Privacy Policy

1. Who We Are

The data controller responsible for your personal data is:

2. Personal Data We Collect

We may collect the following categories of personal data when you use our website or contact us:

• Identity data: Your full name.
• Contact data: Email address, phone number, and postal address.
• Enquiry data: Details of your legal matter or question as provided in our contact form or by correspondence.
• Technical data: IP address, browser type, and usage data collected automatically when you visit our website.

We do not knowingly collect personal data from individuals under the age of 18 without verifiable parental consent.

3. How We Use Your Personal Data

We use your personal data only for the purposes for which it was collected, including:

• To respond to your enquiries and provide legal services;
• To communicate with you regarding your matter or engagement with the Firm;
• To comply with our professional and regulatory obligations under the Legal Profession Act 1976 and the Sabah Bar;
• To maintain our records and manage our business operations;
• To improve our website and services.

4. Legal Basis for Processing

We process your personal data on the following grounds under the PDPA 2010:

• Your consent, which you provide when you submit our contact form or correspond with us;
• Our contractual obligations, where processing is necessary to perform legal services you have engaged us for;
• Our legitimate interests in managing and operating the Firm, provided such interests are not overridden by your rights;
• Compliance with a legal obligation to which we are subject.

5. Disclosure to Third Parties

We do not sell, trade, or rent your personal data to third parties. We may share your personal data only in the following limited circumstances:

• Service providers who assist us in operating our website (including Web3Forms, which processes contact form submissions on our behalf) — such providers are bound by confidentiality obligations and are not permitted to use your data for their own purposes;
• Courts, tribunals, or regulatory bodies where disclosure is required by law;
• Professional advisors, co-counsel, or other parties strictly necessary for the conduct of your legal matter, with your consent;
• Successors to the Firm's business, in the event of a merger or transfer of practice.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law or professional rules. In general:

• Client files and correspondence are retained for a minimum of 7 years following the conclusion of a matter, in accordance with professional guidelines;
• Enquiry data from website visitors who did not become clients is retained for no longer than 12 months;
• Technical and analytical data is retained in anonymised form only.

7. Cookies

Our website may use essential cookies to ensure it functions correctly. We do not use cookies for advertising or tracking purposes. You may disable cookies through your browser settings, but doing so may affect certain website functionality.

8. Security of Your Personal Data

We take reasonable technical and organisational measures to protect your personal data from unauthorised access, use, disclosure, alteration, or destruction. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

If you have reason to believe that your interaction with us is no longer secure, please contact us immediately at jzlegalfirm@gmail.com.

9. Your Rights Under the PDPA

Under the Personal Data Protection Act 2010, you have the following rights in relation to your personal data:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to correction: You may request that we correct any inaccurate or incomplete personal data.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing prior to withdrawal.
• Right to limit processing: In certain circumstances, you may request that we restrict the processing of your personal data.

To exercise any of the above rights, please contact us in writing at the details in Section 1. We will respond within 21 days in accordance with the PDPA.

10. Links to External Websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites. We encourage you to review the privacy policies of any external sites you visit.

11. Changes to This Policy

We reserve the right to update this Privacy Policy from time to time to reflect changes in law, technology, or our practices. The date of the most recent revision is shown at the top of this page. Continued use of our website following any changes constitutes your acceptance of the updated policy.

12. Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy or our handling of your personal data, please contact us:

If you are not satisfied with our response, you may lodge a complaint with the Department of Personal Data Protection Malaysia at www.pdp.gov.my.