Privacy Policy

1. Introduction

Naungan Law ("we", "us", "our") is committed to handling the personal information of our clients, website visitors, and enquirers with care and in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA). This Privacy Policy explains what personal data we collect, how we use it, and the rights available to you.

If you have questions about this policy or wish to exercise any of your rights, please contact us at [email protected].

2. Data We Collect

We may collect the following categories of personal data:

• Identity data: full name, MyKad number or passport number where relevant to your matter
• Contact data: email address, telephone number, postal address
• Matter data: documents, employment records, pension statements, and correspondence you share with us in connection with a legal matter
• Usage data: information about how you interact with our website (pages visited, duration, referring URL), collected via cookies and analytics tools
• Communication data: records of communications between you and our firm

3. How We Collect Your Data

We collect personal data through the following means:

• Contact forms and enquiry submissions on our website
• Telephone conversations and email exchanges
• Documents provided by you in the course of a legal engagement
• Cookies and website analytics tools (with your consent where required)
• Referrals from third parties such as accountants or other legal practitioners

4. Legal Basis for Processing

We process personal data on the following bases:

• Contract: where processing is necessary to provide the legal services you have engaged us for
• Consent: where you have given explicit consent, including for optional cookies and marketing communications
• Legitimate interests: for purposes such as improving our website and maintaining records of our professional practice
• Legal obligation: where we are required to process data to comply with applicable law, including Bar Council obligations

5. How We Use Your Data

• To respond to enquiries and provide legal advice and representation
• To manage your matter file and maintain engagement records
• To communicate with relevant authorities on your behalf (only with your authorisation)
• To issue invoices and manage fee-related communications
• To comply with our obligations under the Legal Profession Act 1976 and other applicable legislation
• To improve our website and understand how visitors engage with our content

6. Data Retention

We retain matter files for a period of seven years following the conclusion of an engagement, in accordance with professional practice standards. Website usage data collected through analytics is retained for no longer than 26 months. Contact data from enquiries that did not result in an engagement is retained for 12 months.

7. Data Sharing

We do not sell or rent personal data to third parties. We may share personal data in the following circumstances:

• With government departments, EPF, or other authorities, where doing so is necessary to carry out your instructions
• With professional advisers such as accountants, where relevant to your matter and with your knowledge
• With our website analytics provider (currently Google Analytics), subject to their privacy terms and your cookie consent
• Where required by law or a court order

8. Data Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Matter files are stored on secure systems with access restricted to practitioners working on your matter. External communications containing sensitive data are sent using encrypted email where practicable.

9. Cookies

Our website uses cookies to function and to understand how it is used. Essential cookies cannot be disabled as they are necessary for the site to operate. Optional cookies — including analytics and preference cookies — are only placed with your consent. Please see our Cookie Policy for full details.

10. Your Rights Under PDPA

Under the Personal Data Protection Act 2010, you have the right to:

• Request access to the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Withdraw consent where processing is based on consent
• Request that we cease processing data for direct marketing purposes
• Lodge a complaint with the Personal Data Protection Commissioner

To exercise any of these rights, please write to us at [email protected]. We will respond within 21 days.

11. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies independently.

12. Children's Privacy

Our services are intended for persons aged 18 and above. We do not knowingly collect personal data from minors. If you believe we have inadvertently received data from a person under 18, please contact us so we can take appropriate action.

13. Changes to This Policy

We may update this policy from time to time. Material changes will be notified via a notice on our website. Continued use of our services following an update constitutes acceptance of the revised policy.

14. Contact

Data controller: Naungan Law
Level 14, Menara Bangkok Bank, 105 Jalan Ampang, 50450 Kuala Lumpur
Email: [email protected]
Tel: +60 3-2783 6491