Legal

Privacy Policy

Last Updated: 12 May 2025

This policy explains how Naungan ("we", "our", "us") collects, uses, and protects personal information you share with us when using our website or engaging our services. We take our obligations under Malaysia's Personal Data Protection Act 2010 (PDPA) seriously, and this document is written to be read — not filed away.

1. Personal data we collect

When you contact us through our website form or speak with us directly, we may collect the following:

Full name and contact details (email address, phone number)
Postal address (if relevant to your matter)
EPF (KWSP) or pension account information you choose to share
Identity document details, where required to process a claim on your behalf
Records of correspondence between you and our team
Website usage data through cookies and analytics tools (see Section 5)

Legal basis for processing: We process your data on the basis of your consent, performance of a service contract, or our legitimate interest in administering your enquiry or engagement. You may withdraw consent at any time without affecting the lawfulness of processing that has already taken place.

Retention: Enquiry data is held for 12 months. Engagement records, including correspondence with EPF or pension bodies, are retained for 7 years to comply with Malaysian legal record-keeping obligations, after which they are securely deleted.

2. How we use your personal data

We use your personal data only for the following purposes:

Responding to your initial enquiry and scheduling consultations
Delivering the pension advisory service you have engaged
Preparing correspondence with EPF, KWAP, or other pension bodies on your behalf
Sending you written updates regarding the progress of your matter
Maintaining our records in compliance with applicable Malaysian law
Improving our website and services through aggregated, anonymised analytics

We do not use your personal data for unsolicited marketing. If you consent to receive occasional updates about our services, you may withdraw that consent at any time by contacting us at [email protected].

Data sharing with third parties

We share your personal data only where necessary and with your awareness: EPF (KWSP), KWAP, or other pension bodies when submitting on your behalf; our IT service providers under strict confidentiality obligations; and where required by Malaysian law or regulatory authority. We do not sell, rent, or trade your personal information.

3. How we protect your data

Digital records are stored on encrypted, access-controlled systems
Physical documents are held in locked storage accessible only to authorised staff
Access to client files is limited to the advisor responsible for your matter and senior supervision
We conduct periodic reviews of our data security practices
In the event of a data breach that affects your personal information, we will notify you and the relevant authority within the timeframe required by Malaysian law

4. Cookies

Our website uses cookies to support basic functionality and to understand how visitors use the site. Essential cookies are necessary for the site to operate. Optional analytics and preference cookies are only placed with your consent. For full details and to manage your preferences, please read our Cookie Policy.

5. Your rights under the PDPA 2010

Under Malaysia's Personal Data Protection Act 2010, you have the following rights in relation to your personal data:

Right of access — you may request a copy of the personal data we hold about you.

Right of correction — you may ask us to correct inaccurate or incomplete data.

Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.

Right to limit processing — in certain circumstances you may request that we restrict how we use your data.

Right to lodge a complaint — if you believe your data has been handled incorrectly, you may raise a complaint with the Department of Personal Data Protection Malaysia (JPDP) at www.pdp.gov.my.

To exercise any of these rights, write to us at [email protected]. We will respond within 21 days.

6. Links to external sites

Our website may contain links to external websites such as EPF's official portal or government resources. We are not responsible for the privacy practices of those sites and encourage you to review their policies independently.

7. Children's privacy

Our services are intended for adults aged 18 and above. We do not knowingly collect personal data from anyone under 18. If we become aware that a minor has submitted personal data, we will delete it promptly.

8. Updates to this policy

We may revise this policy from time to time. Any material changes will be communicated by updating the "Last Updated" date at the top of this page. Continued use of our website or services after a revision constitutes acceptance of the updated policy.

9. Contact us about your data

If you have any questions about this policy or how we handle your personal information, please contact our data matters team:

Naungan

[email protected]

+60 12-376 4825

Level 6, Menara KEN TTDI, Jalan Burhanuddin Helmi, 60000 Kuala Lumpur, Malaysia