Privacy Policy

1. Introduction

Kestrel Ledger ("we", "us", "our") is committed to handling personal data responsibly and in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA). This policy explains what data we collect when you use our website or engage with our services, how we use it, and what rights you have in relation to it.

Our services cover the administrative organisation of retirement-related documents, guided form preparation, and group education sessions. In the course of providing these services we handle documents that contain personal information, and we take that responsibility seriously.

Questions about this policy may be directed to: [email protected]

2. Data We Collect

We collect personal data in the following ways:

• Contact enquiries: Name, email address, and telephone number submitted via the website contact form or email.
• Service delivery: During an Organisation Session or Preparation Support engagement, we handle personal documents provided by the client. These may include identification copies, contribution statements, and employer correspondence. We do not retain copies of these documents after the session unless written retention consent is given.
• Workshop registration: Name, email, and employer name for group session participants.
• Website usage: Standard server logs and, if cookie consent is given, basic analytics data (page views, device type, approximate location by country).

Legal basis for processing: consent (contact form, cookies), contract performance (service delivery), and legitimate interest (improving service quality).

Retention: Contact enquiry data is retained for 24 months from the date of last contact. Workshop registration data is retained for 12 months. Document scan data is deleted from our systems within 30 days of session completion unless written retention consent is given.

3. How We Use Personal Data

• Responding to enquiries and booking appointments
• Delivering the service for which you have engaged us
• Sending session reminders and follow-up communications where agreed
• Improving website content and service quality through anonymised analytics
• Meeting legal and regulatory obligations under Malaysian law

We do not use personal data for unsolicited marketing purposes. We do not sell, rent, or trade personal data with third parties for commercial purposes.

4. Data Sharing

We do not share personal data with third parties except in the following limited circumstances:

• Service providers: Our website may use third-party analytics tools (such as Google Analytics). These operate under their own privacy policies and data processing agreements.
• Legal requirement: Where required by Malaysian law or a lawful order from a competent authority.

No personal data is transferred outside Malaysia except where necessary to operate standard internet services (such as cloud hosting), in which case we ensure appropriate data processing agreements are in place.

5. Data Protection Measures

• Physical documents handled only in secure office or client premises environments
• Digital scans stored in password-protected folders and encrypted at rest
• Access to personal data limited to staff directly involved in your engagement
• Data breaches reported to affected clients and the relevant authority in accordance with PDPA requirements
• Staff briefed on confidentiality obligations as part of their engagement terms

6. Cookies

Our website uses cookies to maintain basic functionality and, with your consent, to collect anonymised analytics data. Essential cookies cannot be disabled as they are necessary for the site to function. Optional analytics and preference cookies can be managed via the cookie preferences control on this site. See our Cookie Policy for full details.

7. Your Rights Under Malaysian PDPA

Under the Personal Data Protection Act 2010, you have the right to:

• Access personal data we hold about you
• Request correction of inaccurate data
• Request deletion of data where there is no longer a lawful basis for retention
• Withdraw consent for processing at any time (this does not affect the lawfulness of processing before withdrawal)
• Object to processing based on legitimate interest
• Lodge a complaint with the Personal Data Protection Department (PDPD) of Malaysia

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days.

8. Third-Party Links

Our website may contain links to external websites, including official government portals such as the EPF member portal. We are not responsible for the privacy practices of external sites and encourage you to read their privacy policies before submitting personal information.

9. Children's Privacy

Our services are directed at adults aged 18 and above. We do not knowingly collect personal data from minors. If you believe personal data of a minor has been submitted to us, please contact us and we will delete it promptly.

10. Policy Updates

We may update this policy from time to time to reflect changes in our practices or applicable law. The date at the top of this page indicates when it was last revised. Continued use of our website or services after a policy update constitutes acceptance of the revised terms.

11. Contact

Data controller: Kestrel Ledger
Address: Level 21, Menara Binjai, 2 Jalan Binjai, 50450 Kuala Lumpur, Malaysia
Email: [email protected]
Telephone: +60 3-2181 4790