Privacy Policy

1. Introduction

Meriwether & Co ("the firm", "we", "us") is committed to handling personal data with care. This policy sets out how we collect, use, store, and protect personal data when you engage with us through our website or in the course of an engagement.

The firm's practice is subject to the Personal Data Protection Act 2010 (PDPA) of Malaysia, which governs the processing of personal data in commercial transactions. For questions about this policy, please contact us at [email protected].

2. Data we collect

When you contact us through this website, we may collect the following:

• Full name
• Email address
• Telephone number (if provided)
• Description of the legal matter or enquiry
• Technical information such as IP address, browser type, and pages visited (collected automatically via server logs or analytics tools)

We collect personal data directly from you when you submit an enquiry form, send an email, or telephone the firm. We do not collect personal data from third-party sources or purchase data lists.

3. Legal basis for processing

Under the PDPA 2010, the firm processes personal data on the following bases:

• Consent: Where you submit an enquiry form, you consent to the firm processing your contact information for the purpose of responding to your enquiry.
• Contractual necessity: Where an engagement is established, processing is necessary for the performance of that engagement.
• Legal obligation: The firm may process data where required by the Legal Profession Act 1976 or other applicable Malaysian legislation.
• Legitimate interests: The firm may process data where there is a legitimate interest in doing so that is not overridden by your rights, for example in maintaining records of completed engagements.

4. How we use your data

Personal data collected is used for the following purposes:

• Responding to enquiries about the firm's services
• Managing and performing client engagements
• Maintaining records as required by professional obligations under the Malaysian Bar
• Improving the firm's website and understanding how it is used
• Complying with legal and regulatory obligations

We do not use your personal data for marketing to third parties and do not sell personal data.

5. Data retention

The firm retains personal data for the following periods:

• Enquiry data (no engagement established): up to 12 months from the date of enquiry
• Client engagement data: 7 years from the conclusion of the engagement, in accordance with professional record-keeping obligations
• Website technical data: up to 12 months, depending on the analytics service used

After the applicable retention period, data is securely deleted or anonymised.

6. Cookies

This website uses cookies to understand how the site is used and to remember certain preferences. Please see our Cookie Policy for details of the cookies used and how to manage them.

7. Sharing of personal data

The firm does not share personal data with third parties except in the following circumstances:

• With service providers who assist in operating this website (for example, web hosting providers), under agreements requiring them to protect the data
• Where disclosure is required by Malaysian law, regulation, or a court order
• With the Bar Council of Malaysia or other regulatory body where required by professional obligations

8. Security measures

The firm applies reasonable technical and organisational measures to protect personal data against unauthorised access, disclosure, or loss. This includes use of secure connections (HTTPS) for the website and access controls on systems containing client data. In the event of a data breach affecting your personal data, the firm will notify you and, where required, the relevant authority in accordance with applicable Malaysian law.

9. Your rights

Under the PDPA 2010 and as a matter of the firm's practice, you have the following rights in respect of your personal data:

• Right of access: You may request a copy of personal data held about you.
• Right of correction: You may request correction of inaccurate personal data.
• Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time. This does not affect the lawfulness of processing before withdrawal.
• Right to limit processing: You may request that the firm limit processing of your data in certain circumstances.

To exercise any of these rights, please write to [email protected]. Requests will be acknowledged within 14 days and responded to within 21 days.

10. Third-party links

This website may contain links to external websites. The firm is not responsible for the privacy practices of those sites and recommends reviewing their privacy policies separately.

11. Children's privacy

The firm's services are directed at businesses and their principals. The firm does not knowingly collect personal data from persons under 18 years of age.

12. Changes to this policy

The firm may update this policy from time to time. Material changes will be noted on this page with an updated date. Continued use of the website following such changes constitutes acceptance of the revised policy.

13. Contact

For questions about this policy or about personal data held by the firm:

Meriwether & Co
Level 19, Mercu UEM, Jalan Stesen Sentral 5, 50470 Kuala Lumpur
Email: [email protected]
Telephone: +60 3-2271 9486