Privacy Policy

1. Data Controller

The data controller responsible for your personal data is Drapeon Counsel, Suite 18-3, Wisma Goldhill, Jalan Raja Chulan, 50200 Kuala Lumpur, Malaysia. We are registered under the Personal Data Protection Act 2010 (PDPA) of Malaysia.

2. Personal Data We Collect

Data You Provide Directly

• Name and contact details (email address, telephone number) when you complete our enquiry form
• The content of written correspondence, including questions submitted via the Counsel Letter format
• Business name and role, where provided in the context of an enquiry or engagement

Data Collected Automatically

• Website usage data (pages visited, time spent) through analytics tools, subject to your cookie consent
• Device and browser information for technical compatibility and security monitoring
• IP address for security and fraud prevention purposes

Data Retention

Enquiry data is retained for twelve months from the date of submission. Active engagement data is retained for seven years from the close of the engagement, in line with standard professional practice. You may request deletion of your data at any time by writing to us at [email protected].

3. Legal Basis for Processing

• Consent — for marketing communications and analytics cookies, where you have opted in
• Legitimate interest — for responding to enquiries, website security, and service improvement
• Contractual necessity — for personal data processed in the course of a consulting engagement
• Legal obligation — for records we are required to retain under Malaysian law

4. How We Use Your Data

• To respond to your enquiries and arrange introductory calls
• To deliver consulting engagements you have commissioned
• To communicate with you about your engagement, including scheduling and document delivery
• To improve the performance and content of our website (analytics, subject to consent)
• To comply with legal and professional obligations

We do not use your personal data for automated decision-making or profiling. We do not sell your data to third parties.

5. Data Sharing

We do not share your personal data with third parties except in the following limited circumstances:

• Technology service providers — website hosting, analytics, and email delivery platforms that process data on our behalf under appropriate data processing agreements
• Legal advisors — only with your explicit written consent in the context of an engagement handover session
• Legal obligation — where required by a court order or applicable law

Any third-party service provider engaged by us is required to maintain data security standards consistent with applicable law.

6. Cookies

Our website uses cookies for essential functionality and, with your consent, for analytics. Essential cookies cannot be disabled without affecting the operation of the site. Analytics and preference cookies require your consent, which you may withdraw at any time through our Cookie Preference Centre. For full details, please see our Cookie Policy.

7. Data Security

We maintain appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include encrypted data transmission, access-controlled systems, and regular review of our security practices. In the event of a data breach affecting your rights or freedoms, we will notify the relevant supervisory authority and, where required, the affected individuals, within the timeframes prescribed by law.

8. Your Rights

Under the Malaysian Personal Data Protection Act 2010, you have the following rights:

• Right of access — to request a copy of the personal data we hold about you
• Right of correction — to request correction of inaccurate or incomplete data
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time
• Right to prevent processing — for direct marketing purposes
• Right to request erasure — subject to our legal retention obligations

To exercise any of these rights, please write to [email protected]. We will respond within thirty days. If you believe we have not handled your data appropriately, you may lodge a complaint with the Department of Personal Data Protection Malaysia (www.pdp.gov.my).

9. Third-Party Links

Our website may contain links to external sites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies independently.

10. Children's Privacy

Our services are directed at business principals and are not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has submitted data to us, please contact us promptly so that we may delete it.

11. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or applicable law. The date at the top of this document reflects the most recent revision. Continued use of our website or services following an update constitutes acceptance of the revised policy.