What data we collect

We collect data directly from users, automatically during website interaction, and from third parties when necessary for service delivery. Collection follows a need-to-know principle: we only request data required to deliver a specific service or comply with legal obligations.

Data you provide

When you contact BizHubLaw, register for services, or submit documents, we may collect the following categories of personal data to handle your request effectively.

• Identity and contact details: name, business name, email address, phone number, business ID where applicable.
• Transactional data: invoices, payment confirmations, contract drafts and signed agreements.
• Case-specific documentation: incorporation documents, licenses, permits, IP filings, correspondence relevant to legal matters.
• Communications: messages, call notes and meeting summaries platform during engagements.
• Sensitive data only where necessary and relevant to the legal matter (for example employment disputes) and handled with strict access controls and explicit legal basis.
• Marketing preferences and consent choices to receive newsletters or promotional updates from BizHubLaw.

Automatically collected data

When you visit our website, we gather technical and usage information to maintain and improve our services, secure the site and analyze trends.

• Device and browser information such as IP address, browser type, and operating system.
• Usage data including pages visited, time spent on pages, referral sources and click paths.
• Cookie identifiers and analytics metrics used to measure site performance.
• Error and diagnostic data related to technical issues that occur during site use.
• Geolocation data inferred from IP for regionalization and fraud prevention.
• Aggregated or anonymized data used for service improvement and reporting.

Data from third parties

We may receive information from trusted third parties where necessary to provide services or comply with legal obligations, and we assess such sources before relying on them.

• Payment processors for invoice settlement and transaction verification.
• Identity verification services used during client onboarding where required by regulation.
• Professional advisors and counterparties when handling multi-party matters or obtaining expert input.

Legal basis for processing

We rely on legitimate bases for processing personal data, depending on the purpose and the context of the interaction. These bases include contract performance, compliance, consent and legitimate interests.

• Contractual necessity — processing required to perform a contract with a client, such as drafting agreements or filing IP applications.
• Legal obligation — processing to comply with statutory duties, regulatory inquiries or court orders.
• Consent — where we ask for explicit permission (for example marketing communications) and you can withdraw consent at any time.
• Legitimate interests — where processing supports business operations like fraud prevention, security and communications while balancing individual rights.

Cookies and similar technologies

We use cookies to support core website functions, measure performance and deliver a smoother user experience. You can manage cookie preferences through your browser or via the cookie control on the site.

Types include essential cookies for site functionality, analytics cookies to track anonymized usage patterns, and preference cookies that remember display settings. We do not use cookies to collect sensitive personal data without consent.

Essential, Performance/Analytics, Preferences and Marketing (only where consent is provided). Essential cookies are required for basic operations and cannot be disabled without affecting site function.

To manage cookies, use your browser settings to block or delete cookies, or use the cookie preference tool available on our website. Disabling non-essential cookies may limit some features.

Cookie Policy and controls

How we share data

We share personal data only for specified purposes and with appropriate safeguards. Third party access is limited to what is necessary for service delivery or legal compliance.

• Service providers such as payment processors, cloud storage and document management platforms under written data processing terms.
• Professional advisors, forensic experts or translators engaged to support a specific client matter.
• Regulatory and law enforcement authorities when required by applicable law or court order.
• Counterparties in legal matters where exchanging documents and evidence is necessary for case progression.
• Business partners and event organizers for joint marketing activities only when consent has been provided.
• Aggregated or anonymized information that cannot be reasonably linked to an individual for reporting and improvement.

International data transfers

Some third-party services we use operate servers outside Malaysia. Where personal data is transferred internationally, we rely on appropriate safeguards such as contractual measures and, where applicable, recognized transfer mechanisms to protect data.

Safeguards include data processing agreements, standard contractual clauses where suitable, access restrictions, and technical controls to limit exposure. We review third-party practices before transferring personal data abroad.

Data retention

We retain personal data only as long as necessary for the purpose it was collected, for legal compliance, or to resolve disputes. Retention periods reflect operational needs and statutory obligations.

Client account records and corporate filings are typically retained for a minimum period required by Malaysian law and professional standards, generally no less than seven years for accounting and tax related records.

Communications and case notes are kept for the duration of the matter plus a retention period that supports dispute resolution and professional obligations, commonly between three to seven years depending on the subject matter.

Technical logs and analytics data are retained in aggregated or anonymized form for performance analysis. Raw logs are retained only as long as required to contribute security incidents or maintain service integrity.

When retention periods expire, data is securely deleted or anonymized. Clients may request earlier deletion where it does not conflict with legal, regulatory or contractual requirements.

Security measures

BizHubLaw applies administrative, technical and physical safeguards to protect personal data. Access is role-based, systems use encryption where appropriate, and security practices are reviewed periodically. We maintain incident response procedures to address potential breaches promptly and inform affected parties as required by applicable law.

• Encryption of sensitive data in transit using industry-standard TLS and encryption at rest for selected storage.
• Role-based access controls, two-factor authentication for administrative accounts and periodic access reviews.
• Staff training on data handling, confidentiality protocols and incident response simulations to maintain readiness.

Your privacy rights

Individuals have certain rights regarding their personal data. The scope of rights may vary by jurisdiction and the legal basis for processing. We provide practical instructions to exercise rights below.

• Right to access — request confirmation and a copy of personal data we hold.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion where processing is no longer necessary and no overriding legal reason exists to retain data.
• Right to restriction of processing — request limitation of processing under certain conditions.
• Right to data portability — receive personal data in a structured, commonly used format where applicable.
• Right to object — object to processing based on legitimate interests or direct marketing in certain cases.
• Right to withdraw consent — where processing is based on consent, withdrawal stops further processing without affecting prior actions.
• Right to lodge a complaint with a supervisory authority if you consider your rights have been infringed.

How to make a rights request

To exercise any data subject right, contact our privacy team with a clear description of your request and sufficient information to verify your identity. We may ask for additional details to locate records and ensure security. Contact details are provided below.

[email protected]

We aim to respond to rights requests within 30 days. Complex requests or those requiring verification may take longer, but we will inform you if additional time is needed.

Marketing communications

BizHubLaw may send email updates, legal briefings and event invitations relevant to entrepreneurs and small businesses in Malaysia. Communications are based on your consent or legitimate interest where allowed. Use-case example: subscribing to a monthly compliance bulletin that summarises recent Companies Act updates and practical steps for small business owners.

You can opt out at any time using the unsubscribe link in emails or by contacting us at [email protected]. Unsubscribe requests received by BizHubLaw are processed promptly; transactional messages about an ongoing engagement may continue while legal or contractual matters are active.

Children's privacy

BizHubLaw provides professional services to entrepreneurs and small businesses and does not target services to children. Individuals under 18 should not create accounts or submit personal data without consent from a parent or legal guardian. If BizHubLaw becomes aware that a minor’s personal data has been collected without appropriate consent, we will take steps to remove it where lawful and practicable.

Third-party links and vendors

BizHubLaw may link to or integrate with third-party service providers such as corporate registries, payment processors and specialist advisors. These third parties have their own privacy practices. Example: when we submit company incorporation documents to the Companies Commission, that body will handle registration data under its own rules. BizHubLaw is not responsible for third-party privacy practices.