General privacy information

Definitions

This section explains the principal terms used throughout the privacy policy and provides context for their use in scenarios such as client onboarding, incident response and vendor assessments.

Purposes of processing

We process personal data to provide legal services, manage relationships, secure systems and meet regulatory obligations. Each purpose is illustrated with practical examples where relevant.

• To provide and manage legal services, draft and review contracts and support negotiations in client engagements.
• To perform due diligence and vendor assessments in mergers, partnerships or procurement scenarios.
• To respond to security incidents and data breach scenarios, including triage, notification and remediation steps.
• To process payments, issue invoices and handle collections related to service fees.
• To communicate service updates, legal alerts and scenario-focused guidance requested by clients.
• To improve our services through analytics and feedback gathered from real case outcomes and user sessions.
• To comply with legal obligations, court orders or to defend our legal rights when disputes arise.
• To anonymise and aggregate data for research and training materials derived from case studies without identifying individuals.

Legal basis for processing

Processing is based on a combination of bases depending on the context: contractual necessity, consent, compliance with legal obligations, and legitimate interests tied to operational needs and security.

• Contract: processing necessary to provide the services you requested, such as drafting agreements or incident response.
• Consent: where you have agreed to receive marketing communications or optional services.
• Legal obligation: where data must be retained or disclosed to comply with laws or regulatory requests.
• Legitimate interests: for example securing our systems, preventing fraud, and improving services based on aggregated case data, subject to individuals' rights and assessments.

Cookies and similar technologies

We use cookies for essential site functions, analytics and optional preferences. Examples are provided from real scenarios such as session tracking during document uploads and anonymous analytics used to improve template utility.

Types include session cookies for login sessions, persistent cookies for preferences, and third-party analytics cookies used to assess site performance.

Categories: Essential (required for service), Performance (analytics), Functional (preferences) and Marketing (only with consent).

You can manage cookie preferences via your browser settings and any cookie banner controls. Disabling non-essential cookies may reduce functionality such as saved preferences or analytics-driven improvements.

Cookie policy

Data sharing

We share personal data only as necessary to deliver services or meet legal requirements, illustrated by examples such as engaging a forensic specialist during incident response or a payment processor for billing.

• Service providers and subcontractors engaged to perform tasks on our behalf, such as cloud hosting, analytics and payment processing.
• Professional advisers, including external counsels, forensic experts and accountants, for specific client matters.
• Regulators, courts or law enforcement when required by law or to comply with binding orders.
• Potential buyers or advisors in connection with a sale, merger or reorganisation, subject to confidentiality and limited use.
• Affiliates and partners when necessary to coordinate service delivery in multi-jurisdictional engagements.
• Aggregated or anonymised data may be shared for research or training without identifying individuals.

International transfers

Data may be transferred to service providers or partners located outside Malaysia when required to provide services, for example cloud hosts or specialist advisors in neighbouring jurisdictions. Transfers are managed with appropriate contractual safeguards and technical protections.

When data is transferred internationally we implement safeguards such as data processing agreements, encryption in transit and at rest, and where applicable, standard contractual clauses or industry-recognised contractual frameworks.

Data retention

Retention periods reflect operational needs, legal obligations and the context of specific engagements. Below are typical retention timeframes used in case scenarios.

Account records and client engagement files are retained while the account is active and for up to seven years after termination to meet contractual and statutory recordkeeping requirements related to professional services and tax.

Communications and case-related messages are retained for the duration of the engagement and typically for two years after case closure unless longer retention is required for legal reasons.

System logs and diagnostics used for security and incident contribute are retained for a rolling period, typically no longer than one year, except where a specific contribute requires longer preservation.

We retain personal data only as long as necessary for the purposes described in this policy and to meet legal, tax and accounting obligations. For active client matters, files are retained for the duration of the engagement and subsequently archived for up to seven years where required by Malaysian business practice. In practice: case files related to corporate formation and IP registration are kept for up to seven years after the matter closes; routine marketing contact data is retained until you unsubscribe; data justified solely for invoicing and tax is kept for statutory periods. You may request deletion of personal data when retention is no longer required for legal or legitimate business purposes. Deletion requests will be assessed against the need to preserve data for regulatory, contractual or defense reasons; where deletion is not possible, we will remove or anonymize data to the extent permitted by law and inform you of the reasons. Practical scenario: if an IT company requests deletion of contact information after a one-off consultation, we will remove active marketing entries and anonymize case notes while preserving minimal billing records if required by law.

Your privacy rights

Clients and contacts of ITNowLegal have specific rights over their personal data. We explain these rights below and give practical examples of how to exercise them in the context of legal service engagements.

• Right of access — you may request a copy of the personal data we hold about you. Example: a founder requests all files where their personal email appears in a corporate formation matter.
• Right to rectification — you can ask us to correct inaccurate or incomplete information. Example: update of company representative contact details used in a contract review.
• Right to erasure (deletion) — where retention is no longer necessary and no legal basis requires continued storage, you may request deletion. Example: removal of a marketing contact from our database after a completed advisory session.
• Right to restriction of processing — you may request limitations on how we process your data while a dispute about accuracy is resolved.
• Right to data portability — to the extent applicable, you can request a machine-readable copy of data you provided to us, useful when moving case management data to an alternative legal provider.
• Right to object — you may object to certain processing activities, including direct marketing, based on your particular situation.
• Right to withdraw consent — where processing is based on consent, you may withdraw that consent going forward; withdrawal does not affect processing completed before withdrawal.
• Right to lodge a complaint — if you believe your rights have been infringed, you may submit a complaint to ITNowLegal and, if unresolved, to the relevant supervisory authority.

How to make a rights request

Submit a rights request by postal mail to our registered address or via the contact form on ITNowLegal.club. Please include sufficient detail to identify the data and the right you wish to exercise and, where possible, supporting documentation. We will verify your identity before responding to protect privacy and confidentiality.

[email protected]

We aim to respond to straightforward requests within 30 calendar days. For complex requests or where additional verification is required, we may need up to 60 calendar days; we will communicate any extension and reasons in writing.