Last reviewed October 2026
How we handle your information
What this website collects, why we collect it, how long we keep it, and how to have it removed.
What this notice covers
This notice explains how Malaysian Social Research Institute (657776-U, 200401019273) handles personal information collected through this website. It complements, and does not replace, the Institute’s general confidentiality practices.
MSRI ensures that information which is confidential, privileged or non-public is not disclosed inappropriately, and respects the privacy rights of all individuals in the performance of its duties.
What we collect
- Contact, partnership and volunteer forms: your name, email address, and any organisation, phone number, location, message, budget indication or skills information you choose to provide.
- Technical information recorded with a form submission: the IP address and browser user-agent string the request came from, used only to detect and investigate spam and abuse.
- For the administrative dashboard: the email address, name and a securely hashed password of MSRI staff accounts, plus a record of which staff member made which change.
Cookies, and your choice about them
By default this site sets no cookies at all. We do not run advertising, we do not embed social tracking pixels, and we do not share data with advertising networks.
On your first visit we ask whether we may measure how the site is used. If you agree, we load Google Analytics with IP anonymisation and advertising features switched off. If you decline, no analytics code is loaded and no analytics cookie is set — the site works identically either way.
The only other cookie is the encrypted session cookie for MSRI staff signing in to the administrative dashboard. It is not set for ordinary visitors.
Why we collect it
We use the information you provide to respond to your enquiry, handle a donation or partnership approach, process a volunteer application, maintain our records, and meet our governance and legal obligations.
We do not sell your information, and we do not share it with third parties for their own marketing purposes.
How long we keep it
Enquiry and application records are kept for as long as needed to handle them and to maintain the Institute’s records of its relationships and correspondence. Donation records are kept for as long as tax and accounting requirements demand.
You can ask us to delete your enquiry or application at any time. Where we are obliged to retain a record — for example for tax purposes — we will tell you that rather than refuse without explanation.
Your rights
You may ask us what personal information we hold about you, ask for a copy, ask us to correct it, or ask us to delete it. You may also withdraw consent for us to contact you.
Write to admin@msri.org.my and we will respond.
How we protect it
- The site is served over HTTPS, and security headers are applied to every response.
- Staff passwords are stored only as salted scrypt hashes. Passwords are never stored or transmitted in a form we can read.
- Administrative sessions use a random token in an HTTP-only, SameSite cookie, and can be revoked immediately.
- Uploads to the media library are restricted by file type and size, and are checked before being accepted.
- Access to the administrative dashboard is limited by role, and every change made there is recorded.
Analytics, and how to change your mind
Analytics is opt-in. Nothing is measured until you accept the prompt, and declining is a complete answer — we do not ask again on every page.
When analytics is enabled, Google Analytics records the pages you visit, roughly how long you stay, the site you arrived from, and coarse location derived from your IP address after that address has been anonymised. We use this only to understand which content is useful. It is never used for advertising, and we do not attempt to identify individual visitors.
Your choice is stored in your browser’s local storage, not in a cookie, so declining genuinely sets nothing. To change your mind, clear this site’s data in your browser settings; you will be asked again on your next visit.
Beneficiary privacy
MSRI works with people who are displaced and often vulnerable. This site is written so that no individual beneficiary can be identified from it.
- Photographs are not captioned with names, and alt text describes the scene rather than the people in it.
- We do not publish beneficiary stories, quotations or case studies without documented informed consent.
- Programme figures are reported as aggregate counts only, with the reporting period shown.
A note on the photographs used here
The photography on this site is drawn from images MSRI already publishes publicly. It shows programme activity rather than individual casework. If you are a beneficiary, a family member, or an MSRI staff member and you would like an image removed, contact us and we will act on it.Changes to this notice
When this notice changes materially, the reviewed date at the top of the page changes with it. The date this site was built is shown on the accessibility page.
Questions about this page? Email admin@msri.org.my.