Legal

This Privacy Statement is for HLB Ler Lum PLT (referred to as “our”, “we” or “us” in this Privacy Statement) and shall highlight the manner we handle your Personal Data (as defined under the Personal Data Protection Act 2010 (Act 709)) (“PDPA”) provided to us (“Personal Data”), in accordance with the PDPA, the Personal Data Protection Regulations 2013, the Personal Data Protection Standard 2015 and the laws of Malaysia.

In the course of our dealings and transactions with you, we may need to collect, use, manage, disclose and/or process your Personal Data collected through information or documents provided by you in writing, over the telephone, electronically by instant messaging, or through email. E.g. your name, national registration identity card/passport number, gender, nationality, race, date of birth, contact number, fax number, residential address, email address, work address, occupation details, bank account details, financial information, personal data from governmental agencies and regulators, recording of your image via our closed-circuit televisions (CCTV) during your visit to our premises, or such other relevant information required depending on the nature of dealings or transactions to facilitate the provision of our services to you.

By submitting your personal information to us, we deemed acceptance from you for the process by us of your personal information in accordance with the practices and principles laid down in this Privacy Statement.

“Process”, “Processed” or “Processing” mean we collect, record, hold or store Personal Data or carry out any operation or set of operations on your Personal Data, including:-

(a)          the organisation, adaptation or alteration of your Personal Data;

(b)          the retrieval, consultation or use of your Personal Data;

(c)          the disclosure of your Personal Data by transmission, transfer, dissemination or otherwise making available; or

(d)          the alignment, combination, correction, erasure or destruction of your Personal Data.

We shall process your Personal Data in conformity with the following principles deriving from the Personal Data Protection Principles laid down in the PDPA (“Principles”):-

(1)          General Principle:

We shall first obtain your written consent before we proceed to collect and process your Personal Data. We maintain that Personal Data collected shall be adequate, relevant, not excessive, necessary and for a lawful purpose directly related to the activity for which Personal Data is collected or processed.

Notwithstanding the above, consent is not required if the processing of your Personal Data is:-

(a)          for the performance of a contract to which you are a party:

(b)          at your request for the entering into a contract with us;

(c)          for compliance with any of our legal obligation, other than one stipulated under a contract;

(d)          for the protection of your vital interest;

(e)          for the administration of justice; or

(f)          for the exercise of any functions conferred on any person by or under any law, such as, complying with a court order.

To facilitate the provision of our services to you, we may need to collect your Personal Data directly from you or indirectly from third parties we are dealing with or are associated to you for whom you have given your prior consent for such disclosure of your Personal Data, including but not limited to your representatives, agents, employers, creditors, financiers, any party with whom you have entered into a contract/agreement and/or the other departments of HLB Ler Lum PLT, in relation to a matter/project handled by us. Your Personal Data may be collected in various forms, whether in electronic or hardcopy format, including but not limited to tender-related documents, agreements you have entered into, letters, emails, facsimiles, forms, invoices, statement of accounts, correspondences, business cards etc.

The Personal Data Protection Regulations 2013 provides that consent, whether express or implied, must be obtained in any method capable of being recorded and maintained by us, e.g. deemed consent, verbal consent, consent by way of conduct/performance etc.

Implied/Deemed Consent

Consent is deemed given to us by way of conduct/performance if:-

(a)          you do not object to the processing of your Personal Data;

(b)          you voluntarily disclose your Personal Data; or

(c)          you proceed to engage our services.

Third Party Consent

For Personal Data of third parties collected from you, e.g. your financiers, agents, representatives, attorneys, emergency contact person and etc., we deemed that you have first procured the consent of such third parties prior to the disclosure of their Personal Data to us.

(2)          Notice and Choice Principle:

We will inform you in writing of the purposes for which we process, collect or disclose your Personal Data. We will provide alternatives to you, i.e. by opting in or opting out, whether your Personal Data may be disclosed by us to a third party or used by us for a purpose other than the purpose for which your Personal Data was originally collected.

Below are the purposes we may collect and process your Personal Data for (please note that the list is non-exhaustive):-

(a)          For verification purposes in regard of your identity, credibility, ownership of an asset so claimed by you and etc.;

(b)          For the facilitation of our services to process your claim;

(c)          For communication and notification purposes;

(d)          For investigations and inquiries purposes to resolve complaints lodged by you;

(e)          For the prevention and deterrence of any potential fraudulent, unlawful, illegal and criminal activities;

(f)          For compliance of any legal and regulatory requirements; and/or

(g)          For any other miscellaneous purposes permitted and/or required under the relevant laws, regulations, by-laws, guidelines and standards laid down by the relevant regulatory authorities.

(3)          Disclosure Principle:

We will only disclose Personal Data in compliance with any statutory or contractual requirements and for the purposes authorised by you. We will not, in the absence of your consent, disclose Personal Data to any party other than the class of third parties to whom we have informed you in writing of such disclosure. We will ensure that the disclosure of your Personal Data shall only be restricted to our employees who are authorised under their employment contracts to process your Personal Data conforming to the requirements of their jobs.

Your Personal Data may also be disclosed to the following relevant third parties in accordance with the laws of Malaysia:-

(a)          the Government of Malaysia and/or any relevant law enforcement agencies;

(b)          individuals, companies, organisations, bodies and/or associations acting in their capacity as our agents, representatives, attorneys, service providers, advisers and/or contractors; or

(c)          other parties to whom have procured your expressed or implied consent for such disclosure of your Personal Data in accordance to any applicable laws, regulations, by-laws, standards and etc.

