AdrianYeo PLT (LLP0003457-LCA & AF 1158) (“AdrianYeo”, “we”, “us”, or “our”) is a professional accounting and consulting firm established in 1995, with its principal place of business at 63, Jalan SS25/2, Taman Bukit Emas, 47301 Petaling Jaya, Selangor, Malaysia. We provide audit, tax planning and compliance, business advisory, outsourced CFO and accounting services, mergers and acquisitions due diligence, business valuations, and related professional solutions to small and medium enterprises (SMEs), not-for-profit organisations, high net worth individuals, business executives, and owners across Malaysia. Our tagline “Connecting Clients with Solutions” reflects our commitment to delivering tailored services in audit, tax, valuation, and advisory matters.

This Privacy Policy explains how we collect, use, process, disclose, store, and protect your personal data when you access or use our website at https://www.adrianyeo.com/ (the “Website”), including subpages, contact forms, “Let’s Chat” inquiries, newsletter subscriptions, blog interactions, resource downloads, or any other online services we provide (collectively, the “Services”). It also covers personal data we handle in the course of providing Professional Services under separate engagement letters.

This Policy is issued in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia and its principles: General, Notice and Choice, Disclosure, Security, Retention, Data Integrity, and Access. As a registered data user in the class of audit and accountancy services, we are committed to safeguarding the personal data we process, especially sensitive financial and tax-related information entrusted to us by clients and prospects.

By accessing the Website or providing any personal data to us, you consent to the collection, processing, use, and disclosure of your personal data as described in this Policy. If you do not agree, please do not use the Website or submit any personal data. For Professional Services, additional or overriding confidentiality terms may be set out in your engagement letter.

1. Personal Data We Collect We collect personal data that is necessary for the purposes described below. “Personal data” means any information that relates directly or indirectly to you, from which you can be identified, including but not limited to:

Directly Provided Data

• Contact and identification information: full name, company name, job title, email address, telephone number (including WhatsApp), postal address, and other details submitted via the contact form, “Let’s Chat”, email inquiries, or newsletter subscription.
• Professional and business information: company registration details, industry sector (e.g., manufacturing, construction, auto dealers, nonprofits), financial summaries, tax-related queries, or descriptions of your accounting, audit, or advisory needs.
• Payment and billing information (where relevant for engagements): bank details or other payment references, though these are primarily handled under separate engagement agreements.
• Any other information you voluntarily provide, such as in messages, attachments, or feedback forms.

Automatically Collected Data

• Technical and usage data: IP address, browser type and version, device information, operating system, referring URLs, pages visited, time and date of visits, clickstream data, and session duration.
• Cookies and similar technologies: We use cookies, web beacons, tracking pixels, and similar technologies to improve user experience, analyse traffic, remember preferences, and measure the effectiveness of our content. You can manage cookie preferences through your browser settings, though disabling certain cookies may affect Website functionality. Third-party analytics tools may also collect aggregated usage data.

Sensitive Personal Data In the context of Professional Services (but not generally via the public Website), we may process sensitive personal data as defined under the PDPA, such as information relating to financial affairs, tax status, or health data (e.g., in retirement plan audits), only with your explicit consent or where permitted by law. Such data is handled with heightened security and strictly limited to the engagement scope.

We do not knowingly collect personal data from children under 13 years of age. The Website is not intended for minors, and if we become aware of such collection, we will take steps to delete it.

2. Sources of Personal Data Personal data may be collected directly from you, from your authorised representatives, through public sources, or from third parties such as referrers, regulatory bodies (e.g., Inland Revenue Board, Companies Commission of Malaysia), or service providers, where lawful.

3. Purposes of Processing Personal Data (Notice and Choice Principle) We process your personal data only for lawful purposes directly related to our activities. The main purposes include:

(a) To respond to your inquiries, provide information about our services (audit readiness, year-end tax planning, business valuation, outsourced accounting, M&A due diligence, etc.), and facilitate initial consultations via the contact page or “Let’s Chat”. (b) To communicate with you about our services, newsletters, blog updates on topics like service tax policy, technology stack optimisation for accounting, mid-year financial health checks, or industry insights. (c) To improve and personalise your experience on the Website, analyse usage trends, and enhance our content and Services. (d) To perform administrative tasks, such as maintaining records, billing (where applicable), and internal compliance. (e) To comply with legal and regulatory obligations, including obligations under the PDPA, Malaysian Institute of Accountants (MIA) rules, anti-money laundering laws, tax regulations, and any other applicable laws. (f) For Professional Services engagements: to deliver audit, tax, advisory, valuation, or outsourced services as agreed in the engagement letter; to prepare financial statements, tax returns, valuation reports, or due diligence findings; and to fulfil our professional duties. (g) For marketing and business development (with your consent where required), such as sending tailored updates on tax changes or audit best practices relevant to your sector. (h) To protect our rights, prevent fraud, ensure Website security, and enforce our Terms and Conditions. (i) Any other purpose for which you have provided explicit consent or as permitted/required by law.

Where it is obligatory for you to provide certain personal data (e.g., to process a service inquiry), we will inform you of the consequences of failing to do so.

You have the right to limit the processing of your personal data by contacting us (see Section 11). However, this may affect our ability to provide certain Services.

4. Disclosure of Personal Data (Disclosure Principle) We do not sell your personal data. We may disclose your personal data to the following parties, only on a need-to-know basis and subject to appropriate safeguards:

• Our partners, directors, employees, and authorised personnel within AdrianYeo PLT who require access for the purposes listed above.
• Third-party service providers (data processors) such as cloud hosting providers, email service platforms, website analytics tools, IT support, or professional software providers (e.g., accounting systems), who process data on our behalf under strict confidentiality agreements.
• Professional advisers, including lawyers, auditors (external where required), or other consultants assisting us.
• Regulatory authorities, government bodies (e.g., IRB, MIA, PDPA Commissioner), or courts when required by law, to comply with legal processes, or to protect public interest.
• In the event of a merger, acquisition, or sale of assets, to the relevant successor entity, subject to continued protection of your data.
• With your explicit consent, to other parties you authorise.

When transferring data outside Malaysia (e.g., to cloud service providers), we ensure the recipient jurisdiction provides an adequate level of protection or implement appropriate contractual safeguards consistent with PDPA requirements.

5. Security of Personal Data (Security Principle) We take reasonable technical, organisational, and administrative measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration, or destruction. These include encryption where appropriate, access controls, secure servers, regular security reviews, and staff training on data protection.

However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, and you transmit data at your own risk. In the event of a personal data breach, we will notify the PDPA Commissioner and affected data subjects as required by law (following recent amendments to the PDPA).

6. Retention of Personal Data (Retention Principle) We retain personal data only as long as necessary for the purposes for which it was collected or as required by law. For Website inquiries, data is typically retained for a reasonable period after the last interaction. For Professional Services clients, data is retained in accordance with MIA guidelines, tax retention requirements (generally 7 years or longer), and our engagement terms.

Once no longer needed, we will securely delete or anonymise the data.

7. Data Integrity and Accuracy We take reasonable steps to ensure personal data is accurate, complete, and up-to-date. You are responsible for providing correct information and updating us of any changes.

8. Your Rights (Access and Correction Principle) Under the PDPA, you have the right to:

• Access your personal data held by us (subject to a reasonable fee and verification).
• Correct inaccurate or incomplete personal data.
• Withdraw consent to processing (though this may limit our Services).
• Request information about how your data is processed.
• Lodge a complaint with us or the Personal Data Protection Commissioner if you believe your rights have been infringed.

To exercise these rights, contact our Data Protection Officer (see Section 11). We will respond within the timelines prescribed by the PDPA. We may refuse requests that are frivolous, vexatious, or not permitted by law, and will inform you of the reasons.

9. Cookies and Tracking Technologies Our Website uses cookies and similar technologies for functionality, analytics, and performance. Types include:

• Essential cookies (necessary for Website operation).
• Analytics cookies (to understand visitor behaviour).
• Preference cookies (to remember your settings).

You can accept or reject cookies via browser settings or our cookie banner (if implemented). Third parties such as analytics providers may set cookies; we are not responsible for their privacy practices.

10. Links to Third-Party Websites The Website may contain links to external sites (e.g., regulatory bodies, accounting software providers). This Privacy Policy does not apply to those sites. We encourage you to review their privacy policies before providing any data.

11. Contact Information and Data Protection Officer If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:

AdrianYeo PLT 63, Jalan SS25/2, Taman Bukit Emas, 47301 Petaling Jaya, Selangor, Malaysia. Telephone: +603-7802 3333 Email: info@adrianyeo.com (Attention: Data Protection Officer)

We will handle your request in accordance with the PDPA.

12. Changes to This Privacy Policy We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The updated version will be posted on the Website with a revised “Last Updated” date. Material changes will be notified via the Website or email where appropriate. Your continued use of the Services after changes constitutes acceptance of the revised Policy.

13. Governing Law This Privacy Policy is governed by the laws of Malaysia. Any disputes shall be subject to the jurisdiction of the Malaysian courts.

14. Acknowledgement By using our Website or engaging our services, you acknowledge that you have read, understood, and agreed to this Privacy Policy. You confirm that the personal data you provide is accurate and that you have the authority to disclose it to us.

Word Count Note: This Privacy Policy contains approximately 1,012 words (excluding this note). It is a comprehensive, customised template tailored to AdrianYeo PLT’s operations as a Malaysian professional accounting firm, incorporating PDPA requirements relevant to audit, tax, and advisory services.

Important Disclaimer: This is an AI-generated template provided for drafting assistance only. It is not legal advice and does not create any professional relationship. Data protection laws, including amendments to the PDPA, evolve, and requirements can be specific to your operations. We strongly recommend that a qualified Malaysian lawyer (experienced in PDPA compliance for professional services firms) reviews, customises, and approves this document before publication. AdrianYeo PLT and the drafter accept no liability for any reliance on this template.

If you need expansions on specific sections, integration with the Terms and Conditions, a Malay language version, or further adjustments (e.g., for data breach procedures or DPO details), please provide more details.