Legal

Privacy Policy

Last Updated: 28 April 2025 · Effective: 28 April 2025

This policy applies to Sentosa Law, operating from Suite 5-2, Menara Mutiara Bangsar, Jalan Liku, 59100 Kuala Lumpur, Malaysia.

1. Introduction

Sentosa Law is committed to handling personal data responsibly. As a legal practice, we recognise that clients entrust us with sensitive information — about their finances, retirement arrangements, and family circumstances — and we take that responsibility seriously.

This Privacy Policy explains what personal data we collect, how we use it, the legal basis on which we process it, and the rights available to you under Malaysia's Personal Data Protection Act 2010 (PDPA). If you have questions about this policy, please contact us at [email protected].

2. Data We Collect

We collect personal data through the following means:

Contact forms on this website: name, email address, telephone number, and any message content you provide
Telephone and email enquiries: name, contact details, and the content of your enquiry
Client engagements: employment history, pension records, EPF contribution statements, identification documents, and any other information relevant to your matter
Analytics cookies (where consented): anonymised usage data such as pages visited and session duration

We do not collect sensitive personal data beyond what is directly necessary for the legal service you have engaged us for. Pension and retirement information shared with us is held under solicitor-client privilege.

Legal Basis for Processing

Contract performance: processing necessary to provide the legal service you have engaged
Consent: for marketing communications and analytics cookies
Legitimate interests: for general practice administration, follow-up on enquiries, and website security
Legal obligation: where Malaysian law requires us to retain or disclose information

Retention Periods

Client matter files: 7 years from closure of the matter (in accordance with the Limitation Act 1953 and Bar Council guidance)
General enquiry records: 2 years from the date of enquiry
Analytics data: no more than 26 months

3. How We Use Your Data

Personal data collected is used for the following purposes:

Responding to enquiries and scheduling consultations
Delivering the legal advisory service you have engaged us for
Drafting correspondence, legal documents, and written summaries on your behalf
Communicating updates about your matter
Sending administrative communications (invoices, appointment reminders)
Improving the functionality of this website (via anonymised analytics, where consented)
Complying with legal and regulatory obligations as a registered legal practice

We do not sell, rent, or share personal data with third parties for marketing purposes. We do not use personal data for automated decision-making.

Third-Party Disclosure

We may share data with: opposing parties or their solicitors (as necessary to conduct your matter), courts and regulatory authorities (where required by law or your instructions), professional indemnity insurers (on an aggregated or anonymised basis), and service providers used to administer the practice (such as document management systems), who are bound by confidentiality obligations.

4. Data Security

We implement reasonable technical and organisational measures to protect personal data, including:

Encrypted email communication for sensitive client documents
Password-protected client file systems with role-based access
Secure disposal of physical documents containing personal data
Regular review of access permissions

In the event of a data breach that is likely to result in risk to your rights and freedoms, we will notify you without undue delay and, where required, report to the relevant authority under the PDPA 2010.

5. Cookies

This website uses cookies. Essential cookies are required for basic site functionality and cannot be disabled. Analytics and preference cookies are optional and require your consent, which you can manage at any time via the cookie banner or our Cookie Policy page.

We do not use advertising or third-party tracking cookies.

6. Your Rights Under the PDPA 2010

As a data subject under Malaysian law, you have the following rights:

Right of access: to request a copy of personal data we hold about you
Right of correction: to request that inaccurate or incomplete data be corrected
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time (this does not affect the lawfulness of prior processing)
Right to cease processing: to request that we stop processing data in a manner that is causing or is likely to cause damage or distress
Right to prevent direct marketing: to opt out of any marketing communications

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days as required under the PDPA 2010. There is no charge for reasonable access requests.

If you believe we have not handled your data appropriately, you may lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP) at www.pdp.gov.my.

7. Third-Party Links

This website may contain links to external websites. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any site you visit through a link from ours.

8. Children's Privacy

Our services are directed at adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided personal data through this website, please contact us and we will remove it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be indicated by a revised "Last Updated" date at the top of this page. We encourage you to review this page periodically. Continued use of our website after changes are posted constitutes acceptance of the revised policy.

10. Contact — Data Enquiries

Data Controller: Sentosa Law

Address: Suite 5-2, Menara Mutiara Bangsar, Jalan Liku, 59100 Kuala Lumpur, Malaysia

Email: [email protected]

Telephone: +60 3-7846 5238

For general enquiries about our services, please use [email protected] or visit our contact page.