How we handle personal data.

This policy explains how KJ Loway LLC (UEN 202643702R), a Singapore law corporation, collects, uses, discloses and protects personal data. It is written to meet our obligations under the Personal Data Protection Act 2012 (the PDPA) and applies to our clients and prospective clients, the individuals who act for them, counterparties and their advisers, visitors to this website, job applicants, and anyone else who deals with us.

In this policy, “we”, “us” and “our” mean KJ Loway LLC. “Personal data” has the meaning given in the PDPA: data about an individual who can be identified from that data, or from that data and other information we hold or are likely to have access to.

Depending on how you deal with us, we may collect your name and contact details; your job title and the organisation you work for; identity documents and identification numbers where the law requires or permits us to collect them; information needed for due diligence on clients, beneficial owners and the source of funds; billing and payment details; the content of your correspondence and the documents you give us; and any other information relevant to a matter on which we act.

For job applicants, we collect the information in your application, including your education, qualifications and employment history, and the results of any reference or background checks you agree to.

We do not ask for sensitive personal data unless a matter requires it. Where it does, we collect only what the matter needs and handle it with additional care.

We collect most personal data directly from you: when you contact us, instruct us, send us documents, attend a meeting or apply for a position. We may also receive it from others, including your employer or organisation when it instructs us, other parties to a matter and their advisers, courts and tribunals, public registers such as those kept by the Accounting and Corporate Regulatory Authority, and screening services we use for due diligence.

Where you give us personal data about another individual, such as a director, shareholder, employee or family member, please make sure you are entitled to do so and that the individual knows that their data will be handled in accordance with this policy.

When you correspond with us, we keep copies of the communications in a secure working records system that we use to run your matter. It holds messages sent to and from our WhatsApp Business number, emails our lawyers forward to it, recordings and transcripts of Microsoft Teams meetings that were recorded, and our lawyers’ own notes, including voice notes. It is hosted for us by Amazon Web Services in Singapore and is open only to our own staff. It is not our official file: a communication forms part of our file when one of our lawyers files it there.

Whether a Teams meeting is recorded is decided for each meeting, and Teams tells every participant when recording starts. Tell us if you prefer a meeting not to be recorded. We do not record telephone calls.

Voice notes, and recordings without a Teams transcript, are transcribed by Amazon Transcribe, which processes the audio in Singapore. We do not use artificial-intelligence services to analyse the content of your matter.

We use personal data to provide legal services and manage our client relationships; to check for conflicts of interest before we accept a matter; to carry out the customer due diligence required of law practices under the Legal Profession Act 1966 and the rules made under it on the prevention of money laundering, terrorism financing and proliferation financing; to communicate with you and with others on a matter; to issue invoices and collect fees; to meet our professional, regulatory, tax and accounting obligations; to protect and enforce our legal rights; to assess job applications; and to run and secure our office systems and this website.

We may also use your contact details to send you legal updates or invitations to events, but only where you have agreed to receive them. We will not use your personal data for a new purpose without first telling you and, where the PDPA requires it, obtaining your consent.

We collect, use and disclose personal data with your consent, or without it where the PDPA or another law allows. Your consent may be given expressly, or deemed where you voluntarily give us personal data for a purpose that is obvious from the circumstances.

You may withdraw your consent at any time by writing to our Data Protection Officer. We will tell you what withdrawing it is likely to mean for you before we act on it: in some cases we may be unable to continue acting for you. Withdrawal does not affect data we are required or permitted by law to keep, and it does not override our duty to keep records for regulatory purposes.

As advocates and solicitors, we owe our clients a duty of confidentiality, and communications between a lawyer and client may be protected by legal professional privilege. Those duties apply alongside the PDPA. Nothing in this policy permits us to disclose information that we are bound to keep confidential, and we will not disclose privileged material except as our client instructs or the law requires.

For the same reason, a request for access to personal data may be answered in part only where full disclosure would reveal information that is confidential to a client or subject to privilege.

We share personal data only as a matter needs or the law requires. Recipients may include other parties to a transaction or dispute and their advisers; courts, tribunals, arbitral institutions and mediators; foreign lawyers, experts and other professionals we engage on your behalf; banks and payment providers; our professional indemnity insurers, auditors and professional advisers; and regulators, law enforcement and government agencies, including the Law Society of Singapore and the Ministry of Law’s Legal Services Regulatory Authority.

We also use service providers who process data on our behalf, such as providers of email, document storage, practice management, IT support and website hosting. They may use personal data only on our instructions and must protect it to the standard the PDPA requires.

These include Microsoft, for email, video meetings and document storage; Amazon Web Services, which hosts our working records system and transcribes audio in Singapore; and WhatsApp, for messages to and from our WhatsApp Business number.

We do not sell personal data.

Some of our service providers, and some of the people we deal with on cross-border matters, are outside Singapore, so personal data may be transferred to or stored in other countries. When we transfer personal data out of Singapore, we take the steps the PDPA requires to ensure that the recipient is bound to protect it to a standard comparable to the protection given under the PDPA, for example through contractual terms.

Our working records system and its transcription service are hosted in Singapore. WhatsApp and Microsoft process data under their own terms in the course of providing their services, which may include processing outside Singapore.

We make reasonable security arrangements to protect personal data from unauthorised access, collection, use, disclosure, copying, modification, disposal and loss. These include access controls, encrypted systems, multi-factor authentication and confidentiality obligations on everyone who works with us. No system is completely secure, and we ask you to take care when sending us sensitive information by email.

If a data breach occurs, we will assess it promptly and, where the PDPA requires, notify the Personal Data Protection Commission and the individuals affected.

We keep personal data only for as long as it serves the purpose for which it was collected, or as long as we need it for legal, regulatory, insurance or business reasons. Client files and due diligence records are kept for the periods required by the Legal Profession Act 1966 and the rules made under it, and for as long as a claim relating to a matter could be brought. When we no longer need personal data, we delete it securely or anonymise it.

Messages, recordings and notes in our working records system are kept while your matter is open and for up to seven years after it closes, or longer where the law or a legal hold requires. WhatsApp photos and files that do not form part of our file are kept for two years.

You may ask us for a copy of the personal data about you that we hold, and for information about how it has been used or disclosed in the past year. You may also ask us to correct any error or omission in it. Please send your request to our Data Protection Officer with enough detail for us to identify you and the data concerned.

We will respond as soon as reasonably possible. If we cannot respond to an access request within 30 days, we will tell you within that time when we expect to be able to. We may charge a reasonable fee for an access request and will tell you the amount before we proceed. There is no fee for correction. The PDPA sets out some circumstances in which we may, or must, decline a request; if that applies, we will tell you why.

This website does not use cookies, analytics or advertising trackers. If you send us an enquiry through the form on our Contact page, what you enter reaches us by email and is handled as this policy describes; any files you attach are deleted from the website's own storage automatically, about a week after you send them. Our hosting and content delivery provider keeps standard access logs, which include IP addresses, browser details and the pages requested. We use them only to keep the website secure and running, and we keep them for a limited period, currently 30 days.

The website may link to other sites. We are not responsible for their content or their privacy practices.

We will send you legal updates, newsletters or event invitations only if you have agreed to receive them, and every message will tell you how to stop receiving them. We comply with the Do Not Call provisions of the PDPA and will not send marketing messages to a Singapore telephone number registered with the Do Not Call Registry unless you have given us clear and unambiguous consent.

Please address any question, request or complaint about this policy or our handling of your personal data to our Data Protection Officer at admin@kjloway.com, with “Data Protection Officer” in the subject line. We will do our best to resolve your concern.

If you are not satisfied with our response, you may contact the Personal Data Protection Commission.

We may update this policy from time to time to reflect changes in the law, our practice or this website. The current version will always be published on this page, with the date it was last updated. This policy is governed by the laws of Singapore.