Privacy Policy

1. Introduction

Legatum ("we", "us", "our") is committed to protecting the personal data of individuals who use our estate and heirloom records support service or visit our website. This policy explains what personal data we collect, why we collect it, how we use it, and the rights available to you under the Personal Data Protection Act 2010 (Malaysia) ("PDPA").

This policy applies to all personal data collected through our website at legatumb.pro, through our contact form, and during the delivery of our programmes. If you have questions about anything in this policy, please write to us at [email protected] before engaging our services.

2. Data We Collect

Personal data you provide directly

• Full name and contact details (email address, telephone number)
• Correspondence you send us through the enquiry form or by email
• Details about the scope or context of a potential engagement, as described voluntarily

Data collected automatically

• Basic website analytics (pages visited, browser type, approximate location) via cookies, if you have consented
• Server logs including IP address and access timestamps, retained for up to 90 days

Data we do not collect

We do not collect financial data, identity document numbers, or any information about the contents of household documents handled during a programme. Materials encountered during sessions are not recorded, photographed or noted by Legatum for its own purposes.

3. Legal Basis and Purpose of Processing

Under the PDPA, we process your personal data on the following bases:

• Consent — when you submit an enquiry form or accept cookies on our website
• Contractual necessity — to communicate with you about a programme you have engaged or are considering
• Legitimate interest — to respond to direct correspondence and maintain basic website security logs

We use your personal data to: respond to your enquiry; arrange and confirm sessions; send programme-related documents; and, where you have consented, to notify you of changes to our services. We do not use personal data for direct marketing without explicit consent, and we do not sell personal data to any third party.

4. Data Retention

Enquiry correspondence is retained for 24 months from the date of last contact. Client engagement records (session notes, correspondence) are retained for 36 months after a programme concludes, after which they are securely deleted. Website server logs are deleted after 90 days. You may request earlier deletion at any time (see Section 7).

5. Data Sharing and Third Parties

We do not sell, rent or share personal data with third parties for commercial purposes. Personal data may be shared only in the following limited circumstances:

• With our website hosting provider for the purpose of delivering the website, under a data processing agreement
• With analytics providers where you have consented to analytics cookies
• Where required by Malaysian law or a competent authority

We do not transfer personal data outside Malaysia except where your email provider's infrastructure requires it for message delivery (which is outside our control).

6. Cookies

Our website uses cookies for basic functionality and, with your consent, for analytics. Essential cookies cannot be disabled as they are necessary for the website to function. Optional analytics and preference cookies are only placed if you accept them through our cookie banner.

For full details, including how to manage your preferences, see our Cookie Policy.

7. Your Rights Under the PDPA

Under the Personal Data Protection Act 2010 (Malaysia), you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete personal data
• Withdraw consent for processing based on consent (this does not affect prior processing)
• Request that we cease processing your data for direct marketing purposes
• Request deletion of data we no longer have a lawful reason to retain

To exercise any of these rights, write to us at [email protected]. We will respond within 21 days. We may need to verify your identity before fulfilling a request.

If you are dissatisfied with how we handle your personal data, you may lodge a complaint with the Department of Personal Data Protection Malaysia (pdp.gov.my).

8. Data Security

We take reasonable steps to protect personal data against unauthorised access, loss or disclosure. These include: access restricted to authorised personnel only; use of encrypted email where possible; secure deletion of data when retention periods expire. No internet transmission is completely secure, and we cannot make absolute assurances about data transmitted to us online.

In the event of a data breach that is likely to affect your rights, we will notify you and the relevant authority in accordance with our obligations under the PDPA.

9. Third-Party Links

Our website may contain links to external websites (for example, Google Maps). We are not responsible for the privacy practices of those sites and encourage you to review their policies before providing personal data to them.

10. Children's Privacy

Our services are directed at adults aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If you believe a minor has provided us with personal data, please contact us at [email protected] and we will delete it promptly.

11. Changes to This Policy

We may update this policy from time to time. The current version will always be available at this URL with the date of the most recent revision. We will notify clients of material changes by email where we hold a valid address. Continued use of our website or services after a change constitutes acceptance of the updated policy.

12. Contact

For privacy-related questions or to exercise your rights:

• [email protected]
• 11 Jalan PJU 5/20, Kota Damansara, 47810 Petaling Jaya, Selangor, Malaysia
• +60 3-6142 8375