Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

2. Personal Data We Collect

Depending on how you engage with us, we may collect the following categories of personal information:

• Identity data — full name, NRIC/passport number where required for legal representation
• Contact data — email address, telephone number, postal address
• Matter data — details of your legal query, case facts and relevant documentation you provide
• Financial data — billing address and payment records (processed through secure third-party channels)
• Technical data — IP address, browser type, pages visited, collected via cookies and analytics tools
• Communications data — records of correspondence, meeting notes, and instructions given to our firm

We collect this information through our website contact form, telephone enquiries, in-person consultations, and written correspondence. We do not knowingly collect sensitive personal data (such as health or financial records) unless it is directly relevant to a matter you have instructed us to handle.

3. Legal Basis for Processing

Under the PDPA 2010, we process your personal data on the following grounds:

• Consent — where you have expressly consented, for example by submitting our contact form
• Contractual necessity — to perform our legal services engagement with you
• Legal obligation — to comply with Malaysian Bar Council rules, anti-money laundering requirements, and court orders
• Legitimate interest — to manage our firm's operations, improve our services, and maintain client records within lawful retention periods

4. How We Use Your Personal Data

We use the personal data we collect for the following purposes:

• To respond to your enquiries and provide initial consultations
• To carry out the legal services you instruct us to perform
• To prepare and file court documents, agreements, or regulatory submissions
• To issue invoices and process payments
• To comply with professional and regulatory obligations under Malaysian Bar Council rules
• To conduct conflict-of-interest checks prior to engagement
• To improve our website and communications based on aggregate usage data
• To send you relevant legal updates or firm announcements, where you have consented to receive these

We will not use your personal data for automated decision-making that produces legal or significant effects without your knowledge.

5. Sharing and Disclosure

Insaf Partners does not sell or rent personal data. We may share information in the following circumstances:

• Opposing parties and courts — as necessary in the conduct of litigation or other legal proceedings
• Professional advisers — such as barristers, expert witnesses, or co-counsel engaged on your matter
• Regulatory authorities — including the Malaysian Bar Council, Bank Negara Malaysia, and MACC where disclosure is required by law
• Service providers — IT infrastructure, document management, and accounting service providers who process data on our behalf under strict confidentiality terms
• Analytics providers — aggregate, anonymised traffic data shared with tools such as Google Analytics

Any third-party processor engaged by us is required to maintain appropriate technical and organisational safeguards consistent with the PDPA 2010.

6. Data Retention

We retain personal data for as long as necessary to fulfil the purposes described above, and in accordance with our professional obligations:

• Matter files — retained for a minimum of 7 years after matter closure, in line with limitation periods under Malaysian law
• Financial records — retained for 7 years as required under the Income Tax Act 1967 and Companies Act 2016
• Website enquiry data — retained for 12 months from initial contact if no engagement follows
• Marketing consent records — retained until consent is withdrawn

After the applicable retention period, data is securely destroyed or anonymised.

7. Data Protection & Security

We take reasonable precautions to protect your data from unauthorised access, loss, alteration or disclosure. Our measures include:

• TLS/SSL encryption for data transmitted via our website
• Access controls limiting personal data to authorised personnel
• Secure physical storage of physical client files within our Kuala Lumpur office
• Regular review of our data handling procedures
• Prompt notification to affected individuals and the relevant authorities in the event of a data breach, in accordance with PDPA obligations

8. Cookies

Our website uses cookies to support essential functionality, understand visitor behaviour, and improve our online presence. You may manage your cookie preferences at any time through our Cookie Policy page. Essential cookies are required for the site to function and cannot be disabled; all other categories are optional and subject to your consent.

9. Your Rights

Under the Personal Data Protection Act 2010, you have the following rights in respect of your personal data held by Insaf Partners:

• Right of access — to request a copy of the personal data we hold about you
• Right of correction — to request that inaccurate or incomplete data be corrected
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing
• Right to limit processing — to request that we restrict the use of your data in certain circumstances
• Right to lodge a complaint — with the Personal Data Protection Department (JPDP) of Malaysia if you believe your rights have been infringed

To exercise any of these rights, please write to us at [email protected]. We will respond within 21 days of receiving a valid request. We may need to verify your identity before fulfilling the request.

10. Third-Party Links

Our website may contain links to external resources such as court portals, regulatory bodies, or news sources. Insaf Partners is not responsible for the privacy practices of those third-party sites. We encourage you to review their respective privacy policies before providing any personal information.

11. Children's Privacy

Our services are directed at adults aged 18 and above. We do not knowingly collect personal data from individuals under 18 without appropriate parental or guardian consent. If you believe a minor has provided us with personal data without such consent, please contact us promptly so we may take appropriate action.

12. Updates to This Policy

We may revise this Privacy Policy periodically to reflect changes in law, our operations, or best practice. Any material changes will be communicated by updating the "Last Updated" date at the top of this page. We encourage you to review this page from time to time. Continued use of our website or services after any update constitutes acceptance of the revised policy.