General privacy statement
ElderHubLegal operates in accordance with applicable Malaysian privacy and data protection principles and observes internationally recognized best practices when processing personal information. We collect and use data necessary to deliver legal advisory services, manage client relationships, comply with regulatory requirements and maintain secure records. Processing activities are limited to lawful purposes, proportionate to the need and subject to technical and organisational safeguards designed to protect confidentiality, integrity and availability of client information. Access to client data is restricted to personnel with a demonstrable need to perform their duties.
Key definitions
The following definitions explain terms used in this policy to clarify what we mean by personal data, processing and related concepts used in our documentation and client communications.
Data we collect
We collect personal data that is necessary for delivering professional legal services, for compliance with legal obligations and for legitimate business administration. Collection is limited to purpose-specific categories and retained only for as long as required.
Data you provide directly
Information provided directly by clients and contacts to enable legal services and communications. Typical items include:
- Full name, residential or correspondence address and contact numbers
- Identification documents such as national ID or passport numbers where required for verification
- Medical or care-related information where relevant to legal advice and only with explicit client consent
- Business information necessary for estate administration or fiduciary matters
- Instructions, correspondence and documents relevant to the provision of legal services
- Preferences for communications and authorised third-party contacts
Data collected automatically
When visiting our website or using online services, we automatically collect technical and usage data to enable service functionality, security and improvement.
- Device and browser information including user agent string
- IP address and anonymised location data for security and analytics
- Website usage data such as pages visited, session duration and navigation paths
- Interaction data from forms and online booking tools
- Security logs used to detect and contribute unauthorised access attempts
- Cookies and similar identifiers as described in the cookies section
Data received from third parties
We may receive personal data from authorised third parties to support client matters, subject to verification and legal safeguards.
- Referrals from healthcare providers or social services with client consent
- Information from business institutions or trustees relevant to estate matters
- Court or government agency records required for legal proceedings or verification
Purposes of processing
We process personal data only for specific, explicit and legitimate purposes related to the delivery of legal services, regulatory compliance and client relationship management.
- To provide legal advice, draft documents and manage legal matters for clients
- To verify client identity and perform due diligence checks required by law
- To communicate with clients, authorised representatives and service providers
- To maintain secure records and backups necessary for professional obligations
- To carry out billing, accounting and administrative operations
- To improve our services through aggregated analytics and client feedback
- To respond to legal requests from courts, regulators or law enforcement as required by law
- To manage complaints, disputes and internal quality assurance processes
Legal bases for processing
We rely on appropriate legal bases when processing personal data, depending on the nature of the processing activity and applicable law.
- Processing necessary for the performance of a contract with the client or to take steps at the client's request before entering a contract
- Processing required to comply with a legal obligation, such as regulatory reporting or court orders
- Processing necessary for the legitimate interests of ElderHubLegal, such as fraud prevention and service improvement, balanced against individuals' rights
- Processing based on explicit consent where special categories of data (for example health information) are involved and consent has been freely given
European data subject rights (reference)
Although ElderHubLegal is based in Malaysia, we recognise the importance of certain European data subject rights and provide information about rights commonly referenced under data protection frameworks.
- Right to access: individuals may request confirmation of processing and access to the personal data we hold about them
- Right to rectification: clients may request correction of inaccurate or incomplete personal data
- Right to erasure: where lawful, individuals may request deletion of personal data that is no longer necessary for the purposes collected
- Right to restrict processing: in some circumstances a request can limit how personal data is processed
- Right to data portability: where technically feasible and lawful, individuals may request transfer of their personal data in a structured format
- Right to object: individuals may object to processing based on legitimate interests or direct marketing; we will assess such requests in context
Sharing and disclosure of personal data
We do not sell personal data. Disclosure is limited to trusted third parties and service providers that support our legal services, under contractual or legal obligations and appropriate safeguards.
- External legal counsel or specialist advisors engaged with client consent for matter-specific advice
- Court offices, registries and government agencies where required for proceedings or statutory filings
- Service providers such as secure document storage, IT support and payment processors under confidentiality agreements
- Healthcare professionals or social services when necessary to support advance care planning and only with proper authorisation
- Regulators and law enforcement when required by law or a valid legal process
- Auditors and compliance staff for the purpose of regulatory inspections or internal reviews
International transfers
Personal data may be transferred to service providers or partners located outside Malaysia where necessary to deliver services. Transfers are conducted under contractual measures and technical safeguards to maintain an adequate level of protection.
