Preamble
Corvus Legal recognizes the importance of protecting personal data entrusted to us in the course of our practice. This policy sets out the manner in which we collect, use, store, and disclose personal data, in accordance with the Personal Data Protection Act 2010 of Malaysia (PDPA). We encourage you to read this document carefully.
§ 1.0 — Introduction
Scope and Application
This Privacy Policy applies to all personal data collected by or on behalf of Corvus Legal (referred to herein as "the Firm", "we", "us", or "our") through this website, through enquiry and instruction channels, and in the course of client engagement.
It applies to visitors to this website, prospective clients, existing clients, and any third parties whose personal data is provided to the Firm in connection with a matter. By submitting your personal data to us, you acknowledge that you have read and understood this policy.
§ 2.0 — Data Controller
Identity of the Data Controller
The data controller in respect of personal data processed under this policy is:
Corvus Legal
Level 25, Menara Etiqa Twins
Jalan Pinang, 50450 Kuala Lumpur
Malaysia
Tel: +60 3 2789 4617
Email: [email protected]
§ 3.0 — Personal Data Collected
Categories of Data We Process
Depending on the nature of your interaction with the Firm, we may collect and process the following categories of personal data:
§ 3.1 — Identification Data
Full name, identity card or passport number, company registration number (where applicable), and position or designation.
§ 3.2 — Contact Data
Email address, telephone number, and mailing or business address.
§ 3.3 — Matter-Related Data
Information provided in connection with a legal matter, including facts, documents, financial information, and correspondence relevant to the instruction.
§ 3.4 — Website Usage Data
IP address, browser type, pages visited, time spent, and referral source, collected automatically when you visit this website. See Section 10 regarding cookies.
§ 4.0 — Purpose of Processing
How We Use Your Data
Personal data collected by the Firm is processed for the following purposes:
- To respond to enquiries submitted through this website or by other means
- To establish and manage client relationships and engagement arrangements
- To provide legal services in accordance with the terms of engagement
- To comply with legal, regulatory, and professional obligations including anti-money laundering requirements under the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLATFPUAA)
- To issue invoices and maintain accounting records
- To improve the functionality and content of this website
- To send service-related communications that you have requested or consented to
We do not use personal data collected in the course of legal instructions for marketing purposes without separate consent. We do not sell personal data to third parties.
§ 5.0 — Legal Basis for Processing
Grounds Under the PDPA
The Firm processes personal data on the following grounds as recognized under the PDPA 2010:
§ 6.0 — Data Retention
How Long We Keep Your Data
Personal data is retained for as long as is necessary for the purpose for which it was collected, or as required by applicable law and professional standards.
Client matter files are typically retained for a minimum of seven (7) years following the conclusion of a matter, in accordance with the requirements of the Legal Profession Act 1976 and the rules of the Malaysian Bar.
Website enquiry data that does not proceed to engagement will be retained for no longer than twelve (12) months. Thereafter, it is deleted or anonymised unless there is a specific reason for longer retention that is communicated to you.
§ 7.0 — Disclosure of Personal Data
Third Parties Who May Receive Your Data
The Firm does not disclose personal data to third parties except in the following circumstances:
- Service Providers: Third-party service providers who assist in operating this website, hosting data, or providing IT infrastructure, under confidentiality obligations.
- Regulatory Bodies: Where disclosure is required by applicable law, court order, regulatory investigation, or pursuant to the Firm's obligations under the AMLATFPUAA.
- Counterparties (with consent): Where the nature of the matter requires disclosure to a counterparty or their advisers, and you have provided consent or the disclosure is inherent to the engagement.
- Professional Indemnity Insurers: Where necessary in connection with a claim or potential claim under the Firm's professional indemnity arrangements.
We do not transfer personal data outside of Malaysia unless appropriate safeguards are in place and disclosure is necessary for the engagement.
§ 8.0 — Your Rights
Rights Under the PDPA
Subject to applicable law, you have the following rights in respect of your personal data:
Right of Access
To request confirmation of whether we hold your personal data and, if so, to receive a copy of it.
Right of Correction
To request that inaccurate or incomplete personal data be corrected.
Right to Withdraw Consent
To withdraw any consent given for processing, subject to legal and contractual limitations that may apply.
Right to Limit Processing
To request that processing be limited to specific purposes in defined circumstances.
To exercise any of the above rights, please contact us using the details in Section 12. We will respond within a reasonable period and in accordance with our obligations under the PDPA. We may require you to verify your identity before processing the request.
§ 9.0 — Data Security
How We Protect Your Data
The Firm maintains reasonable and appropriate technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration, or disclosure.
These measures include access controls, encrypted communication channels for sensitive matter correspondence, and staff procedures that reflect our obligations under the PDPA and under the rules of the Malaysian Bar governing client confidentiality.
No system of data transmission or storage can be entirely secure. If you have concerns about the security of data you have shared with us, please contact us directly.
§ 10.0 — Cookies
Use of Cookies on This Website
This website uses cookies to support its functionality and to understand how it is used. A cookie is a small text file placed on your device by the website server.
We use essential cookies (which are necessary for the website to function) and, with your consent, analytical cookies that help us understand visitor behaviour in aggregate, non-personal form.
For full details of the cookies used on this website and your choices regarding them, please refer to our Cookie Policy. You may withdraw your consent to non-essential cookies at any time by adjusting your browser settings or revisiting the cookie preference controls on this website.
§ 11.0 — Amendments
Changes to This Policy
The Firm reserves the right to amend this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance, or operational practice. The current version will always be accessible on this website.
The effective date at the top of this document indicates when the current version came into effect. We encourage you to review this policy periodically. Continued use of this website or our services following any amendment constitutes acceptance of the revised policy.
§ 12.0 — Contact
Data Protection Enquiries
Questions, requests to exercise your rights, or complaints regarding our handling of personal data may be directed to:
Data Protection Contact
Corvus Legal — Privacy Matters
Level 25, Menara Etiqa Twins, Jalan Pinang
50450 Kuala Lumpur, Malaysia
Email: [email protected]
Tel: +60 3 2789 4617
If you are not satisfied with our response to a data protection enquiry, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia (pdp.gov.my).
Cross-References