1. Scope and controller
This policy applies to the Bond Law Firm website, email enquiries and other online interactions that expressly refer to it. The controller is the law firm legal entity that operates this website and determines the purposes and means of processing.
Controller: Bond Law Firm. Privacy-related matters may be submitted through the website Contact page. Client-matter processing may also be governed by engagement terms, professional duties and a matter-specific notice.
2. Personal data we may collect
- Data you provide: name, role, organisation, email, telephone, location, preferred language, enquiry details and files you choose to provide.
- Client and matter data: information required for conflicts, identity checks, onboarding, legal services, billing and regulatory compliance.
- Technical data: IP address, device and browser type, timestamps, referring and requested pages, error logs and security-event information, including data generated by hosting and security providers.
- Sensitive data: processed only where necessary and permitted. Do not send highly sensitive or confidential material through ordinary website channels before engagement is confirmed.
3. Purposes and legal bases
We may process data to respond to enquiries; conduct conflicts checks; decide whether to accept an engagement; provide and administer legal services; meet professional, regulatory, anti-money laundering, tax and accounting duties; secure and improve the website; manage events or subscriptions; and establish, exercise or defend legal claims.
Where required, legal bases may include consent, pre-contract steps or contract performance, compliance with legal obligations, vital interests, and our or a third party’s legitimate interests. This policy does not replace a separate consent or notice where applicable law requires one.
4. Disclosures and service providers
We do not sell personal data. Where necessary, we may disclose it to lawyers, staff and advisers working on a matter; vetted hosting, IT, security, document, communications and other providers; local counsel or professionals authorised by you; regulators, courts, tribunals, law-enforcement bodies or legally entitled recipients; and a successor in a reorganisation or business transfer.
Providers should process data only for agreed purposes and under applicable confidentiality, protection and security requirements. Independent local counsel and other professionals may act as separate controllers.
5. International transfers
Because our work focuses on Malaysia, Singapore, Japan, South Korea, Vietnam and other Asia-Pacific markets, data may be accessed or processed outside your location. Where applicable, we use contractual safeguards, consent, adequacy findings, comparable-protection requirements or another recognised mechanism, considering the recipient, destination, purpose and nature of the data.
6. Cookies, logs and analytics
The current site does not intentionally set advertising cookies or operate personalised advertising or cross-site tracking. Hosting and security infrastructure may still process essential technical identifiers and server logs for delivery, load balancing, abuse prevention and troubleshooting.
If analytics, embedded media, maps, chat, marketing or non-essential cookies are added, we will update this policy before activation and provide preference or consent controls where required.
7. Retention and security
We retain data only as long as required for the purpose, professional and legal duties, disputes and enforcement. Periods depend on record type, matter status, limitation periods, regulatory rules and risk. When no longer required, data is deleted, anonymised or securely archived.
Risk-based technical and organisational measures may include access controls, least privilege, transfer protection, provider review, backups and incident response. No internet transmission or storage system is completely secure.
8. Your rights and choices
Depending on the applicable law, you may have rights to information, access, a copy, correction, deletion, restriction, objection, consent withdrawal, portability and review of certain automated decisions. Rights are not absolute and may be limited by legal professional privilege, professional duties, third-party rights, mandatory retention or another lawful exception.
We may reasonably verify identity and authority. Withdrawing consent does not affect earlier lawful processing. You may also complain to the competent data protection authority.
Children
This site is intended for business and professional audiences, not children. We do not knowingly collect website data from children below the applicable legal age.
9. Contact, complaints and updates
For privacy questions, rights requests or complaints, please use our Contact page. Do not attach unnecessary identification or sensitive case material to an initial request.
We may update this policy for legal, technical or business changes. Material changes will be signposted and the effective date revised. If language versions differ, they should be interpreted by reference to applicable law, context and relevant formal documents.