Privacy Policy

1. Who is responsible for your data

Primary data controller

Winnie Lim 林曉怡, operating Joyfulness Path in Malaysia, determines the primary purposes for collecting and using activity registration data.

Technical and production service provider

SOUL NEW ENERGY LIMITED (心靈新能量有限公司), trading as Soul New Energy, is a company registered in Hong Kong. It provides website, registration system, data management, email, activity production, streaming and related technical support under Joyfulness Path's instructions.

Soul New Energy processes Joyfulness Path participant data only as needed to provide those services. It will not use that data for its own marketing unless you give separate express consent.

2. Data we may collect

Depending on the service, we may collect:

1. Identity and contact data: name, email address, location and contact details you choose to provide.
2. Registration and activity data: activity name, registration time, attendance status, Focus selection, text entered under “Other”, and records connected with activity arrangements.
3. Choices and consent records: versions of the Terms and privacy notice shown, cross-border processing choice, activity notifications, follow-up messages, newsletter choices and withdrawals.
4. Payment and transaction data: payment status, transaction identifier, amount, currency, payment time and refund record. Full payment card details are normally handled by the payment provider; we will not ask you to submit full card details through a general form.
5. Communications: emails, form content, enquiries, comments and cancellation or correction requests sent to us.
6. Technical and usage data: IP address, device and browser type, access time, referring page, activity-page interaction, security logs and necessary system records.
7. Streaming and activity interaction data: Zoom display name, chat, speech or video. Whether it is recorded and how it is used will depend on the activity-page notice and the explanation before the activity begins.

Please provide only information needed for the activity in the Focus and free-text fields. Do not provide a diagnosis, medication details, trauma details, identity-document numbers, financial-account information or another person's data. You may select “Prefer not to say”.

Focus and sensitive personal data

A Focus selection or optional free text may indirectly reveal emotional or mental wellbeing or religious or similar beliefs and may therefore constitute sensitive personal data. We process it only after obtaining your express consent, for registration, activity planning and aggregated analysis that does not identify you. We do not publish an individual's Focus or free text or use it to make a medical, psychological, financial or other professional assessment. You may withdraw consent. Withdrawal does not affect processing already completed, but we may then be unable to use that data for a related personalised arrangement.

3. Sources of data

We may obtain data from:

• website, registration and enquiry forms completed by you;
• your emails and activity interactions with Joyfulness Path or Soul New Energy;
• Zoom, Facebook, YouTube, payment platforms or other third-party services you choose to use;
• logs generated for security, error handling and service operation; and
• a person authorised to act for you.

4. Purposes of processing

We may use personal data to:

1. receive and process activity registrations;
2. confirm identity, manage capacity and prevent duplicates or misuse;
3. send confirmations, activity links, times, arrangements, reminders, rescheduling notices and other essential notices;
4. provide Zoom access, streams, replays, materials or another registered service;
5. use overall Focus patterns to plan content and improve the participant experience;
6. process payments, refunds, reconciliation, accounts and records;
7. respond to enquiries, complaints, access, correction, withdrawal and unsubscribe requests;
8. send follow-up activity messages or newsletters after your optional consent;
9. maintain the security of websites, forms, email, data systems and streams;
10. identify errors, duplicate submissions, unauthorised use and other system problems;
11. comply with legal requirements, resolve disputes and protect lawful rights; and
12. prepare aggregated operational statistics that no longer reasonably identify an individual.

We will not change the data to a purpose unrelated to the original collection without appropriate notice and any consent required by law.

5. Mandatory and optional data

Mandatory data

Name, email address, location, a Focus selection (which may be “Prefer not to say”), acceptance of the Terms, express consent for sensitive-data and necessary cross-border processing, current-cycle activity notifications and the activity-nature acknowledgement are needed to complete registration and deliver the activity. If you do not provide them, we may be unable to confirm your registration, send access information or provide the service.

Optional data

Follow-up messages, newsletter subscriptions and non-essential free text are optional. Refusing or later withdrawing these choices does not affect a completed registration or purchased service.

6. Communication choices

We manage these three purposes separately:

1. Activity notifications: confirmations, access links, arrangements and reminders directly connected with the activity cycle you registered for.
2. Follow-up messages: further information about the same series or related activities; optional.
3. Newsletter: recurring Joyfulness Path content and updates; optional.

Optional choices are not pre-selected. You may withdraw consent to follow-up messages or newsletters at any time by using the unsubscribe method in an email or contacting us.

7. Parties to whom data may be disclosed

We disclose data only as necessary to:

• Soul New Energy and authorised people assisting with the activity;
• website hosting, cloud storage, database, form, automation and security providers;
• email delivery and communication providers;
• video activity platforms such as Zoom;
• public streaming platforms such as Facebook and YouTube, without automatically publishing Zoom participant data;
• payment providers such as Stripe or PayPal where listed on the activity page;
• accountants, legal advisers and other professional advisers under confidentiality duties;
• courts, regulators, law-enforcement or other authorities acting with proper power; and
• another party with your separate consent.

