This notice is also available in Bahasa Malaysia.
Who is responsible
Koo Chin Nam & Co. is the data controller for the personal data described in this notice. Questions and requests may be sent to the firm using the contact details below.
What we collect and where it comes from
- Enquiries: your name, email address or telephone number, a brief description of your matter, relevant parties’ names for conflict checks, and correspondence with us.
- Newsletter subscriptions: your email address, any optional name you provide, and records of your subscription choice, consent and withdrawal.
- Requests for a guide by email: the email address you provide and the guide requested.
- Website use: technical information such as your IP address, browser and device information, pages requested, access times and cookie preferences. Cookies may store identifiers or preferences on your device.
We collect information directly from you through forms, email, telephone calls or other communications, and automatically through website operation. Where necessary for an enquiry or matter, information may also come from your authorised representative, relevant public records or other parties involved.
If you provide another person’s data, ensure that you are entitled to do so and, where appropriate, make this notice available to them.
Why we use personal data
- To respond to enquiries, carry out conflict checks and assess whether we can act.
- To arrange consultations and, if engaged, provide and administer legal services.
- To send a requested guide or KCN Legal Notes where you have chosen to subscribe.
- To operate, maintain and secure the website and our communications.
- To meet legal and professional obligations, maintain necessary records and handle complaints or legal claims.
We process data with consent where required, or where another basis permitted by the PDPA applies. Sensitive personal data is processed only with explicit consent or under an applicable statutory exception, including where relevant to legal advice or proceedings.
Your choices and required information
You choose whether to contact us or subscribe. Required fields are identified when information is requested. We need enough information to respond and complete necessary checks; without it, we may be unable to consider your enquiry or provide the requested service. Optional information need not be supplied.
A newsletter subscription requires an email address; your name is optional. Consent is requested separately through an unticked choice and recorded. Sending an enquiry or requesting a guide by email does not subscribe you to the newsletter. Our checklists remain freely readable without subscribing.
You can unsubscribe using the link in a newsletter or contact us directly. You may also ask us to stop using your data for direct marketing.
Sending an enquiry through a form or by email does not create a solicitor–client relationship. Do not send confidential documents until we have completed a conflict check and confirmed that we can act. Avoid including unnecessary sensitive details in an initial enquiry.
Cookies
Cookies may support essential website functions, remember preferences or, where enabled, help us understand website use. The cookies in use and available controls are described in our cookies policy.
You can manage cookies through available website controls and your browser settings. Blocking essential cookies may affect some website functions. Where consent is required for optional cookies, we will request it before using them.
Who may receive personal data
Access is limited to people who need the information for the stated purposes. Recipients may include the firm’s lawyers and authorised staff; service providers supporting hosting, IT, security, email, newsletter delivery and record storage; and professional advisers.
Where necessary for an instructed matter or a legal obligation, recipients may also include courts, registries, regulators, public authorities and relevant parties or their representatives. Disclosures remain subject to applicable law and our professional confidentiality obligations.
Transfers outside Malaysia
Hosting, email or other service providers may store or process data outside Malaysia. Any such transfer must meet the PDPA’s applicable transfer requirements, including a basis involving substantially similar law or adequate protection, or an applicable statutory exception.
We assess the relevant arrangements and safeguards before making such transfers. Use of this website alone is not blanket consent to overseas transfers.
How long we keep data
We retain data only for as long as necessary for its purpose and applicable legal or professional requirements. Relevant factors include whether an enquiry becomes an instructed matter, conflict-check requirements, record-keeping duties and the need to address complaints or legal claims.
Newsletter data is kept while needed to administer the subscription. After withdrawal, limited consent or suppression records may be retained to document your choice and prevent further mailings. Data no longer required is securely deleted or anonymised.
Your rights
Subject to the PDPA’s conditions and exceptions, you may:
- Request access to your personal data and correction of inaccurate or incomplete data.
- Withdraw consent by written notice and ask us to stop direct marketing.
- Request portability by asking us in writing to transmit your personal data to another data controller, subject to technical feasibility and compatible data formats.
We may need to verify your identity and clarify the request. We will explain any applicable restriction or reason we cannot fulfil it. Withdrawing consent may affect services that depend on that processing; it does not necessarily require us to delete records we must lawfully retain.
Security and data breaches
We use reasonable technical and organisational safeguards appropriate to the data and its use, including access restrictions and safeguards for service providers. No method of electronic transmission or storage can be guaranteed completely secure.
If a personal data breach occurs, we will assess and respond to it and notify the Personal Data Protection Commissioner as required by law. Where the breach causes or is likely to cause significant harm, we will also notify affected individuals as required, within applicable notification periods.
Contact and complaints
For a privacy request or concern, email koo.chin.nam@gmail.com, marked “Privacy request”, or telephone 03-2273 6033.
You may also write to Koo Chin Nam & Co., Suite 2A & 2C, 2nd Floor, Wisma Pahlawan, Jalan Sultan Sulaiman, 50000 Kuala Lumpur.
You may raise a complaint with Malaysia’s Personal Data Protection Commissioner through the official personal data protection website.
Changes to this notice
We will publish changes here and identify the date of an approved update. Where required, we will provide further notice or obtain fresh consent before using data for a new purpose.
Draft for the firm’s review.