Privacy Policy

1. Introduction and scope

This policy applies to personal data processed by Chaiadvo Legal in the course of operating its legal practice from 16, Jalan SS 21/37, Damansara Utama, 47400 Petaling Jaya, Selangor, Malaysia. It applies to data provided through this website, by email, by telephone, and through formal engagement with the firm.

The firm operates in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia. Where our clients are located in other jurisdictions, we take reasonable steps to honour the data protection standards applicable in those jurisdictions.

2. What personal data we collect

Depending on how you interact with the firm, we may collect and hold the following categories of personal data:

• Name, contact details (email address, telephone number), and correspondence address
• The content of your communications with the firm
• Information about the legal matter you have asked the firm to consider
• Documents and materials you provide as part of an engagement
• Billing information where an engagement is formalised
• Website usage data collected via cookies (see Section 6 and the Cookie Policy)

The firm collects only what is necessary for the purpose at hand. We do not collect sensitive personal data unless it is directly relevant to the matter you have asked us to consider.

3. How and why we use personal data

We use personal data for the following purposes:

• Responding to enquiries: To consider and respond to initial enquiries submitted through the website or by email or telephone.
• Conducting engagements: To provide the legal services you have engaged the firm to provide, including preparing counsel letters, reviewing documents, and maintaining standing counsel arrangements.
• Administration: To maintain engagement records, issue invoices, and communicate about the progress of matters.
• Legal and regulatory compliance: To meet the firm's obligations under the Legal Profession Act 1976, the PDPA, and other applicable Malaysian law.

The legal basis for processing personal data is, depending on context: the performance of a contract or pre-contractual steps (for engagement-related processing); compliance with a legal obligation; or our legitimate interests as a legal practice in maintaining proper records of matters handled.

4. How long we keep personal data

The firm retains personal data for as long as is necessary for the purpose for which it was collected, taking into account our professional obligations and the possibility that a matter may need to be referred to in the future. As a general guide:

• Matter files are retained for a minimum of seven years following the close of an engagement, in accordance with standard legal practice requirements.
• Enquiries that did not proceed to engagement are retained for up to twelve months, then deleted.
• Website usage data is retained for periods determined by the relevant cookie settings (see the Cookie Policy).

5. Who we share personal data with

The firm does not disclose personal data to third parties except in the following circumstances:

• Where you have expressly authorised us to communicate with another party on your behalf
• Where we are required to do so by law or by a court or regulatory order
• Where we use third-party service providers to assist with the operation of the firm (for example, cloud storage or accounting software), and those providers are bound by appropriate data processing terms

The firm does not sell personal data to third parties.

6. Cookies and website analytics

This website uses cookies as described in the Cookie Policy. If you have questions about specific cookies used on this site, please refer to that policy or write to us at [email protected].

7. Data protection measures

The firm takes reasonable technical and organisational measures to protect personal data against accidental or unlawful loss, alteration, or unauthorised disclosure. These include:

• Restricted access to matter files on a need-to-know basis within the firm
• Encrypted email for sensitive communications where practicable
• Password-protected document storage with controlled access
• Regular review of data held and deletion of data no longer required

Where a personal data breach occurs that is likely to result in harm to individuals, the firm will take appropriate steps in accordance with its obligations under the PDPA.

8. Your rights under the PDPA

Under Malaysia's Personal Data Protection Act 2010, you have the following rights in relation to personal data held about you:

• Right of access: To request a copy of the personal data we hold about you.
• Right to correction: To request correction of personal data that is inaccurate, incomplete, or misleading.
• Right to withdraw consent: Where processing is based on consent, to withdraw that consent at any time.
• Right to limit processing: To request that we limit the processing of your personal data in certain circumstances.
• Right to enquire: To enquire about the firm's policies and practices regarding personal data.

To exercise any of these rights, please write to [email protected]. We will respond within the period required by the PDPA.

9. Third-party links

This website may contain links to external sites. The firm is not responsible for the privacy practices of those sites. We encourage you to read the privacy policies of any external site you visit.

10. Children

The firm's services are directed at persons aged 18 and above. We do not knowingly collect personal data from minors. If you believe personal data relating to a minor has been provided to the firm, please contact us promptly so that we can address the matter.

11. Changes to this policy

The firm may update this policy from time to time to reflect changes in law or in the firm's practices. Material changes will be noted with a revised "Last updated" date at the top of this page. Continued use of this website following any change constitutes acceptance of the revised policy.

12. Contact

For any questions or concerns about this policy, or to exercise your rights under the PDPA, please contact: