Privacy Policy

1. Introduction

Cairnpost ("we", "us", "our") is committed to protecting the personal data of individuals who contact us, engage our services or visit this website. This policy explains what personal data we collect, why we collect it, how we use it and what rights you hold under Malaysian law.

This policy applies to personal data processed in connection with the Cairnpost website at https://cairnpos.cyou and all services provided by Cairnpost from our Shah Alam, Selangor premises.

2. Data We Collect

We collect only the data necessary to communicate with you and to carry out the coordination work you engage us for. This includes:

• Contact data: name, email address, telephone number provided via the website contact form or direct communication.
• Engagement data: information about the documents the family holds, their physical locations and the names of custodians — collected only during a paid engagement session.
• Usage data: anonymous information about how visitors interact with our website, collected via cookies (see our Cookie Policy).

We do not collect financial account details, identification numbers (IC/passport) or any biometric data. We do not retain document contents beyond what is needed to produce the session output.

3. How We Use Personal Data

Personal data collected is used to:

• Respond to enquiries and schedule sessions
• Fulfil the coordination service scope agreed in writing
• Issue written outputs and deliver them to the correct family member
• Comply with applicable Malaysian legal requirements
• Improve the usability of our website (anonymous analytics only)

4. Legal Basis for Processing

We process personal data under the following grounds as recognised by Malaysia's Personal Data Protection Act 2010 (PDPA):

• Consent: for website contact form submissions and optional communications.
• Contractual necessity: for data processed to deliver an engagement the client has paid for.
• Legal obligation: where retention or disclosure is required by Malaysian law.

5. Data Retention

We hold personal data only as long as necessary for the purpose it was collected:

• Enquiry data (no engagement booked): retained for 6 months, then deleted.
• Engagement contact data: retained for 3 years after engagement close for business record purposes, then deleted.
• Working notes from sessions: destroyed on the day the final printed output is handed to the client.
• Scanned document copies: transferred to family-controlled storage and removed from any Cairnpost device immediately after transfer.

6. Data Security

We apply practical security measures appropriate to our size and the nature of the data we hold:

• Access to personal data restricted to coordinators directly involved in an engagement
• Electronic data stored on password-protected, encrypted devices
• Paper records held in secured premises; destroyed using cross-cut shredding
• No personal engagement data transmitted via unencrypted email

In the event of a data breach affecting your personal data, we will notify you within 72 hours of becoming aware of it, where required by applicable law.

7. Cookies

This website uses cookies to support basic functionality and, where consent is given, to understand how visitors use the site. For full details of the cookies we use and how to manage them, please see our Cookie Policy.

8. Third-Party Sharing

We do not sell, rent or trade personal data. We share data only in these limited circumstances:

• Service providers who assist with website hosting or analytics, under contractual confidentiality obligations
• Law enforcement or regulatory bodies where required by Malaysian law

Referrals to solicitors, estate administrators or financial planners listed in our practitioner directory are made at the family's request only. We do not share engagement data with those practitioners without explicit written consent.

9. Third-Party Links

Our website may contain links to third-party sites. We are not responsible for the privacy practices of those sites and encourage you to review their policies independently.

10. Your Rights

Under Malaysia's PDPA 2010 and applicable data protection principles, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete personal data
• Withdraw consent for processing based on consent (without affecting prior processing)
• Request deletion of personal data we no longer have a legal basis to retain
• Object to processing for direct marketing purposes

To exercise any of these rights, contact us at [email protected]. We will respond within 14 business days.

11. Children's Privacy

Our services are intended for adults aged 18 and above. We do not knowingly collect personal data from individuals under 18. If you believe a minor has submitted data to us, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this policy from time to time. We will post the updated version on this page and revise the "Last Updated" date. Continued use of our website or services after a change constitutes acceptance of the updated policy.

13. Contact

For privacy-related questions or to exercise your rights, please contact our data point of contact: