Privacy Policy

1. Introduction

Bersatu Partners ("we", "us", "our") is committed to protecting the personal data of individuals who interact with us — whether as prospective clients, existing clients, counterparties, or visitors to our website. This Privacy Policy explains what data we collect, why we collect it, how long we retain it, and what rights you have in relation to it.

We are a data controller established in Malaysia and this policy is prepared in compliance with the Personal Data Protection Act 2010 (Malaysia) ("PDPA 2010"). For enquiries about how we handle personal data, please contact us at [email protected].

2. What Personal Data We Collect

We collect personal data in the following circumstances and of the following categories:

• Enquiry and contact forms: name, email address, phone number, and any information you choose to include in a message describing a prospective transaction.
• Engagement documentation: identity documents, company information, financial information, and other data necessary to conduct legal advisory work and comply with applicable anti-money laundering and know-your-client obligations.
• Website usage data: technical data such as IP address, browser type, pages visited, and session duration, collected via cookies and analytics tools.
• Correspondence: email, postal and telephone communications with us in the ordinary course of an engagement or an enquiry.

3. How We Use Personal Data

We use personal data for the following purposes:

• To respond to enquiries and assess whether an engagement is appropriate.
• To deliver legal advisory services under an engagement agreement.
• To comply with legal and regulatory obligations, including AMLA obligations applicable to legal practitioners.
• To communicate progress updates, invoices, and other engagement-related correspondence.
• To analyse and improve website performance using aggregated, anonymised data.

We do not use personal data for marketing to third parties or share it with advertising networks.

4. Legal Basis for Processing

Under the PDPA 2010, we process personal data on the following bases:

• Consent: where you have provided information voluntarily in an enquiry or contact form.
• Contractual necessity: where processing is required to perform or prepare to perform an engagement agreement.
• Legal obligation: where processing is required for compliance with applicable Malaysian law, including anti-money laundering requirements.
• Legitimate interests: for website analytics and service improvement, where this does not override your fundamental rights.

5. Data Retention

We retain personal data for as long as is necessary for the purpose for which it was collected, or as required by applicable law:

• Enquiry data from contacts that do not proceed to an engagement: up to 12 months from last contact.
• Engagement documentation: 7 years from completion of the engagement, in accordance with professional practice requirements.
• AMLA-related records: as required by the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (minimum 6 years).
• Website analytics data: up to 26 months in aggregated form.

6. Data Sharing

We do not sell personal data. We may share it in limited circumstances:

• With co-advisers (financial advisers, tax advisers, overseas counsel) where required to deliver advisory services, subject to appropriate confidentiality obligations.
• With regulatory bodies (the Securities Commission, the Malaysia Competition Commission, the Malaysian Bar) where legally required.
• With service providers who assist with IT infrastructure and document management, under data processing agreements.
• With counterparties in a transaction, to the extent required by the transaction process.

7. Cookies

Our website uses cookies to support basic functionality and to understand how visitors use the site. For full details of the cookies we use and how to manage your preferences, please see our Cookie Policy.

8. Your Rights

Under the PDPA 2010, you have the following rights in relation to your personal data:

• Right of access: to request a copy of personal data we hold about you.
• Right of correction: to request correction of inaccurate or incomplete personal data.
• Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time (this does not affect the lawfulness of processing before withdrawal).
• Right to limit processing: in certain circumstances, to request that we limit how we use your data.
• Right to inquire: to ask questions about how your data is processed.

To exercise any of these rights, please write to us at [email protected]. We will respond within 21 days of a valid request. We may require identity verification before processing a request.

9. Data Security

We maintain appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or loss. This includes encrypted document storage, access controls, and regular review of security practices. Where a personal data breach occurs and is likely to cause significant harm, we will notify the relevant authority and, where appropriate, the affected individuals.

10. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites and recommend you review their privacy policies separately.

11. Children's Privacy

Our services are intended for professionals and businesses. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware that we have inadvertently collected such data, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Material changes will be posted on this page with an updated effective date. We recommend reviewing this page periodically.

13. Contact

For questions or requests regarding this Privacy Policy or the handling of your personal data: