Privacy Policy

1. Introduction

Yau & Associates ("the Firm", "we", "us" or "our") is committed to protecting the privacy and security of personal data collected through this website and in the course of our dealings with clients, prospective clients, counterparties, transactions, disputes or matters, seminar participants, survey participants, professional contacts and other persons with whom we interact including visitors.

This Privacy Policy is issued in accordance with the Personal Data Protection Act 2010 (Act 709), as amended by the Personal Data Protection (Amendment) Act 2024 (collectively, the "PDPA"), and applies to personal data processed by us in connection with our legal practice, professional activities, business operations, website, events, seminars, research initiatives and other dealings with you.

By using this website or submitting personal data to us (including by email), you acknowledge that you have read and understood this Privacy Policy.

2. Personal Data We Collect

• Contact and identification data you voluntarily provide, such as your name, email address, telephone number, company/organisation name and job title.
• Enquiry content — the substance of any message, query or instruction you submit to us by email.
• Technical data collected automatically when you visit our website, such as IP address, browser type, device information and pages visited, where such functionality is enabled.
• Client and matter data provided to us in the course of a professional engagement, governed additionally by the engagement terms agreed with you and by solicitor-client confidentiality and privilege.
• Registration and participation information relating to seminars, webinars, conferences, workshops, surveys, research initiatives and other events organised by us or in collaboration with third parties.
• Information collected as part of client acceptance procedures, conflict checks, customer due diligence, anti-money laundering, sanctions screening and other compliance processes.
• Personal data relating to directors, officers, employees, beneficial owners and authorised representatives of clients and prospective clients.

We do not knowingly collect personal data from minors through this website, and this website is not directed at children.

3. Purposes of Processing

It is necessary for us to collect and process personal data provided by you. If you do not provide such personal data, or if you do not consent to this Privacy Policy, we may be unable to provide our services to you, fulfil our contractual or legal obligations, or process your personal data for any of the purposes set out in this Privacy Policy.

In accordance with the General Principle and Notice and Choice Principle under the PDPA, we process personal data for the following purposes:

• Responding to enquiries submitted through our website or by email.
• Assessing and progressing potential instructions and client engagements.
• Providing legal services to clients, including matter administration and billing.
• Maintaining business records and client relationship management.
• Complying with our professional, regulatory and legal obligations, including under the Legal Profession Act 1976 and the rules of the Malaysian Bar.
• Conducting conflict-of-interest checks and client acceptance procedures.
• Improving our website and services.
• Organising and administering seminars, webinars, conferences, workshops and other professional events.
• Communicating with participants and providing event materials and follow-up communications.
• Conducting surveys, research projects, benchmarking exercises and industry studies.
• Preparing anonymised and aggregated statistical reports and publications.
• Sending legal updates, newsletters, publications and invitations to seminars and other events.

We process personal data only for the purpose for which it was collected, or for a directly related purpose, unless you consent otherwise or the law permits or requires it. For anonymous surveys, questionnaires or research projects, we may collect, analyse and use anonymised or aggregated information for research, statistical, educational and professional purposes.

4. Disclosure of Personal Data

In accordance with the Disclosure Principle, we do not sell or rent personal data to third parties. Personal data may be disclosed to:

• Our lawyers and staff on a need-to-know basis.
• Professional advisers, co-counsel, foreign lawyers or other third parties engaged to assist in a matter, where necessary and appropriate.
• Service providers who support our operations (e.g. website hosting, IT support, third-party technology providers, cloud hosting providers, document management providers and communications service providers), subject to appropriate confidentiality obligations.
• Regulators, courts or authorities, where required by law or court order.
• Professional collaborators, foreign law firms, seminar co-organisers, chambers of commerce, industry associations and other research or event partners.

Where any service provider is located outside Malaysia (for example, cloud hosting infrastructure), we take reasonable steps to ensure such data continues to be protected to a standard comparable to the PDPA before any cross-border transfer.

5. Data Security

In accordance with the Security Principle, we implement appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction, having regard to the nature and sensitivity of the data concerned.

Please note that we do not enter sensitive, confidential or proprietary client data into free or publicly available artificial intelligence platforms. Please refer to our Statement on the Use of Artificial Intelligence in our "How We Work" page for further details.

6. Data Retention

In accordance with the Retention Principle, personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, or as required by our professional obligations, applicable law, or the rules of the Malaysian Bar (including, where relevant, requirements relating to the retention of client files). We may retain personal data for longer periods where necessary to establish, exercise or defend legal rights or claims, comply with legal holds, or satisfy legal or regulatory requirements.

7. Data Integrity

In accordance with the Data Integrity Principle, we take reasonable steps to ensure personal data is accurate, complete, not misleading and kept up to date, having regard to the purpose for which it was collected.

8. Your Rights of Access and Correction

In accordance with the Access Principle, you have the right to:

• Request access to the personal data we hold about you;
• Request correction of any personal data that is inaccurate, incomplete or outdated; and
• Withdraw consent to our processing of your personal data, where processing is based on consent (subject to any overriding legal or professional obligation, such as retention of client records).

Requests may be made in writing to the contact details in Section 11 below. We may require verification of your identity before acting on a request and may charge a nominal processing fee as permitted under the PDPA.

9. Cookies and Website Analytics

Our website may use cookies or similar technologies to support basic website functionality and, where enabled, to understand website usage through analytics. You may configure your browser to refuse cookies; however, some parts of the website may not function properly as a result.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, our practices, or the services we offer. The updated version will be posted on this page with a revised "Last updated" date.

11. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights under the PDPA, please contact us at:

Yau & Associates
Penthouse 16-1, Level 16, Wisma UOA Damansara II
50490 Kuala Lumpur, Malaysia
(Co-working Space)
Email: info@yauassociates.com
Telephone: +60 17 362 3459