Privacy Policy

1. Introduction

Vellumkin ("we", "us", "our") is committed to handling personal data responsibly. This policy explains which personal data we collect when you use our website or engage our services, how we use it, how long we keep it, and what rights you have under Malaysian law.

Our services are clerical and educational in nature. We do not collect more personal data than is needed to arrange and complete appointments and to communicate with you about your enquiry.

2. Personal Data We Collect

We collect the following categories of personal data:

• Contact details: name, email address, and telephone number, provided when you submit the website enquiry form or contact us directly.
• Appointment notes: brief notes recorded during service sessions to allow us to complete the archive or register work. These notes relate to the documents you bring and do not include interpretation of their legal effect.
• Usage data: standard server logs (IP address, browser type, pages visited) collected automatically when you browse the website, used only for site maintenance and security.
• Cookie data: preferences stored in your browser relating to cookie consent. See Section 6 and our Cookie Policy for details.

Legal basis: We process contact details on the basis of your consent (enquiry form submission) and, once an engagement begins, on the basis of contractual necessity. Appointment notes are processed on the basis of contractual necessity. Usage data is processed on the basis of our legitimate interest in operating a functional, secure website.

Retention: Contact details and appointment notes are retained for 12 months from the close of the engagement and then destroyed. Server logs are retained for 90 days. Cookie consent records are held until you clear your browser data.

3. How We Use Personal Data

• To respond to your enquiry and schedule appointments.
• To carry out and complete the archive, briefing or register service you have engaged us for.
• To send appointment reminders and service-related communications.
• To maintain and improve the website.
• To comply with our obligations under Malaysian law.

We do not use personal data for direct marketing without your express consent, and we do not sell or rent personal data to any third party.

Third-party sharing: We share personal data only where necessary — with our web hosting provider (for server operations) and, if you consent to analytics cookies, with the analytics service named in our Cookie Policy. We do not share appointment notes or archive-related information with any third party.

4. How We Protect Personal Data

• The website uses HTTPS (TLS encryption) for all data in transit.
• Paper appointment notes are kept in a locked filing cabinet accessible only to Vellumkin staff.
• Digital records are stored on password-protected systems with access restricted to staff directly involved in the engagement.
• Paper records are shredded, and digital records are permanently deleted, at the end of the retention period.
• In the event of a data breach affecting your personal data, we will notify you and the relevant authority within the timeframe required by Malaysian law.

5. International Data Transfers

We process and store personal data in Malaysia. If any third-party service provider operates servers outside Malaysia, we take steps to ensure that data is handled in a manner consistent with the Personal Data Protection Act 2010 (PDPA). We do not knowingly transfer personal data to countries that do not provide an adequate level of protection without appropriate safeguards.

6. Cookies

We use cookies to maintain basic site functionality (essential cookies) and, with your consent, for analytics purposes. A cookie consent banner is displayed on your first visit. You can change your preferences at any time via our Cookie Policy page.

We do not use cookies for advertising or cross-site tracking.

7. Your Rights Under the PDPA 2010

Under Malaysia's Personal Data Protection Act 2010, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Ask us to correct inaccurate or incomplete personal data.
• Withdrawal of consent: Withdraw consent to processing where consent is the legal basis. This will not affect any lawful processing carried out before withdrawal.
• Restriction: Ask us to limit how we use your personal data in certain circumstances.
• Complaint: Lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP) if you believe your data has been handled unlawfully.

To exercise any of these rights, write to us at [email protected]. We will respond within 21 days.

8. Links to Third-Party Sites

Our website may contain links to external sites, including the practitioner directory resources we reference. We are not responsible for the privacy practices of those sites. We recommend reading the privacy policy of any external site before providing personal data.

9. Children's Privacy

Our services are intended for adults aged 18 and over who are managing family or estate matters. We do not knowingly collect personal data from individuals under 18. If you believe we have inadvertently collected data relating to a minor, please contact us at [email protected] and we will delete it promptly.

10. Changes to This Policy

We may update this policy from time to time. Changes will be published on this page with a revised Last Updated date. Where changes are material, we will notify active clients by email. Continued use of the website after a change is posted constitutes acceptance of the updated policy.

11. Contact for Data Enquiries

For any questions about this policy or how we handle your personal data, please contact our data point of contact: