Privacy Policy

1. Introduction

Merantau Chambers ("the Firm", "we", "us") is committed to handling personal data responsibly and in accordance with the Personal Data Protection Act 2010 of Malaysia (PDPA). This Policy explains what personal data we collect, how we use it, and the choices you have regarding your information. Our principal place of business is 23A, Jalan Sultan Ismail, 50250 Kuala Lumpur, Malaysia.

If you have questions about this Policy, please contact us at [email protected].

2. Data We Collect

We may collect the following categories of personal data:

• Identity data: full name, nationality, date of birth, passport number, and similar identifying information relevant to an immigration matter.
• Contact data: email address, telephone number, and postal address.
• Matter data: details of the immigration application or legal matter you engage us for, including documents you provide.
• Financial data: where required for an application (e.g., MM2H financial documentation), subject to the specific matter scope.
• Technical data: IP address, browser type, and page visit data collected automatically when you use our website.
• Communications data: correspondence between you and the Firm.

We collect this data when you submit an enquiry form on our website, communicate with us by email or telephone, or engage us formally for a legal matter.

3. How We Use Your Data

Personal data is used for the following purposes:

• Responding to your enquiry and conducting an initial matter assessment.
• Providing legal advisory and representation services where an engagement is established.
• Preparing and submitting immigration applications and related documentation to the relevant Malaysian authorities.
• Corresponding with government authorities (ESD, TalentCorp, Immigration Department) on your behalf.
• Maintaining matter records as required by our professional obligations under the Malaysian Bar.
• Improving the functionality of our website through anonymised analytics.

Our legal basis for processing is: your consent (for initial enquiries), performance of a contract (for formal engagements), and compliance with legal obligations (for record-keeping obligations under the PDPA and Malaysian Bar requirements).

4. Data Sharing

We do not sell, rent, or share your personal data with third parties for commercial purposes. Your data may be shared with:

• Malaysian government authorities as required by your matter (ESD, TalentCorp, Immigration Department, Courts).
• Service providers who assist us in operating our practice (e.g., secure document storage), subject to contractual data protection obligations.
• Where required by law or order of a Malaysian court.

5. Data Retention

We retain personal data for as long as is necessary for the purposes set out in this Policy. For client matter files, we generally retain records for seven years after the conclusion of the matter, in accordance with our professional obligations. Enquiry data where no engagement is established is retained for twelve months. You may request deletion at any time, subject to our retention obligations under law.

6. Data Protection Measures

We maintain the following measures to protect your personal data:

• Secure, access-controlled document management systems with practitioner-level permissions.
• Encrypted email communication for the transmission of sensitive documents.
• Restricted physical access to matter files within our offices.
• Regular review of security practices against current standards.
• Staff awareness of PDPA obligations as part of professional practice.

In the event of a personal data breach that is likely to result in significant harm, we will notify you and, where required, the relevant authority in accordance with the PDPA.

7. Cookies

Our website uses cookies. Please see our Cookie Policy for full details on the types of cookies used, their purposes, and how to manage your preferences.

8. Your Rights Under the PDPA

Under the Personal Data Protection Act 2010, you have the following rights regarding your personal data:

• Right of access: to request information about what personal data we hold about you.
• Right of correction: to request correction of inaccurate or incomplete personal data.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.
• Right to prevent processing: for purposes of direct marketing or processing causing substantial unwarranted damage or distress.
• Right to complain: to the Personal Data Protection Commissioner of Malaysia if you consider your rights have not been respected.

To exercise any of these rights, write to us at [email protected]. We will respond within 21 days.

9. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policy of any site you visit.

10. Children's Privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. Where a minor is the subject of an immigration matter, data is collected from the responsible adult on their behalf.

11. Changes to This Policy

We may update this Policy from time to time. Material changes will be communicated by posting the revised Policy on our website with an updated effective date. We encourage you to review this Policy periodically.

12. Contact Us

For all data-related enquiries, corrections, or withdrawal of consent: