Privacy Policy

Summary

We are committed to protecting your privacy. This policy outlines how we collect, use, and protect your personal data in compliance with the Malaysian Personal Data Protection Act (PDPA) 2010. We collect data to provide our services, comply with legal obligations, and improve our website. We do not sell or trade personal data. You have rights over your data, including the right to access and correct it.

1. Our Role and Contact Details

Saifudin & Co. ("SNCO", "we", "us" or "our") is the data user for personal data we collect via the Site or during client onboarding.
General Enquiries: enquiry@saifudinco.com
Postal Address: B-11-5, Plaza Mont Kiara 2, Jalan Kiara, Mont Kiara, 50480 Kuala Lumpur, Malaysia

2. Personal Data We Process

  • Client and Counterparty Data: Identification data (e.g., name, NRIC/passport number), contact details, financial information, tax details, and information required for Anti-Money Laundering (AML) and Counter-Financing of Terrorism (CFT) checks.
  • Website and Communications Data: IP address, device and browser type, cookie data, and information you provide through our website forms. For details of the cookies we use, see our Cookie Policy.
  • Sensitive Personal Data: We only process sensitive personal data (as defined by the PDPA) where it is lawful to do so and with appropriate safeguards and/or your explicit consent.

3. Basis for Processing Under the PDPA 2010

We process your personal data on the bases recognised under the Personal Data Protection Act 2010, namely:

  • your consent (for example, for marketing communications);
  • where processing is necessary for the performance of a contract with you, such as providing professional services set out in our engagement letter;
  • where processing is necessary to comply with a legal or regulatory obligation (for example, under the Companies Act 2016, the Income Tax Act 1967, or anti-money-laundering legislation); or
  • where processing is otherwise permitted under the General Principle in section 6 of the PDPA 2010.

4. Purposes of Processing

  • Service delivery and client onboarding.
  • Compliance with law and regulation (PDPA, AML/CFT, tax, company law, and MIA professional requirements).
  • Business operations (billing, IT, security, quality control).
  • Use of AI Tools: We may use secure artificial intelligence (AI) tools, including large language models, to assist with drafting, research, and analysis, always under the supervision and review of qualified professionals. Any personal or client information processed through AI tools is handled in accordance with the PDPA 2010 and our professional confidentiality obligations under the MIA By-Laws. Engaging our services may involve the use of such tools as part of our standard working methods. If you do not wish your data to be processed using AI tools, you may notify us in writing at any time and we will accommodate your request where reasonably practicable.
  • Marketing and communication (with your consent).
  • Website analytics and improvement.

5. Data Sharing and International Transfers

We share data only with trusted service providers, professional advisers, and regulatory authorities, subject to strict confidentiality and data-protection safeguards. We do not sell or trade personal data, and we only disclose it as described in this Policy or as required by law. Where we transfer your data outside Malaysia (for example, for cloud storage), we take steps to meet the cross-border transfer requirements of the PDPA 2010 (as amended).

6. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

  • Client Records: at least 7 years from the end of the engagement, in line with statutory record-keeping requirements under Malaysian tax and companies legislation (for example, the Income Tax Act 1967 and the Companies Act 2016).
  • Website and Communications Data: typically 12–24 months.
  • Marketing Data: until you withdraw your consent.

7. Your Rights Under the PDPA 2010

Under the PDPA 2010 you have the right to:

  • Access: request a copy of the personal data we hold about you;
  • Correction: request that we correct inaccurate or incomplete personal data;
  • Withdraw Consent: where we process your data based on consent, withdraw that consent at any time;
  • Prevent Processing: require us to cease processing that is likely to cause you damage or distress, subject to the exceptions in the Act.

We will consider requests to delete personal data on a case-by-case basis; we may be required to retain certain records to comply with other Malaysian laws even after a request to withdraw consent. To exercise any of these rights, contact us at enquiry@saifudinco.com.

8. Children’s Data

We do not knowingly collect personal data from children under the age of 18.

9. Data Breach Notifications

In the event of a personal data breach, we will assess the risk to affected individuals and notify the Department of Personal Data Protection (JPDP) and affected individuals where required under the Personal Data Protection Act 2010 (as amended), within the period prescribed by law.

10. How to Make a Complaint

If you have any concerns about our privacy practices, please contact us first. You also have the right to lodge a complaint with the JPDP.

Last reviewed: 19 July 2026