/01 Who is responsible
Mr.Ooi is responsible for personal data collected through mrooi.com, our free tools, our marketing and our client work. The entity responsible in your country is listed on Company Information. Contact us about privacy at privacy@mrooi.com.
Country notices. If you are in one of these countries, its notice adds to this policy and applies first where they differ: India · Malaysia · Singapore · Australia · United States · EU and UK.
/02 What we collect
| Source | Personal data |
|---|---|
| Audit and contact forms | Name, work email, phone or WhatsApp number, business name, website, city, the search or project you describe, consent record (time, page, policy version) |
| Lead forms on LinkedIn and Meta | The fields you choose to submit, passed to us by the platform |
| Calls and messages | Phone number, call time and duration, messages you send |
| Free tools | The URL you scan, results, IP address, and email if you choose to receive the report |
| Website use | Pages viewed, referring site, campaign tags (UTM), device and browser data, approximate location from IP, cookie identifiers (see the Cookie Policy) |
| Client engagements | Contact details of your team, and any personal data inside the systems you give us access to (for example leads in your analytics or CRM), handled under the Data Processing Agreement |
| Job applications | See the Candidate Privacy Notice |
We do not ask for sensitive personal data (such as health, financial account or government ID numbers) through our website, and we ask you not to send it.
/03 Why we use it
| Purpose | Basis |
|---|---|
| Reply to your request and deliver the audit or service | Your request or our contract with you |
| Send the report from a free tool | Your request |
| Measure and improve the website and our ads | Your consent to analytics and advertising cookies, where required |
| Show you relevant ads (retargeting) | Your consent, where required |
| Send newsletters and event invitations | Your consent; unsubscribe at any time |
| Keep records for tax, accounting and legal claims | Legal obligation and legitimate interests |
| Protect the site and the tools from abuse | Legitimate interests |
/04 Who receives it
We share personal data only with service providers that help us run Mr.Ooi, each bound by contract to protect it: hosting and content delivery (Cloudflare), analytics and tag management (Google Analytics 4, Google Tag Manager), advertising platforms (Google Ads, Meta, LinkedIn) where you have consented, our CRM and email providers, and professional advisers. The current list, with locations, is on the Sub-processors page. We do not sell personal data.
/05 International transfers
Mr.Ooi works across India, Malaysia, the United States and Australia, and our providers operate in several countries. When personal data moves between countries, we use contractual protections and the safeguards each country's law requires. Country notices explain the local rules.
/06 How long we keep it
| Data | How long |
|---|---|
| Enquiries that do not become clients | 24 months after the last contact, then deleted |
| Client contact and project records | Length of the engagement plus 24 months; invoices and tax records for the period tax law requires |
| Free-tool scans | 90 days, unless you ask us to keep the report |
| Analytics data | 14 months (Google Analytics retention setting) |
| Consent records | As long as we rely on the consent, plus 3 years |
| Security and access logs | At least 1 year |
Full details are in the Data Retention and Deletion Schedule.
/07 Your rights
Depending on where you live, you can ask to access, correct, update, delete or receive a copy of your personal data, to withdraw consent, to object to or restrict some uses, and to opt out of marketing. Use the Privacy Request Form or write to privacy@mrooi.com. We reply within 30 days, or sooner where local law requires. You can also complain to your local regulator; country notices list them.
/08 Security
We protect personal data with access controls, multi-factor authentication, encryption in transit, least-privilege access to client systems and staff confidentiality obligations. See the Security Overview.
/09 Children
Our services are for businesses. We do not knowingly collect personal data from anyone under 18.
/10 Automated decisions and AI
We do not make decisions about individuals that have legal or similarly significant effects using automated processing alone. How we use AI in our tools and services is described in the AI Use Policy.
/11 Changes
We publish every change here with a new effective date and keep earlier versions in the Legal Archive. Material changes are emailed to clients.