Privacy Policy

1. Introduction

Payung Seri ("we", "our", "us") is a legal practice based at 22 Jalan Padungan, 93100 Kuching, Sarawak, Malaysia. We provide legal services relating to pension matters in Malaysia. This Privacy Policy explains how we collect, use, store and protect personal data that you provide to us in connection with those services.

We are committed to handling your information with care. All personal data is processed in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA 2010) and, where applicable, the standards set by the Malaysian Bar Council.

If you have questions about this policy or the way we handle your data, contact us at [email protected].

2. Data We Collect

2.1 Information You Provide Directly

When you contact us, complete a form on our website or instruct us to act on your behalf, we may collect:

• Full name
• Email address
• Telephone number (if provided)
• Postal address
• Details of your pension matter, including employment history, scheme details and correspondence
• Financial information necessary for billing and fee arrangements
• Family relationships, where relevant to a dependant's pension entitlement

2.2 Information Collected Automatically

Our website may collect certain technical data automatically, including IP address, browser type, pages visited and time spent on the site. This is used for security monitoring and service improvement, not for profiling individual users.

2.3 Legal Basis for Processing

We process personal data on the following bases:

• Performance of a contract: To provide the legal services you have requested.
• Legitimate interests: To manage our practice, improve our services and communicate with you about your matter.
• Legal obligation: To comply with requirements under the Legal Profession Act 1976 and other applicable legislation.
• Consent: For optional marketing communications, where you have opted in.

2.4 Retention Periods

We retain client files for a minimum of seven years from the conclusion of a matter, in accordance with standard professional practice in Malaysia. Correspondence and other documents associated with your matter are retained for the same period unless you request earlier deletion and there is no legal obligation to retain them.

3. How We Use Your Data

We use the personal data you provide for the following purposes:

• Responding to initial enquiries and scheduling consultations
• Providing legal advice and handling your pension matter
• Preparing written opinions, submissions and correspondence on your behalf
• Billing and processing payment for our services
• Communicating updates about your matter
• Maintaining records of our professional work as required by law and professional regulations
• Improving the quality and accessibility of our services

We do not sell your personal data to third parties. We do not use your data for automated decision-making that produces legal or similarly significant effects.

3.1 Data Sharing

We may share your personal data with third parties in the following circumstances:

• Counterparties and authorities: When necessary to conduct your matter, including scheme administrators, former employers, relevant government departments and courts or tribunals.
• Counsel and experts: If we engage a barrister or expert witness on your behalf, we share relevant information with them under professional obligations of confidentiality.
• Service providers: Including secure document storage providers and IT support, under appropriate data processing agreements.
• Legal requirements: Where required by law, court order or regulatory authority.

4. Data Protection Measures

We take reasonable and appropriate technical and organisational steps to protect your personal data from unauthorised access, disclosure, alteration or destruction. These include:

• Encryption of electronic communications and stored data
• Password-protected access to client file systems with role-based permissions
• Secure physical storage for paper files held at our office
• Regular review of access controls
• Staff training on data protection obligations

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and, where required, the relevant authority, within the timeframe prescribed by law.

5. Cookies

Our website uses cookies to support basic functionality and to understand how visitors use the site. Essential cookies cannot be disabled as they are necessary for the site to operate. Optional cookies (analytics and preferences) are set only with your consent, managed through the cookie banner on our homepage.

For full details, see our Cookie Policy.

6. Your Rights

Under the Personal Data Protection Act 2010 and general principles of Malaysian law, you have the following rights in relation to your personal data:

• Right of access: You may request a copy of the personal data we hold about you.
• Right of correction: You may ask us to correct inaccurate or incomplete data.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Right to limit processing: In certain circumstances, you may ask us to restrict how we use your data.
• Right to object: Where processing is based on legitimate interests, you may object, and we will assess whether our interests override yours.

To exercise any of these rights, contact us at [email protected]. We will respond within thirty days of receiving a valid request.

If you are not satisfied with how we handle your personal data, you may lodge a complaint with the Personal Data Protection Department (PDPD) of Malaysia, which is the competent supervisory authority under the PDPA 2010.

7. Third-Party Links

Our website may contain links to external websites, including government portals and regulatory bodies. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies before submitting any personal data to them.

8. Children's Privacy

Our services are directed at adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If you believe we have inadvertently collected data from a minor, please contact us at [email protected] and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. The updated policy will be posted on our website with a revised "Last Updated" date. We encourage you to check this page periodically. Continued use of our website or services after any update constitutes acceptance of the revised policy.

10. Contact

For any data protection enquiries, to exercise your rights, or to raise a concern about how we handle your personal data, contact us at: