Privacy Policy

1. Data We Collect

We collect personal data only where it is necessary to provide our services or to respond to enquiries. This includes:

• Identity data: full name, names of other family members involved in the estate process
• Contact data: email address, telephone number, postal address
• Engagement data: information about the estate situation shared during sessions or correspondence, document content where documents are provided to us for filing or coordination
• Website usage data: IP address, browser type, pages visited, and time spent on pages (collected via cookies — see Section 5)

We do not collect sensitive personal data such as health records, financial account details, or identity document numbers unless these are contained within estate documents provided to us as part of a service engagement, in which case they are handled under the terms of the engagement agreement.

2. How We Collect Data

Personal data is collected through the following means:

• Website contact forms submitted by you
• Email and telephone correspondence
• In-person or video meetings during service engagements
• Documents provided to us by you or collected locally on your behalf as part of an agreed engagement
• Cookies and website analytics tools (see Section 5)

3. Legal Basis for Processing

Under the PDPA 2010, we process your personal data on the following grounds:

• Consent: where you have contacted us through a form or provided data expressly for us to respond to an enquiry
• Contract performance: where data processing is necessary to carry out the services you have engaged us to provide
• Legitimate interests: for website analytics and service improvement, where your interests do not override ours
• Legal obligation: where we are required to retain records for compliance with applicable Malaysian law

4. How We Use Your Data

We use personal data for the following purposes:

• Responding to website enquiries and arranging initial conversations
• Delivering administrative support services as agreed under a service arrangement
• Maintaining and sharing the digital archive with named family members you authorise
• Sending written meeting notes, progress reports, and coordination communications
• Issuing invoices and processing payments
• Improving our website and services through anonymised usage analysis

We do not send marketing emails. We do not sell your data to third parties. We do not use your data for purposes unrelated to the service engagement or your enquiry.

5. Cookies

Our website uses cookies to remember your preferences and to understand how visitors use our site. Cookie categories include:

• Essential cookies: required for the site to function and cannot be disabled
• Analytics cookies: used to understand page visits and site performance (optional)
• Preference cookies: used to remember your consent choices (optional)

For full details and to manage your cookie preferences, see our Cookie Policy.

6. Data Sharing

We do not share your personal data with third parties except in the following circumstances:

• With family members you authorise: named archive access is granted only to individuals you specify
• With independent professional firms: only where you have explicitly instructed us to forward materials to a legal or other professional you have engaged, and only the materials you specify
• With translation or courier services: where engagement of these services is necessary for your arrangement and you have been informed of this at the outset
• Where required by law: if compelled by a Malaysian court order or other legal requirement

7. Data Retention

We retain personal data only as long as necessary:

• Enquiry data (no engagement): deleted or anonymised after 12 months if no engagement follows
• Engagement data: retained for seven years from the date the engagement closes, to comply with Malaysian record-keeping requirements, after which it is securely destroyed
• Website usage data: retained in anonymised form for up to 26 months through analytics tools

8. Data Security

We take reasonable steps to protect your personal data from unauthorised access, loss, or disclosure. These measures include:

• Digital archives stored on password-protected platforms with role-based access controls
• Access restricted to Cairnrose staff and named family members only
• Physical documents held securely and not left unattended during transport
• Original documents sent by tracked courier where transit is necessary

If we become aware of a data breach that may affect your personal data, we will notify you as required under the PDPA 2010.

9. Your Rights Under Malaysian Law

Under the Personal Data Protection Act 2010, you have the following rights regarding your personal data held by Cairnrose:

• Right of access: you may request a copy of the personal data we hold about you
• Right of correction: you may request that inaccurate or incomplete data be corrected
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time
• Right to limit processing: you may ask us to restrict how we use your data in certain circumstances
• Right to lodge a complaint: you may contact the Department of Personal Data Protection Malaysia (JPDP) if you believe your rights have been infringed

To exercise any of these rights, contact us at [email protected] or by post to Jalan Gaya 17, 88000 Kota Kinabalu, Sabah. We will respond within 21 days.

10. Third-Party Links

Our website may contain links to other websites. We are not responsible for the privacy practices of those sites and recommend you read their policies independently before providing any personal data.

11. Children's Privacy

Our services are directed at adults aged 18 and above. We do not knowingly collect personal data from persons under 18. If you believe a minor has provided personal data through our website without appropriate consent, please contact us so we can remove it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the Last Updated date at the top of this page. Continued use of our website or services after a change constitutes acceptance of the updated policy. For significant changes, we will notify active engagement clients by email.

13. Contact for Data Enquiries

For any questions about this Privacy Policy or to exercise your data rights: