Privacy notice
- Effective
- Version
- 1.1
- Last updated
Contents
This notice explains how personal data is handled when you visit this website or contact us through it, including from Malaysia. It covers this website only.
We have kept it short and specific. If anything is unclear, ask us using the contact details in section 1.
Who is responsible
The controller of the personal data described in this notice is LAAP Group, the company behind FromNine, with its registered office at Opgeëistenlaan 2, 9000 Gent, Belgium, and enterprise number 0440.481.750.
For any question or request about your personal data, write to contact@fromnine.com. Mentioning “privacy” in the subject line helps us pass your message to the right person quickly.
Malaysian law. The Personal Data Protection Act 2010 (Act 709), as amended by the Personal Data Protection (Amendment) Act 2024 (Act A1727), applies to the processing of personal data in respect of commercial transactions (section 2(1)) by a person established in Malaysia, or by a person not established in Malaysia that uses equipment in Malaysia to process personal data other than for transit (section 2(2)); such a person nominates a representative in Malaysia (section 2(3)). To the extent the PDPA applies to the processing described here, we act as data controller, the term the Act has used since 1 April 2025, and this notice gives the information section 7(1) requires: the data we process and its source, the purposes, the classes of third parties who receive it, your choices, whether supplying data is obligatory, your rights of access and correction, and how to contact us with enquiries or complaints.
Section 7(3) of the PDPA requires such a notice to be “in the national and English languages”. This is the English version; a Malay version of this notice is published on the Malay edition of this website for Malaysia.
- Company name
- LAAP Group
- Registered office
- Opgeëistenlaan 2, 9000 Gent
- contact@fromnine.com
What we process, why, and on what basis
We process personal data in three situations. For each, we list the data, the purpose, the legal basis under the General Data Protection Regulation (GDPR) and how long we keep it.
We collect this data from you directly, or from your browser when it requests a page. Supplying it is voluntary: you can read the website without giving us any personal data. To answer an enquiry we need your name, your email address and your message; without them we cannot reply.
When you visit the website
To deliver pages and keep the website secure, our hosting provider processes technical data each time your browser requests a page: IP address, date and time, the requested address, browser and operating system details, the referring page and the response status.
Purpose: delivering the website, detecting and preventing abuse, and fixing faults. Legal basis: our legitimate interest in operating a secure, working website (Article 6(1)(f) GDPR). Retention: server logs are deleted after no more than 30 days, unless they are needed to investigate a specific security incident.
We do not use analytics, advertising or social media tracking on this website. If that changes, we will update this notice first and ask for your consent where the law requires it.
When you contact us
If you use the contact form, we process your name, your email address, your organisation if you give it, the topic you choose if you choose one, your message and the language version of the website you used.
Purpose: answering your enquiry and, if you wish, continuing the conversation about a project. Legal basis: steps taken at your request before a possible contract (Article 6(1)(b) GDPR), and otherwise our legitimate interest in replying to messages sent to us (Article 6(1)(f) GDPR). Retention: we delete enquiries 12 months after our last contact with you, unless they lead to a business relationship, in which case the retention rules of that relationship apply.
Your message is delivered to our team by email. The website does not store it in a database. Our operational logs record only a reference number and whether delivery succeeded, never your name, email address or message.
To protect the form against abuse, we use a hidden spam check and limit the number of messages per sender. For that limit, your IP address and email address are converted into one-way hashed values that are kept in memory for at most 24 hours and then discarded.
Preferences stored in your browser
The website remembers your choice of theme and your animation setting in your browser, and your language and region if you use the switcher. The theme and animation choices stay on your device. The details are in the cookie policy.
Who receives your data
We share personal data only with service providers that process it on our behalf and under our instructions, bound by a data processing agreement: our hosting provider, which delivers the website and keeps the server logs; our email delivery provider, which delivers contact form messages to our team; and our email and collaboration platform, where our team reads and answers your message. These are the classes of third parties to whom your data may be disclosed.
Within FromNine, an enquiry may be passed to the colleagues or the office best placed to answer it, based on our legitimate interest in handling your request properly. FromNine has offices in Antwerp, Ghent, Amsterdam and Cyberjaya (Malaysia); the next section explains how access from outside the European Economic Area is safeguarded.
We do not sell personal data and do not share it for advertising.
Transfers outside the European Economic Area
We aim to process personal data within the European Economic Area (EEA). FromNine also has an office in Cyberjaya, Malaysia, which is outside the EEA. Where colleagues there, or a service provider outside the EEA, have access to personal data, we make sure that this access is covered by appropriate safeguards under Article 46 GDPR, in particular the Standard Contractual Clauses adopted by the European Commission, with additional measures where needed. The European Commission has not adopted an adequacy decision for Malaysia, so access from Cyberjaya relies on these safeguards. For other countries, where the Commission has adopted an adequacy decision, we may rely on that decision instead.
For information: the Personal Data Protection Commissioner’s Cross Border Personal Data Transfer Guidelines of 29 April 2025 accept the EU GDPR Standard Contractual Clauses as one of the contract models for transfers of personal data out of Malaysia under section 129 of the PDPA.
You can ask for a copy of the relevant safeguards by writing to contact@fromnine.com.
How we protect your data
FromNine operates an information security management system certified to ISO/IEC 27001. Access to enquiries is limited to the people who need it to answer you, and data is encrypted in transit between your browser, our website and our mail systems.
If a personal data breach occurs, we notify the supervisory authority and the people affected as the GDPR requires. Where the PDPA applies, we also notify the Personal Data Protection Commissioner as soon as practicable and inform the people affected where the breach causes or is likely to cause them significant harm (section 12B of the PDPA).
Your rights
You can ask us for access to your personal data and for its rectification or erasure, or ask us to restrict its processing. You can object to processing that is based on our legitimate interests, and you have the right to data portability where processing is based on steps towards a contract. These rights are set out in Articles 15 to 21 of the GDPR.
To the extent the PDPA applies, you can also ask for access to and correction of your personal data under that Act, and ask us, by written notice sent by electronic means, to transmit your data to another data controller (data portability, section 43A), subject to technical feasibility and the compatibility of data formats.
To use a right, write to contact@fromnine.com. We reply within one month. For complex requests this can be extended by two further months; we will tell you if that happens and why. We may ask you to confirm your identity first.
We do not use automated decision-making or profiling that produces legal or similarly significant effects for you.
Changes to this notice
We update this notice when our processing changes. The version and dates at the top of the page show which version you are reading. We announce significant changes on this page.
Questions about this page?Contact us