for the consequences of acting on inaccurate or outdated data supplied by you, but we will correct it as soon as you tell us.

Your rights

You may at any time:

1. Request access to the personal data we hold about you.
2. Request correction of data that is inaccurate, incomplete or out of date.
3. Make an enquiry about how your data is being used.
4. Withdraw consent to our retaining, holding or storing your personal data. Please note that this may mean we can no longer perform our obligations to you.
5. Request portability. Where it is technically feasible and the conditions in the Act are met, you may ask us to transmit your personal data directly to another data controller of your choosing, in a structured and commonly used format.

Requests may be refused only in the circumstances permitted by the Act or by other applicable law, and we will tell you if that is the case.

Send any request to:

Personal Data Protection Officer

Jubilant Profile Sdn. Bhd.

The Soho Suites KLCC, 20 A2-8-3, Jalan Perak, Kuala Lumpur City Centre, 50450 Kuala Lumpur, Malaysia

Email: info@healingbowl.asia

Telephone: +60 11-2782 7788

If a breach occurs

If a personal data breach occurs that causes or is likely to cause significant harm to you, we will notify the Personal Data Protection Commissioner as soon as practicable and in any event within 72 hours of the breach, and we will notify you directly within seven days of that notification.

Retention and security

We are committed to keeping your personal data confidential, secure and accurate. Personal data is destroyed or deleted from our records and systems once it is no longer required for the purposes set out above and once any retention period required by law has passed.

Consent

By providing your personal data to us, you confirm that you have read, understood and accepted this notice, and you consent to the processing of your personal data as described in it.

Where we ask for your consent to send you marketing communications, that consent is given separately and may be withdrawn at any time without affecting your order.

Effective date: 8 September 2026

---

This notice is issued in English and Bahasa Malaysia in accordance with section 7 of the Personal Data Protection Act 2010. The Bahasa Malaysia version is published on this page. In the event of any inconsistency between the two, the English version shall prevail.