Circumstances where we may disclose your Personal Data for any other purpose other than the purpose for which your Personal Data was to be disclosed are that:-

(a)          Such disclosure was consented by you; or

(b)          Such disclosure is necessary to prevent or detect a crime or for investigation purposes; or

(c)          Such disclosure is required or authorised by law or by a court order;

(d)          Such disclosure was under our reasonable belief that we had in law the right to do so;

(e)          Such disclosure is based on our reasonable belief will be consented by you or that we had in law the right to do so; or

(f)          Such disclosure is justified in concern of the public interest as determined by the relevant Minister charged with the responsibility for the protection of personal data.

(4)          Security Principle:

We adopt practical measures to safeguard the confidentiality and security of all Personal Data, including pertinent organisational and technical advances to secure your Personal Data from any accidental loss, damage, misuse, modification, unauthorised or accidental access or disclosure, alteration or unlawful destruction, in conformation with the security standards laid down under Clauses 4 and 5 of the Personal Data Protection Standard 2015, having regard:-

(a)          to the nature of your Personal Data and the harm that would result from such loss, misuse, modification, unauthorised or accidental access or disclosure, alteration or destruction;

(b)          to the place or location where your Personal Data is stored;

(c)          to any security measures incorporated into any equipment in which your Personal Data is stored;

(d)          to the measures taken for ensuring the reliability, integrity and competence of our employees having access to your Personal Data; and

(e)          to the measures taken by us for ensuring the secure transfer of your Personal Data.

(5)          Retention Principle:

We will not retain your Personal Data for periods longer than is necessary for the fulfilment of the purpose for which your Personal Data is collected.  We will adopt all reasonable efforts to ensure that the retention of your Personal Data shall only for so long as the data is required to comply with our obligations to you or our obligations under Malaysian law or upon our receipt of your request for the deletion or alteration of your Personal Data, in conformation with the retention standard laid down under Clause 6 of the Personal Data Protection Standard 2015 and other applicable laws governing the duration of the retention of information and/or documents.

(6)          Data Integrity Principle:

We will ensure that your Personal Data is accurate, complete, not misleading and kept up-to-date, having regard to the purpose for which the data was collected and processed, in conformation with the data integrity standard laid down under Clause 7 of the Personal Data Protection Standard 2015.

(7)          Access Principle:

We allow your access to your Personal Data held by us to make any necessary correction, deletion or rectification on your Personal Data which is inaccurate, incomplete, misleading or not up-to-date, by submitting a written request to us via our email address or postal address as set out below, to request for a copy or to make correction of your Personal Data held by us.

Your written request shall state your name, contact number, correspondence address and brief details of the Personal Data you wish to access to or to make correction on. There will be imposition of fee to facilitate a data access request but such fee will not exceed the statutory maximum permitted under First Schedule of the Personal Data Protection (Fees) Regulations 2013. For any correction of Personal Data, no charges will be imposed. You may submit a written request informing us on the inaccurate or outdated Personal Data and provide the correct and up-to-date Personal Data to us in order for us to update the same in our system. Upon submission of your written data access/correction request and payment of the relevant prescribed fee (if applicable) made to us, we shall comply with such request not later than 21 business days from the date of receipt of the data access/correction request.

We may reject your data access/correction request upon the occurrence of events laid down in Section 32 (data access request) and Section 36 (data correction request) of the PDPA.

Circumstances where we may refuse to comply with a data access request:-

(a)          we are unable to verify your identity as we are not supplied with necessary information as we may reasonably require (e.g. your name, identification card number, address and etc.);

(b)          we are not supplied with sufficient information as we may reasonably require to locate your Personal Data;

(c)          the  burden or expense of providing access to the Personal Data is disproportionate to the risks to your privacy in relation to the relevant Personal Data in question (e.g. the amount of time and cost to be incurred by us as opposed to the significance of the Personal Data requested);

(d)          we are unable to comply with your data access request without disclosing another individual’s Personal Data, unless that individual in particular has consented to such disclosure or we deemed it reasonable to comply with your data access request without obtaining prior consent of the aforementioned individual;

(e)          we are prohibited by another data user processing your Personal Data from complying with your data access request;

(f)          providing access is in violation of a court order;

(g)          providing access would disclose confidential commercial information; or

(h)          such access to your Personal Data is regulated by another law other than the PDPA.

Circumstances where we may refuse to comply with a data correction request:-

(a)          we are unable to verify your identity as we are not supplied with necessary information as we may reasonably require (e.g. your name, identification card number, address and etc.);

(b)          we are not supplied with necessary information as we may reasonably require to determine how the Personal Data to which your data correction request relates is inaccurate, incomplete, misleading or not up-to-date;

(c)          we are not satisfied that the Personal Data to which your data correction request relates is inaccurate, incomplete, misleading or not up-to-date;

(d)          we are not satisfied that the correction which is the subject of the data correction request is accurate, complete, not misleading or up-to-date; or

(e)          we are prohibited by another data user processing your Personal Data from complying with your data correction request.

We reserve the right at any time to update and modify the content of this Privacy Statement and shall notify and announce such update and modification through this website. Changes made to this Privacy Statement shall be effective from the date on which they are posted and shall supersede over all previous versions of the Privacy Statement published.

Complaints or queries on any aspect of this Privacy Statement may be made in writing to our email address or postal address as set out below:-

Postal Address: B-3-11, Megan Avenue II, 12, Jalan Yap Kwan Seng, 50450 Kuala Lumpur

Attention to: Personal Data Protection Officer

Email Address: admin@lerlum-hlb.com

This Privacy Statement was last modified on 19th March 2018