Privacy Policy

This Privacy Policy explains how DESMOND ONG & CO. ADVOCATES ("the Firm", "we", "us", or "our") collects, uses, discloses, and protects personal data in accordance with the Personal Data Protection Act 2010 (Malaysia) ("PDPA"). By using this website or submitting information to us, you consent to the practices described in this Policy.

1. Data Controller

The data controller for personal data collected through this website is:

2. Personal Data We Collect

We collect personal data that you voluntarily provide to us, including when you:

• Submit an enquiry via the contact form on this website (name, email address, organisation, and description of matter)
• Book an appointment via our online scheduling tool (name, email address, and any information provided in the booking)
• Contact us directly by email or telephone

We do not collect sensitive personal data (as defined under the PDPA) through this website. We do not request information relating to health, financial accounts, political opinions, religious beliefs, or criminal records through our website forms.

3. Purposes of Collection and Use

We collect and use your personal data for the following purposes:

• Responding to your enquiry or request for information
• Scheduling and managing consultations and appointments
• Assessing whether the Firm can assist with your legal matter
• Complying with our professional obligations, including conflict-of-interest checks
• Maintaining records required by law or our professional regulatory bodies
• Improving the functionality and content of this website

We will not use your personal data for direct marketing purposes without your separate consent.

4. Disclosure of Personal Data

We do not sell, rent, or trade your personal data to third parties. We may disclose your personal data to:

• Service providers — third-party providers who assist in operating this website or delivering our services, including email routing services (Formspree) and appointment scheduling services (Google Workspace), subject to appropriate data processing terms
• Professional regulators — the Advocates Association of Sarawak, the Bar Council Malaysia, or other regulatory bodies, where required
• Law enforcement or courts — where we are required or permitted to do so by law

Where data is transferred to service providers outside Malaysia, we take reasonable steps to ensure appropriate safeguards are in place consistent with the PDPA.

5. Retention

We retain personal data collected through this website for as long as necessary to fulfil the purposes described above, or as required by law or our professional obligations. Enquiry data for matters that do not proceed to a retainer is generally retained for a period of 12 months, after which it is securely deleted.

6. Your Rights

Under the PDPA, you have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — request that inaccurate or incomplete personal data be corrected
• Withdrawal of consent — withdraw your consent to our processing of your personal data (subject to any legal or professional obligations that require us to retain it)
• Enquiry — obtain information about our data processing practices

To exercise any of these rights, please contact us at contact@docalaw.com. We will respond to your request within 21 days.

7. Security

We take reasonable technical and organisational measures to protect personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. Our website is served over HTTPS. However, no method of transmission over the internet is entirely secure, and we cannot guarantee the absolute security of data transmitted to us.

8. Cookies and Analytics

This website does not currently use tracking cookies or third-party analytics tools. The Google Calendar scheduling embed and Formspree contact form are provided by third-party services which may set their own cookies in accordance with their respective privacy policies. We encourage you to review the privacy policies of Google and Formspree for further information.

9. Children

This website is not directed at persons under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has submitted personal data to us, please contact us and we will take steps to delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated policy will be posted on this page with a revised effective date. We encourage you to review this page periodically.

11. Contact

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact: