Privacy Policy

1. Introduction

Windrow ("we", "us", "our") is committed to handling personal data responsibly and with respect for the individuals whose information we hold. This Privacy Policy explains how we collect, use, disclose, and protect personal data in connection with our legal services and this website.

This policy is prepared in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia and applies to all personal data we process in our capacity as a data user. By using our website or engaging our services, you acknowledge that you have read and understood this policy.

For questions about this policy or our data practices, please contact us at [email protected].

2. Data We Collect

We collect personal data through the following means:

• Contact forms on this website: name, email address, phone number (optional), and the content of messages submitted
• Client engagement: identity documents, company registration details, correspondence, and information provided during the course of legal instructions
• Analytics tools: technical data including IP addresses, browser type, pages visited, and session duration — collected in anonymised or aggregated form where possible
• Cookies: as described in our Cookie Policy

We do not knowingly collect personal data from individuals under 18 years of age. If you believe a minor has submitted data through our website, please contact us so we can remove it promptly.

3. How We Use Personal Data

Personal data is used for the following purposes:

• Responding to enquiries submitted through our contact form
• Establishing and administering client engagement agreements
• Delivering legal services, including correspondence with regulatory authorities on behalf of clients
• Compliance with legal and professional obligations, including the Legal Profession Act 1976 and anti-money laundering obligations
• Improving the functionality and content of this website through anonymised analytics
• Sending service-related communications to existing clients where relevant

We do not use personal data for unsolicited marketing communications and do not sell or share client data with third parties for commercial purposes.

4. Legal Basis for Processing

Under the PDPA and general data protection principles, we process personal data on the following bases:

• Consent: where you have submitted a contact form or enquiry
• Contractual necessity: where processing is required to deliver the legal services you have engaged us for
• Legal obligation: where we are required to retain or disclose data by law, including professional conduct rules
• Legitimate interest: for improving our website and understanding how visitors use it

5. Data Retention

We retain personal data for as long as necessary to fulfil the purpose for which it was collected and to comply with applicable legal and professional obligations:

• Client matter files: retained for a minimum of 7 years from matter close, in accordance with professional conduct requirements
• Contact form submissions: retained for 12 months if no engagement follows
• Website analytics data: retained for up to 26 months in aggregated form

Following the applicable retention period, data is securely deleted or anonymised.

6. Data Sharing and Third Parties

We do not sell personal data. We may share data in the following limited circumstances:

• Regulatory authorities: disclosure required by the DOE, courts, or other regulatory bodies in the course of representing a client
• Professional advisors: where external counsel, barristers, or experts are instructed as part of a matter, subject to confidentiality obligations
• Service providers: third-party services used to operate this website (e.g., hosting, analytics) — under data processing agreements that restrict the use of data

Any international transfer of data, where it occurs, is subject to appropriate safeguards consistent with applicable Malaysian data protection requirements.

7. Data Security

We take reasonable technical and organisational measures to protect personal data from unauthorised access, loss, or disclosure. These include:

• Encrypted storage for client matter files
• Access controls restricting data to authorised personnel only
• Secure email communication for sensitive client correspondence
• Regular review of our data handling practices

In the event of a data breach that is likely to adversely affect individuals, we will notify the relevant parties in accordance with our obligations under applicable law.

8. Cookies

This website uses cookies to support basic functionality and to understand how visitors use the site. For a full explanation of the cookies we use and how to manage your preferences, please refer to our Cookie Policy.

9. Your Rights

Under the PDPA and general data protection principles, you have the following rights in relation to your personal data:

• Right to access: to request a copy of personal data we hold about you
• Right to rectification: to request correction of inaccurate data
• Right to erasure: to request deletion of data we no longer have a lawful basis to retain
• Right to object: to object to processing where we rely on legitimate interest
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time — this does not affect the lawfulness of prior processing
• Right to lodge a complaint: you may raise concerns with the Department of Personal Data Protection (JPDP) in Malaysia if you believe your data has been mishandled

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days. Some rights may be limited where professional obligations or legal requirements apply.

10. External Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their policies independently.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The updated version will be posted on this page with a revised date. Continued use of our website following any update constitutes acceptance of the revised policy.

12. Contact Information

For any questions, requests, or concerns relating to this Privacy Policy or the handling of your personal data:

• Email: [email protected]
• Phone: +60 3-5923 4168
• Address: Windrow, 28 Jalan Maharajalela, 50150 Kuala Lumpur, Malaysia