Legal Document
Privacy Policy
Last Updated: 15 April 2025 | Wibawa, Kuala Lumpur, Malaysia
This Privacy Policy describes how Wibawa ("we", "us", "the practice") collects, uses, and protects personal data provided to us in connection with our pension legal assistance services. We are committed to handling personal information with the discretion and care that our clients have a right to expect from a legal practice.
1. Who We Are
Wibawa is a legal practice registered and operating in Malaysia, with offices at 88 Jalan Tun Razak, 50400 Kuala Lumpur. We provide pension-focused legal assistance to individuals and families across Malaysia. For data protection purposes, Wibawa is the data controller in respect of personal data collected through this website and in the course of our legal services.
2. What Personal Data We Collect
Depending on how you interact with us, we may collect the following categories of personal data:
Through the contact form on our website:
- Full name
- Email address
- Telephone number (optional)
- Message content
In the course of legal engagement:
- Identity documents (MyKad, passport)
- Employment and contribution records
- Pension scheme correspondence and award letters
- Financial information relevant to the pension matter
- Family relationship information (for survivor and dependant matters)
Automatically through website use:
- Browser type and version
- Device type and operating system
- Pages visited and time spent
- Referring website
- Cookie preferences (see Section 6)
3. Legal Basis for Processing
We process personal data under the following legal bases, in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA):
- Consent: Where you have provided information through our contact form or agreed to the use of non-essential cookies.
- Contractual necessity: Where processing is necessary to provide the legal services you have engaged us for.
- Legitimate interests: For general website analytics and practice administration, where these interests are not overridden by your rights.
- Legal obligation: Where we are required to retain records by professional or regulatory requirements.
4. How We Use Your Personal Data
Personal data collected through the website contact form is used to:
- Respond to your enquiry
- Arrange an initial consultation if appropriate
- Send information relevant to your enquiry
Personal data collected in the course of a legal engagement is used to:
- Provide the legal services described in our engagement letter
- Communicate with pension administrators, government agencies, and other relevant parties on your behalf
- Maintain records of the matter as required by professional standards
We do not use client data for direct marketing purposes without specific consent. We do not sell personal data to third parties.
5. Data Retention
- Website enquiries not resulting in engagement: Retained for up to 12 months, then deleted.
- Legal engagement files: Retained for a minimum of 7 years from the close of the matter, in line with Malaysian Bar requirements, then securely deleted or destroyed.
- Cookie preference records: Retained until you clear your browser data or withdraw consent.
6. Cookies
Our website uses cookies to improve the browsing experience and to understand how the site is used. Essential cookies are always active and cannot be disabled as they are required for the website to function correctly. Optional analytics and preference cookies may be accepted or declined through our cookie banner.
For full details of the cookies we use, please see our Cookie Policy.
7. Sharing of Personal Data
Personal data is shared only in the following circumstances:
- With your explicit instruction: We share data with pension administrators, government agencies, and other relevant third parties only to the extent required to carry out the work you have instructed us on.
- Service providers: We use limited third-party services for website hosting and analytics (including Google Analytics, where enabled). These providers process data on our behalf under data processing agreements and do not use your data for their own commercial purposes.
- Legal requirement: Where we are required to disclose information by law, court order, or the request of a regulatory authority.
We do not transfer personal data outside Malaysia except where required to provide the services you have instructed (for example, contacting a foreign pension authority on your behalf), and only with your knowledge.
8. Data Security
We maintain appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, or disclosure. These include:
- Secure, password-protected systems for file storage
- Encrypted email communication for sensitive data
- Access controls limiting data access to personnel handling the matter
- Secure disposal of physical documents containing personal data
In the event of a personal data breach that is likely to affect your rights or interests, we will notify you as soon as practicable and take appropriate steps to contain and address the breach.
9. Your Rights
Under Malaysia's Personal Data Protection Act 2010, you have the following rights in relation to your personal data:
- Right of access: You may request a copy of the personal data we hold about you.
- Right of correction: You may request that inaccurate or incomplete data be corrected.
- Right to withdraw consent: Where processing is based on your consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
- Right to limit processing: You may request that we limit how we use your data in certain circumstances.
- Right to lodge a complaint: If you believe your data has been handled in a manner inconsistent with the PDPA, you may lodge a complaint with the Department of Personal Data Protection (JPDP) Malaysia.
To exercise any of these rights, please contact us at [email protected] or write to us at our office address. We will respond within 21 days.
10. Third-Party Links
Our website may contain links to third-party websites, including government agencies and other organisations. We are not responsible for the privacy practices of those websites and recommend that you review their privacy policies separately.
11. Children's Privacy
Our services are directed at adults aged 18 and over. We do not knowingly collect personal data from individuals under 18 through our website. In the context of survivor and dependant pension matters, data about minor dependants may be processed where necessary and lawful — always with the consent of the adult guardian responsible for the matter.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The updated policy will be published on this page with a revised "Last Updated" date. Continued use of our website or services after any change constitutes acceptance of the updated policy.
13. Contact and Data Inquiries
For any questions, requests, or concerns regarding this Privacy Policy or the handling of your personal data, please contact us: