Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

• Firm name: Rajpal, Firah & Vishnu (Advocates & Solicitors, Malaysia)
• Petaling Jaya office: Unit 1039, Millennium Square PJ, Jalan 14/1, 46100 Petaling Jaya, Selangor, Malaysia  ·  Tel: +60 3-7960 1115
• Batu Caves office: No. 42-1A, First Floor, Jalan Medan Batu Caves 1, 68100 Batu Caves, Selangor, Malaysia  ·  Tel: +60 3-6186 8652, +60 12-261 5635
• Privacy enquiries: rajpal.associates@gmail.com

2. Personal Data We Collect

When you use our website, message us on WhatsApp, or contact us by telephone or email, we may collect the following personal data:

• Full name and WhatsApp display name
• Telephone or WhatsApp number
• Email address (if you provide one)
• Nature of your legal enquiry (e.g. criminal law, civil litigation, corporate advisory, conveyancing, probate, or other)
• The content of your WhatsApp messages, including any comments, documents, images, or voice notes you choose to send
• The date and time of your enquiry

Sensitive personal data. If your enquiry relates to a criminal charge, police investigation, prior conviction, or similar matter, information you provide may constitute sensitive personal data under the PDPA. Processing such data requires your explicit consent — a clear and affirmative act beyond ordinary consent. By sending us a WhatsApp message (or otherwise contacting us) that includes such information, you give that explicit consent for us to process sensitive personal data you voluntarily include in your enquiry.

We do not require you to send your identity card (IC) or passport number by WhatsApp or email. Please do not include such identifiers unless we specifically request them after an engagement is confirmed.

3. Purpose of Collection

We collect and process your personal data for the following purposes:

• To assess and respond to your legal enquiry
• To schedule and conduct a consultation
• To communicate with you about your matter using your preferred contact method
• To determine whether we can act for you and, if so, to prepare for engagement
• To comply with applicable legal and professional obligations

4. Legal Basis and Consent

We process your personal data on the following bases under the PDPA:

• Consent: You provide consent by contacting us voluntarily — for example by tapping our WhatsApp link, sending us a message, calling, or emailing — and by continuing the conversation. Starting that contact means you agree to the processing of your data as described in this Privacy Policy.
• Explicit consent: Where you disclose sensitive personal data (such as criminal-matter details) in a WhatsApp message or other communication, sending that information constitutes your explicit consent for that processing.
• Legal obligation: We may retain certain records where required by law or the rules of the Malaysian Bar and the legal profession.

You may withdraw your consent at any time by contacting us at rajpal.associates@gmail.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and we may still need to retain certain data where required by law or professional rules.

5. Third-Party Processors and Cross-Border Transfers

WhatsApp contact on this website is provided through WhatsApp LLC (a Meta Platforms company). When you message us, your communications are transmitted and stored using WhatsApp’s systems, which may be located outside Malaysia.

WhatsApp acts as a service provider in respect of those messages. We rely on WhatsApp’s contractual and technical safeguards for cross-border personal data transfers, consistent with the Personal Data Protection (Cross-Border Transfer of Personal Data) Guidelines. For details on how WhatsApp handles data, see WhatsApp’s Privacy Policy and WhatsApp’s Terms of Service.

Our website also uses the following third-party services that may process limited technical data (such as your IP address or browser type):

• Google Fonts — for typography
• Google Maps — embedded maps on our contact page

We do not use third-party advertising trackers, analytics cookies, or social-media pixels on this website at the time of publication.

6. Retention Period

We retain enquiry data for as long as reasonably necessary to respond to your enquiry and, if you become a client, for the duration of the retainer and any applicable limitation or record-keeping period under Malaysian law and professional rules.

Enquiry data that does not result in an engagement is generally retained for up to two (2) years from the date of your WhatsApp message or other enquiry, after which it is securely deleted or anonymised unless a longer period is required by law or a legitimate professional need.

Where we are required to maintain internal records of personal data breaches, such records are kept for at least two (2) years as required under the PDPA, separate from your enquiry file.

7. Your Rights as a Data Subject

Under the PDPA (including 2024 amendments), you have the right to:

• Access your personal data held by us
• Correct inaccurate or incomplete personal data
• Withdraw consent to processing (subject to legal and professional retention obligations)
• Data portability — request a copy of your personal data in a commonly used electronic format, where technically feasible
• Deletion — request deletion of your personal data, subject to our legal and professional obligations to retain certain client and matter records

To exercise any of these rights, email rajpal.associates@gmail.com. We will respond within the timeframe required by the PDPA. We may need to verify your identity before processing a request.

8. Security Measures

We take reasonable steps to protect personal data against unauthorised access, loss, misuse, or disclosure. Measures include access controls limited to authorised personnel, secure handling of client files, and use of reputable third-party providers with their own security certifications and safeguards.

No method of transmission over the internet is completely secure. WhatsApp uses end-to-end encryption for personal chats, but we cannot guarantee absolute security of data you send us. Do not send identity documents, passwords, or highly confidential investigation material by WhatsApp unless we specifically ask you to after we have agreed to act for you.

9. Data Protection Officer

Under the PDPA, a Data Protection Officer (DPO) must be appointed where an organisation processes personal data of 20,000 or more individuals, processes sensitive personal data of 10,000 or more individuals, or engages in systematic monitoring on a large scale.

Based on our current scale of operations, we do not meet the threshold requiring a mandatory DPO appointment. All data protection enquiries may nonetheless be directed to rajpal.associates@gmail.com.

10. Data Breach Notification

In the event of a personal data breach that is likely to cause significant harm to affected individuals, we will notify the Personal Data Protection Commissioner and affected data subjects as required under the mandatory breach notification regime under the PDPA.

11. Minors

Our WhatsApp contact channel and website are not intended for use by persons under 18 years of age without the consent and involvement of a parent or legal guardian. If you are making an enquiry on behalf of a minor, you confirm that you have authority to do so and consent to the processing of the minor’s personal data as described in this policy.

12. Cookies and Website Tracking

This website does not currently set first-party analytics or advertising cookies. Third-party services embedded on our site (Google Fonts, Google Maps) may process limited technical information in accordance with their own policies. If we introduce analytics or other tracking in future, we will update this policy accordingly.

13. Complaints and Contact

If you have questions or complaints about how we handle your personal data, please contact us first at rajpal.associates@gmail.com or call +60 3-7960 1115 (Petaling Jaya) or +60 3-6186 8652 / +60 12-261 5635 (Batu Caves).

You may also lodge a complaint with the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi — JPDP) at www.pdp.gov.my if you are not satisfied with our response.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, our practices, or the services we offer. The effective date at the top of this page will be revised accordingly. Continued use of our website or WhatsApp contact after an update constitutes notice of the revised policy.