Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

• Firm name: Rajpal, Firah & Vishnu (Advocates & Solicitors, Malaysia)
• Petaling Jaya office: Unit 1039, Millennium Square PJ, Jalan 14/1, 46100 Petaling Jaya, Selangor, Malaysia  ·  Tel: 03-7960 1115
• Batu Caves office: No. 42-1A, First Floor, Jalan Medan Batu Caves 1, 68100 Batu Caves, Selangor, Malaysia  ·  Tel: 03-6186 8653
• Privacy enquiries: rajpal.associates@gmail.com

2. Personal Data We Collect

When you use our website or submit our online consultation form (hosted on Google Forms), we may collect the following personal data:

• Full name
• Telephone number
• Email address
• Nature of your legal enquiry (e.g. criminal law, civil litigation, corporate advisory, conveyancing, probate, or other)
• Comments or case-related details you choose to provide
• Your preferred method of contact (e.g. WhatsApp, Telegram, phone call, or email)

Sensitive personal data. If your enquiry relates to a criminal charge, police investigation, prior conviction, or similar matter, information you provide may constitute sensitive personal data under the PDPA. Processing such data requires your explicit consent — a clear and affirmative act beyond ordinary consent. By ticking the consent checkbox on our consultation form before submission, you give that explicit consent for us to process sensitive personal data you voluntarily include in your enquiry.

We do not require you to submit your identity card (IC) or passport number through the consultation form. Please do not include such identifiers unless we specifically request them after an engagement is confirmed.

3. Purpose of Collection

We collect and process your personal data for the following purposes:

• To assess and respond to your legal enquiry
• To schedule and conduct a consultation
• To communicate with you about your matter using your preferred contact method
• To determine whether we can act for you and, if so, to prepare for engagement
• To comply with applicable legal and professional obligations

4. Legal Basis and Consent

We process your personal data on the following bases under the PDPA:

• Consent: You provide consent by actively ticking the checkbox on our consultation form confirming that you have read this Privacy Policy and agree to the processing of your data as described. Submitting the form without ticking this box will not be accepted.
• Explicit consent: Where you disclose sensitive personal data (such as criminal-matter details), the same checkbox constitutes your explicit consent for that processing.
• Legal obligation: We may retain certain records where required by law or the rules of the Malaysian Bar and the legal profession.

You may withdraw your consent at any time by contacting us at rajpal.associates@gmail.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and we may still need to retain certain data where required by law or professional rules.

5. Third-Party Processors and Cross-Border Transfers

Our consultation form is hosted by Google LLC (Google Forms). When you submit the form, your responses are transmitted to and stored on Google’s servers, which may be located outside Malaysia.

Google acts as a data processor in respect of form submissions. We rely on Google’s contractual and technical safeguards for cross-border personal data transfers, consistent with the Personal Data Protection (Cross-Border Transfer of Personal Data) Guidelines. For details on how Google handles data, see Google’s Privacy Policy and Google’s Terms of Service.

Our website also uses the following third-party services that may process limited technical data (such as your IP address or browser type):

• Google Fonts — for typography
• Google Maps — embedded maps on our contact page

We do not use third-party advertising trackers, analytics cookies, or social-media pixels on this website at the time of publication.

6. Retention Period

We retain enquiry data for as long as reasonably necessary to respond to your enquiry and, if you become a client, for the duration of the retainer and any applicable limitation or record-keeping period under Malaysian law and professional rules.

Enquiry data that does not result in an engagement is generally retained for up to two (2) years from the date of submission, after which it is securely deleted or anonymised unless a longer period is required by law or a legitimate professional need.

Where we are required to maintain internal records of personal data breaches, such records are kept for at least two (2) years as required under the PDPA, separate from your enquiry file.

7. Your Rights as a Data Subject

Under the PDPA (including 2024 amendments), you have the right to:

• Access your personal data held by us
• Correct inaccurate or incomplete personal data
• Withdraw consent to processing (subject to legal and professional retention obligations)
• Data portability — request a copy of your personal data in a commonly used electronic format, where technically feasible
• Deletion — request deletion of your personal data, subject to our legal and professional obligations to retain certain client and matter records

To exercise any of these rights, email rajpal.associates@gmail.com. We will respond within the timeframe required by the PDPA. We may need to verify your identity before processing a request.

8. Security Measures

We take reasonable steps to protect personal data against unauthorised access, loss, misuse, or disclosure. Measures include access controls limited to authorised personnel, secure handling of client files, and use of reputable third-party providers with their own security certifications and safeguards.

No method of transmission over the internet is completely secure. While we take appropriate precautions, we cannot guarantee absolute security of data submitted through online forms.

9. Data Protection Officer

Under the PDPA, a Data Protection Officer (DPO) must be appointed where an organisation processes personal data of 20,000 or more individuals, processes sensitive personal data of 10,000 or more individuals, or engages in systematic monitoring on a large scale.

Based on our current scale of operations, we do not meet the threshold requiring a mandatory DPO appointment. All data protection enquiries may nonetheless be directed to rajpal.associates@gmail.com.

10. Data Breach Notification

In the event of a personal data breach that is likely to cause significant harm to affected individuals, we will notify the Personal Data Protection Commissioner and affected data subjects as required under the mandatory breach notification regime under the PDPA.

11. Minors

Our consultation form and website are not intended for use by persons under 18 years of age without the consent and involvement of a parent or legal guardian. If you are submitting an enquiry on behalf of a minor, you confirm that you have authority to do so and consent to the processing of the minor’s personal data as described in this policy.

12. Cookies and Website Tracking

This website does not currently set first-party analytics or advertising cookies. Third-party services embedded on our site (Google Fonts, Google Maps) may process limited technical information in accordance with their own policies. If we introduce analytics or other tracking in future, we will update this policy accordingly.

13. Complaints and Contact

If you have questions or complaints about how we handle your personal data, please contact us first at rajpal.associates@gmail.com or call 03-7960 1115 (Petaling Jaya) or 03-6186 8653 (Batu Caves).

You may also lodge a complaint with the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi — JPDP) at www.pdp.gov.my if you are not satisfied with our response.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, our practices, or the services we offer. The effective date at the top of this page will be revised accordingly. Continued use of our website or consultation form after an update constitutes notice of the revised policy.