Current technical services may include Vercel, Google Workspace, Google Sheets, Google Apps Script, Zoom, Meta/Facebook, Google/YouTube, Stripe and PayPal. If the service list changes materially, we will update this Policy or the relevant notice.

We do not sell participant personal data.

8. Cross-border processing

Joyfulness Path operates from Malaysia and Soul New Energy is located in Hong Kong. Registration data may be transferred from Malaysia to Hong Kong to provide website, registration management, email, technical and activity production services.

Some providers may also use servers or support teams in Malaysia, Hong Kong or other countries or regions, where data-protection laws may differ from those in your location.

We will:

• explain the purpose of the transfer and categories of recipient when data is collected;
• obtain consent where required;
• transfer only data necessary for the stated purpose;
• impose confidentiality, security and use restrictions on processors;
• retain reasonable records of cross-border recipients and processing; and
• take reasonable security measures and review relevant providers.

9. Retention

We do not retain personal data longer than necessary for its purpose. Our current reference periods are:

• general registration and activity records: up to 24 months after the last activity or meaningful interaction;
• identifiable Focus free text: where practicable and no longer needed, prioritised for deletion or de-identification within 90 days after the activity;
• payment, refund and accounting records: for the period required by applicable law, normally no longer than seven years;
• technical and security logs: normally up to 90 days where within our control;
• follow-up and newsletter data: until you withdraw consent or the service ends;
• unsubscribe or suppression records: the minimum data needed to avoid contacting you again; and
• data connected with a dispute, investigation or legal requirement: until the matter ends and the applicable period expires.

When data is no longer needed, we will take reasonable steps to delete, anonymise or securely dispose of it. Data retained independently by a third-party platform may also be subject to its policy and backup cycle.

10. Security

We take reasonable measures proportionate to the nature and risk of the data, including:

• restricting access to people who need it for their work;
• using individual accounts, appropriate passwords and multi-factor authentication where available;
• avoiding public links or unprotected channels for data transfer where reasonably possible;
• retaining necessary system, error and permission records;
• reviewing access and removing permissions no longer required;
• requiring service providers and partners to maintain confidentiality and security; and
• maintaining a process to report, contain and follow up a data incident.

No online transmission or system can be guaranteed to be absolutely secure. Contact us promptly if you suspect unauthorised use of your data or account.

If a personal data breach may cause significant harm or requires notification by law, we will assess and contain it, keep records and notify the relevant regulator and affected people where required.

11. Cookies and website analytics

The website may use cookies or similar technologies necessary for functionality, security and preferences. If non-essential analytics or promotional tracking is introduced, we will provide notice and choice as required.

You may restrict cookies through your browser, although some functions may then not work properly.

12. Your rights and choices

Subject to applicable law and reasonable identity verification, you may request to:

• access personal data we hold about you;
• correct data that is inaccurate, incomplete or out of date;
• withdraw consent-based processing;
• stop receiving follow-up messages or newsletters;
• restrict certain processing or make a complaint;
• receive or transfer data where the law applies and it is technically feasible; and
• delete data that is no longer needed and has no other lawful retention basis.

Withdrawal does not affect processing already carried out before it. We may request reasonable information to verify your identity and protect your data.

13. Children and minors

The website and activities are primarily intended for people aged 18 or above. A person under 18 should first obtain consent from a parent or legal guardian. If we learn that a minor's data was collected without appropriate consent, we will take reasonable steps to restrict its use or delete it.

14. Public streaming and activity recording

Registering or accepting general activity terms is not permission to use your name, voice or image publicly. Unless separate express consent is obtained, a public stream should normally show only hosts and authorised guests.

If an activity includes recording, replay or public content, the activity page or announcement before the activity will explain the recording scope, purpose and audience. Participants should avoid placing information in their display name or a public chat that they do not want others to see.

15. Third-party websites

The website may link to third-party platforms. Their own policies govern how they collect and use data. Please review their terms and privacy policies before use.

16. Updates to this Policy

We may update this Policy to reflect changes to services, technology or legal requirements. The new effective date will be shown. If a material change affects data purposes, disclosures or choices, we will provide additional notice or obtain fresh consent where required.

17. Language versions

This English version is provided together with Bahasa Melayu and Traditional Chinese versions. If there is a difference between versions, they will be interpreted consistently with applicable law and the reviewed official text, without reducing your legal rights.

18. Contact us

Data controller: Winnie Lim 林曉怡, operating as Joyfulness Path
Place of operation: Malaysia (online operation; no public walk-in location)
Public telephone: +60 12-234 9607
Privacy enquiries and rights requests: winnie.joyfulness.path@gmail.com

Technical and production service provider: SOUL NEW ENERGY LIMITED (心靈新能量有限公司)
Hong Kong Company No. (CR No.): 79188635
Business Registration Certificate No.: 79188635-000-11-25-9
Place of registration: Hong Kong
Technical and company enquiries: hello@soulnewenergy.com