Privacy Policy

1. Who We Are

The data controller is Quilstow Advocates & Solicitors, a legal practice registered and operating in Malaysia, with offices at 28 Lorong Kuda, 55200 Kuala Lumpur, Malaysia. If you have any questions about this policy or how your data is handled, please contact us at privacy@quilstow.

2. Data We Collect

We collect personal data through various means, including our website contact form, email, telephone, and in-person consultations. The categories of data we may hold include:

• Identity data — full name, identification number where provided
• Contact data — email address, telephone number, postal address
• Matter data — information relating to your legal matter shared in the course of an engagement
• Technical data — IP address, browser type, pages visited, collected via cookies where consent is given
• Communications data — records of correspondence between you and our practice

3. Legal Basis for Processing

We process personal data on the following lawful bases under the PDPA 2010:

• Consent — where you have provided express consent, for example by submitting our contact form
• Contract — where processing is necessary for the performance of a retainer or engagement agreement
• Legal obligation — where we are required to process data to comply with applicable law, including anti-money laundering obligations
• Legitimate interests — for internal practice management and quality assurance purposes

4. How We Use Your Data

Personal data collected is used to respond to enquiries, carry out legal engagements, communicate progress updates, comply with statutory or regulatory requirements, and improve the operation of our practice. We do not use your personal data for unsolicited marketing communications without your consent.

5. Data Sharing

We do not sell or share personal data with third parties for commercial purposes. Data may be shared in the following limited circumstances:

• With other legal practitioners, courts, or regulatory bodies where required by the nature of the engagement
• With service providers who process data on our behalf under data processing agreements (e.g. secure cloud storage)
• Where required by law, court order, or competent regulatory authority

6. Data Retention

Client matter files are retained for a minimum of seven years following completion of an engagement, in accordance with standard legal practice requirements. Enquiry data from individuals who do not proceed to engagement is retained for twelve months. Technical and analytics data is retained for no longer than twenty-four months.

7. Data Security

We maintain appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include encrypted file storage, restricted access controls, and regular internal reviews. In the event of a data breach that may affect your rights, we will notify you as required under applicable law.

8. Cookies

Our website uses cookies to support basic functionality and, where consent is given, to collect anonymised analytics data. Please refer to our Cookie Policy for full details of the cookies we use and how to manage your preferences.

9. Your Rights Under the PDPA 2010

Under the Personal Data Protection Act 2010, you have the following rights in relation to your personal data held by Quilstow:

• Right of access — to request a copy of the personal data we hold about you
• Right of correction — to request correction of inaccurate or incomplete personal data
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time
• Right to prevent processing — for direct marketing purposes
• Right to lodge a complaint — with the Personal Data Protection Commissioner of Malaysia

To exercise any of these rights, please contact us in writing at privacy@quilstow. We will respond within thirty days.

10. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and encourage you to review their policies independently.

11. Children

Our services are directed at individuals aged 18 and above. We do not knowingly collect personal data from minors. If you believe a minor has submitted data to us, please contact us and we will take appropriate steps to remove it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The most current version will always be available on this page, with the date of last revision shown at the top. Continued use of our website or services following any update constitutes acceptance of the revised policy.

13. Contact

For any questions or requests relating to this Privacy Policy or the handling of your personal data, please contact: