Privacy Policy

We collect personal data in the following ways:

Via our website contact form: Name, email address, and (optionally) telephone number and a written message. This data is collected when you submit an enquiry.

During engagement delivery: In the course of carrying out advisory work, we may collect and handle business and personal data provided to us by you or your organisation — including financial information, organisational charts, and information about third parties relevant to the engagement scope. This data is governed by the engagement agreement.

Via cookies and analytics: Our website may collect technical data (IP address, browser type, pages visited) through cookies and analytics tools. Please see our Cookie Policy for details.

The legal bases for processing are: (a) consent, where you have submitted a form or accepted cookies; (b) legitimate interest, for analytics and service improvement; and (c) performance of a contract, for data collected and used in the course of an engagement.

We use the personal data we collect for the following purposes:

• To respond to your enquiry and determine whether an engagement is appropriate
• To carry out advisory services you have engaged us to deliver
• To communicate with you about your engagement and any follow-on matters
• To maintain records required for our own legal and financial obligations
• To improve our website and understand how it is used (analytics data only)

We do not use your personal data for unsolicited marketing. We do not sell or rent your data to third parties.

We may share data with third-party service providers who assist us with IT, email delivery or document storage — only to the extent necessary and under confidentiality obligations. We may also share data where required by Malaysian law or regulatory authority.

Enquiry data (name, email, message) is retained for up to 24 months from the date of initial contact. If an engagement proceeds, data relating to the engagement is retained for 7 years from the engagement's conclusion, consistent with Malaysian accounting and tax record-keeping obligations.

After the applicable retention period, data is deleted or anonymised.

We take reasonable technical and organisational measures to protect the personal data we hold. These include access controls limiting data to those who need it, use of encrypted communication where applicable, and secure storage of client documents.

In the event of a data breach likely to affect your rights or interests, we will notify you and (where applicable) the relevant Malaysian regulatory authority in accordance with our legal obligations.

Under the Personal Data Protection Act 2010 (Malaysia), you have the following rights in relation to your personal data held by us:

• Right of access: to request a copy of the personal data we hold about you
• Right of correction: to request correction of inaccurate or incomplete data
• Right to limit processing: to request that we limit our use of your data in certain circumstances
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time
• Right to object: to object to processing for direct marketing purposes

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days. We may ask you to verify your identity before acting on a request.

If you are not satisfied with our response, you may lodge a complaint with Malaysia's Department of Personal Data Protection (JPDP) at www.pdp.gov.my.

For any privacy-related questions or to exercise your rights:

Tuah Advisory Sdn Bhd
5 Jalan Lintas, 88300 Kota Kinabalu, Sabah, Malaysia
Email: [email protected]
Phone: +60 8-8473 2691