Privacy Policy

1. Who We Are

Naungan is a legal practice based at Persiaran Bukit Utama 15, 47800 Petaling Jaya, Selangor, Malaysia, providing pension-related legal services to individuals and families. We are the data controller for personal data collected through this website and through our client engagements.

For data protection enquiries, contact us at [email protected].

2. Personal Data We Collect

We may collect the following personal data when you use our website or engage our services:

• Full name and contact details (email address, phone number)
• Postal address, if relevant to your matter
• Information submitted through our enquiry form, including your message
• Technical data such as browser type, IP address, and pages visited (via cookies and analytics tools)
• In the course of legal service delivery: identity documents, pension statements, employment records, and other documents you provide to us

We collect data directly from you (through forms, calls, and correspondence) and, where you have authorised it, from third parties such as employers, pension fund administrators, or family members acting on your behalf.

3. Legal Basis for Processing

We process your personal data on the following grounds under the PDPA 2010 and applicable principles:

• Contract: Processing is necessary to deliver the legal services you have requested.
• Consent: Where you have given us consent, for example by submitting the enquiry form or accepting cookies.
• Legitimate interests: For website security, analytics, and improving our services, where our interests do not override your rights.
• Legal obligation: Where processing is required to comply with our professional duties or applicable law.

4. How We Use Your Data

• To respond to your enquiries and arrange consultations
• To deliver the legal services you have engaged us for
• To prepare and file documents on your behalf
• To send updates and correspondence related to your matter
• To conduct scheduled reviews under ongoing service arrangements
• To improve our website and services using anonymised analytics data
• To comply with our professional and legal obligations

We do not use your personal data for unsolicited marketing. If you enquire and we do not hear from you further, we will not continue to contact you without your consent.

5. Data Retention

We retain client files and related personal data for a minimum of seven years following the conclusion of a matter, in line with professional obligations and the applicable limitation period under Malaysian law. Website enquiry data where no engagement follows is deleted within twelve months. Analytics data is retained in anonymised form.

6. Data Sharing

We do not sell your personal data. We may share it in the following limited circumstances:

• With regulatory bodies, pension fund administrators, or courts, where required to conduct your legal matter
• With third-party service providers who support our operations (such as secure document storage or email hosting) under data processing agreements
• Where required by law or court order
• With family members you have specifically authorised us to include in your matter

7. Data Protection Measures

We take reasonable technical and organisational steps to protect your data:

• Secure document storage with access restricted to authorised personnel
• Encrypted email communication for sensitive documents
• Password-protected systems with regular access reviews
• Staff training on data protection obligations
• A documented procedure for responding to data incidents

If a data incident occurs that is likely to affect your rights, we will notify you and the relevant authority within the timeframe required by law.

8. Cookies

Our website uses cookies to improve your experience and to understand how the site is used. You can manage your cookie preferences at any time. For full details, see our Cookie Policy.

9. Your Rights

Under the PDPA 2010 and applicable data protection principles, you have the following rights in relation to your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Ask us to correct inaccurate or incomplete data.
• Withdrawal of consent: Withdraw consent at any time where processing is based on consent, without affecting prior processing.
• Objection: Object to processing carried out on the basis of legitimate interests.
• Restriction: Request that we limit how we process your data in certain circumstances.
• Complaint: Lodge a complaint with the Personal Data Protection Commissioner of Malaysia.

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days. Some rights may be limited by our professional legal obligations.

10. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites and recommend you review their policies before submitting personal data.

11. Children

Our services are intended for individuals aged 18 and over. We do not knowingly collect personal data from minors. If you believe a minor has submitted data through our website, please contact us so we can remove it.

12. Changes to This Policy

We may update this policy from time to time. Where changes are material, we will note the updated date at the top of this page. Continued use of our website following an update constitutes acceptance of the revised policy.

13. Contact

For any questions about this policy or your personal data:

• Email: [email protected]
• Post: Naungan, Persiaran Bukit Utama 15, 47800 Petaling Jaya, Selangor, Malaysia