Privacy Policy

1. Who We Are

The data controller for the personal information you provide is:

2. Personal Data We Collect

We collect personal data only when you voluntarily provide it to us or when it arises from your use of our website. The categories of data we may collect include:

• Identity information — your name (first name and, where provided, family name)
• Contact information — email address and telephone number
• Enquiry content — the message or description of your situation you share via our contact form
• Technical data — IP address, browser type, device type, and pages visited, collected via cookies and analytics tools
• Matter-related information — personal details relevant to your legal matter, shared in the course of our engagement

Legal basis for processing: We process your data based on your consent (where given), the performance of a contract for legal services, and our legitimate interests in operating a professional legal practice. Matter-related information shared in the context of legal advice is also protected by legal professional privilege.

Retention: Contact enquiry data is retained for up to 12 months unless an engagement begins, in which case matter files are retained for a minimum of 7 years in compliance with professional obligations under Malaysian Bar Council guidelines. Analytics data is retained for no longer than 26 months.

3. How We Use Your Personal Data

We use the personal data you provide for the following purposes:

• To respond to your enquiry and, where appropriate, arrange a consultation
• To provide the legal services you have engaged us for
• To communicate with you about your matter, including updates and requests for information
• To comply with our legal and professional obligations, including record-keeping requirements
• To improve our website and understand how visitors use it (using anonymised analytics data)

We do not use your personal data for marketing purposes unless you have expressly consented. We do not sell or rent your personal data to any third party.

4. Sharing of Personal Data

We do not share your personal data with third parties except in the following limited circumstances:

• Service providers: Trusted technology providers who assist with website hosting and analytics, under contractual data protection obligations
• Legal requirements: Where we are required by law, court order, or regulatory authority to disclose information
• With your consent: To other parties only where you have specifically authorised us to do so in connection with your matter

5. Data Protection Measures

We take reasonable and appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include:

• Secure HTTPS encryption for all data transmitted via our website
• Restricted access to personal data on a need-to-know basis within our practice
• Secure physical and electronic storage of client files and correspondence
• Regular review of our data handling practices

In the event of a personal data breach that is likely to cause harm, we will notify the affected individuals and the relevant authorities as required under Malaysian law.

6. Cookies

Our website uses cookies to function properly and to help us understand how it is used. These include essential cookies (required for the site to work) and optional analytics cookies (to measure visitor activity in anonymised form).

You can manage your cookie preferences at any time. Please see our Cookie Policy for full details.

7. Your Rights Under the PDPA

Under Malaysia's Personal Data Protection Act 2010, you have the following rights in respect of your personal data:

• Right of access — to request a copy of the personal data we hold about you
• Right of correction — to request correction of inaccurate or incomplete personal data
• Right to withdraw consent — to withdraw any consent you have given to processing, where processing is based on consent
• Right to prevent processing likely to cause damage or distress — to request that we cease or restrict processing in defined circumstances
• Right to prevent processing for direct marketing — to opt out of any marketing communications at any time

To exercise any of these rights, please contact us at [email protected]. We will respond within 21 days. Note that some rights may be limited where processing is necessary to fulfil our legal and professional obligations.

If you are dissatisfied with how we handle your personal data, you may lodge a complaint with the Personal Data Protection Commissioner of Malaysia, the supervisory authority responsible for data protection in this jurisdiction.

8. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies before providing any personal information.

9. Children's Privacy

Our services are intended for adults aged 18 and above. We do not knowingly collect personal data directly from individuals under 18. If you believe we have inadvertently received personal data from a minor, please contact us at [email protected] and we will take appropriate steps to remove it.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we do, we will revise the "Last Updated" date at the top of this page. Where changes are material, we will take reasonable steps to bring them to your attention. Continued use of our website following any update constitutes acceptance of the revised policy.