Where transfers occur, ElderHubLegal implements appropriate safeguards such as contractual data protection clauses, vetting of processors and, where relevant, encryption and access controls to limit exposure.
Data retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, to meet statutory or regulatory obligations and to resolve potential disputes. Retention periods are determined based on legal requirements and professional standards.
Client account records and case files are typically retained for a period consistent with legal practice standards and regulatory obligations. Specific retention periods vary by matter type and applicable law.
Communications and message records are retained to support case continuity and auditability. Non-essential messages may be archived according to retention schedules and deleted when no longer needed.
Security logs, access records and system logs are retained for operational and forensic purposes for defined periods to detect, contribute and mitigate security incidents and to comply with legal obligations.
ElderHubLegal retains personal data only as long as necessary to provide senior legal advisory services, comply with legal obligations, resolve disputes and enforce agreements. Retention periods vary by data type: engagement records and case files are typically retained for a minimum of seven years unless a longer period is required by law or professional rules. Where personal data is no longer required, we securely delete or anonymize it. You may request deletion of your personal data subject to legal and regulatory limitations; deletion requests are assessed to ensure compliance with obligations such as record-keeping for audits, tax, or regulatory purposes.
Data Security and Storage
ElderHubLegal applies a layered approach to information security designed for the protection of sensitive client information. Technical, administrative and physical safeguards are in place to reduce the risk of unauthorized access, disclosure, alteration or destruction of personal data. Access to personal data is limited to authorized personnel on a need-to-know basis and subject to confidentiality obligations. Regular reviews and training help maintain an active security posture aligned with prevailing professional standards.
- Encryption of data in transit using industry-standard TLS and encryption at rest for sensitive records.
- Role-based access controls, multi-factor authentication for administrative access, and secure credential management.
- Periodic security assessments, patch management, secure backups and incident response procedures.
Your rights regarding personal data
Under applicable data protection laws, individuals have a set of rights related to their personal data. ElderHubLegal respects these rights and provides channels to exercise them. Rights may be subject to limitations necessary to protect legal or professional obligations, confidentiality or the rights of others.
- Right of access: request a copy of personal data we hold about you and an explanation of its use.
- Right of rectification: request correction of inaccurate or incomplete personal data.
- Right to erasure: request deletion of personal data where processing is no longer necessary or lawful, subject to exceptions.
- Right to restriction: request limitation of processing where accuracy, lawfulness or necessity is contested.
- Right to data portability: request transfer of certain personal data to you or another provider in a structured, commonly used format.
- Right to object: object to processing based on legitimate interests or direct marketing; objections are considered in light of applicable law.
- Right to withdraw consent: where processing relies on consent, you may withdraw consent at any time without affecting prior lawful processing.
- Right to lodge a complaint with a supervisory authority if you believe your rights have been infringed.
Exercising Your Data Rights
To exercise your data rights, please contact our privacy team with a clear description of your request and a means for us to identify you. We may request additional information to verify your identity and to locate the relevant records. Requests are handled with confidentiality and in accordance with applicable legal requirements.
We aim to acknowledge requests promptly and to respond to most valid requests within 30 calendar days. In complex cases or where additional verification is necessary, we may extend the response period and will inform you of any extension and its reasons.
Marketing Communications
ElderHubLegal may send informational or promotional communications related to services, events and legal guidance where you have consented or where we have a legitimate interest. Communications are limited to relevant topics for senior legal advisory and professional updates. Marketing content will clearly identify ElderHubLegal and provide easy means to manage preferences.
You may opt out of marketing communications at any time by using the unsubscribe link in emails or by contacting our privacy team. Processing of a valid unsubscribe request will be actioned without undue delay and will not affect transactional communications necessary to the provision of services.
Children's Privacy
Our services and content are intended for adults and for the professional provision of senior legal advisory. ElderHubLegal does not knowingly collect personal data from individuals under 18. If we learn that we have collected personal data of a child without appropriate consent, we will take steps to remove that information as required by law.
Third-Party Links
Our website and communications may contain links to third-party websites or services. Those third parties have their own privacy practices and ElderHubLegal is not responsible for their content or policies. We recommend reviewing the privacy notices of any site you visit from links on our site.
Policy Updates
This privacy policy may be updated to reflect changes in our practices, legal obligations or service offerings. Material changes will be communicated where required by law and the updated policy will indicate the effective date. Continued use of ElderHubLegal services after publication signifies acceptance of the revised terms.