Privacy Policy
Last updated: 10 July 2025
1. Introduction
Legacia ("we", "us", "our") is a document management and estate records practice based in Kuala Lumpur, Malaysia. We are committed to protecting the personal data of everyone who contacts us or uses our services, in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA 2010).
This policy describes what personal data we collect, how we use it, how we protect it and what rights you have in relation to it. It applies to information collected through our website at legacia.pro, by telephone, by email and in the course of providing our services.
For questions about this policy, contact us at [email protected].
2. Data we collect
We collect the following types of personal data:
- Contact information: name, email address, telephone number and postal address — provided when you contact us or enter into a service agreement.
- Service records: information about the documents and possessions recorded during an inventory or consolidation project, held only for the duration of the service and returned or deleted thereafter.
- Correspondence: emails, letters and notes from telephone calls, retained for the period of the service engagement and for a maximum of two years after its conclusion.
- Website usage data: anonymised analytics data about pages visited and time on site, collected via cookies where consent has been given. No personally identifiable data is collected through analytics.
We collect data directly from you. We do not purchase or obtain data from third-party data brokers.
Legal basis for processing
- Contract performance: data necessary to deliver the service you have engaged us for.
- Legitimate interest: maintaining records of correspondence for the duration and for a reasonable period after, to allow us to respond to any queries about completed work.
- Consent: analytics and optional cookies, where you have given consent through the cookie preference panel on our website.
3. How we use personal data
- To respond to enquiries and provide information about our services.
- To agree the scope of a service engagement and to deliver the agreed work.
- To manage the administrative retainer, including maintaining a correspondence log and preparing document packs on your behalf.
- To issue invoices and maintain basic financial records as required by Malaysian law.
- To improve our website and understand how it is used, using anonymised analytics data where consent has been given.
We do not use personal data for direct marketing. We do not send promotional communications without your consent.
4. Data sharing
We do not sell personal data to third parties. We do not share personal data with third parties for their marketing purposes.
We may share data in the following limited circumstances:
- With service providers: we use encrypted cloud storage to hold digital copies of scanned documents during consolidation projects. These providers process data on our behalf under data processing agreements and may not use the data for their own purposes.
- For legal compliance: where required by Malaysian law or a lawful order of a court or regulatory authority.
5. Data retention
- Service records and document scans: held only for the duration of the active service and deleted within 30 days of service completion, unless you have asked us to retain a copy for a specified period.
- Correspondence: retained for a maximum of two years after the conclusion of a service engagement, then deleted.
- Financial records: retained for seven years as required by Malaysian law.
- Website analytics: anonymised data retained for up to 24 months.
6. Data security
- Digital copies of client documents are stored on encrypted media using AES-256 encryption or equivalent.
- Access to client files is restricted to the assigned administrator and the practice principals.
- Physical documents held during a project are stored in locked cabinets accessible only to authorised staff.
- In the event of a data breach that is likely to result in a risk to your rights, we will notify you promptly and take steps to contain the breach.
- Staff handling client data receive data protection training appropriate to their role.
7. Cookies
Our website uses cookies to maintain basic functionality and, where you consent, to collect anonymised usage data. Essential cookies are necessary for the website to work and cannot be declined. Optional analytics and preference cookies are only activated if you accept them through the cookie preference panel.
For full details, see our Cookie Policy.
8. Your rights
Under the Personal Data Protection Act 2010 (Malaysia), you have the following rights in relation to your personal data:
- Right of access: you may request a copy of the personal data we hold about you.
- Right to correction: you may ask us to correct inaccurate or incomplete data.
- Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.
- Right to limit processing: in certain circumstances, you may ask us to restrict how we use your data.
- Right to raise a concern: you may raise a complaint with the Department of Personal Data Protection, Ministry of Communications and Digital, Malaysia.
To exercise any of these rights, write to us at [email protected]. We will respond within 21 days.
9. Third-party links
Our website may contain links to third-party sites. We are not responsible for the privacy practices of those sites and recommend that you read their privacy policies independently.
10. Children's privacy
Our services are directed at adults. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently received data from a minor, please contact us and we will delete it promptly.
11. Updates to this policy
We may update this policy from time to time. Changes will be posted on this page with an updated date at the top. Where changes are material, we will notify active clients by email.
12. Contact
Data controller: Legacia
9 Jalan Setiabakti, Damansara Heights, 50490 Kuala Lumpur, Malaysia