Last updated: 14 October 2026
Keeyaa Corporate Services Sdn. Bhd. (Registration No. 200301014908 (617328-D)) (“Keeyaa“, “we“, “us” or “our“) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, store and protect personal data in accordance with the Personal Data Protection Act 2010 of Malaysia (as amended by the Personal Data Protection (Amendment) Act 2024) (“PDPA“) and its related regulations and codes of practice.
By using our website at www.keeyaa.com.my, contacting us or engaging our services, you acknowledge that you have read and understood this Privacy Policy.
1. Who We Are
Keeyaa is a Malaysian corporate services firm established in 2003 by Licensed Chartered Secretaries. We provide company registration and incorporation, company secretarial, nominee director and resident agent, company restructuring, company dissolution, licensing, payroll and statutory registration services. For the purposes of the PDPA, Keeyaa is the data user responsible for the personal data described in this policy.
2. Scope of This Policy
This policy applies to personal data we process about:
- visitors to our website;
- prospective and existing clients, including their directors, shareholders, beneficial owners, officers, employees and authorised representatives;
- individuals who contact us by phone, email, WhatsApp, social media or our online enquiry form; and
- business contacts, suppliers and service partners.
3. Personal Data We Collect
Depending on your relationship with us and the services you request, we may collect the following personal data:
- Identity data – full name, NRIC or passport number, nationality, date of birth, gender and photographs or copies of identity documents.
- Contact data – residential and business address, email address, and telephone and mobile numbers.
- Corporate and statutory data – directorships, shareholdings, beneficial ownership information, positions held, and other information required by the Companies Commission of Malaysia (SSM) and other authorities.
- Employment and payroll data (for payroll clients) – employee names, identification numbers, salary details, bank account details, and EPF, SOCSO, EIS, HRDF and income tax reference numbers.
- Financial data – billing details, payment records and bank account information needed to process fees and payments.
- Due diligence data – information needed to meet our anti-money laundering, counter-terrorism financing and “know your customer” obligations, such as proof of address and source of funds.
- Communications data – the content of enquiries, messages, emails and correspondence you send us.
- Technical and usage data – IP address, browser type, device information, pages visited, time spent on pages and referring website, collected through cookies and similar technologies.
Some personal data is obligatory. If you do not provide it, we may be unable to carry out the services you have requested or meet our legal and regulatory obligations. We will tell you when information is obligatory.
4. How We Collect Personal Data
We collect personal data:
- directly from you when you fill in our enquiry form, call, email or WhatsApp us, meet us, or sign an engagement letter or service agreement;
- from your company, employer or authorised representative when they engage us on your behalf;
- from public sources such as SSM records and other official registries;
- from government agencies, regulators and professional advisers in the course of providing our services; and
- automatically when you browse our website, through cookies and analytics tools.
If you provide personal data about another person (for example, a fellow director, shareholder or employee), you confirm that you are authorised to do so and that the person has been informed of this Privacy Policy.
5. Purposes of Processing
We process personal data for the following purposes:
- to respond to your enquiries and provide quotations and consultations;
- to deliver our services, including company incorporation, secretarial work, statutory filings, licensing applications, restructuring, dissolution and payroll processing;
- to prepare, lodge and maintain statutory records and submissions with SSM, the Inland Revenue Board (LHDN), EPF, SOCSO, HRD Corp, MIDA, CIDB and other authorities;
- to verify identity and carry out due diligence as required by the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 and other applicable laws;
- to issue invoices, process payments and manage our client accounts;
- to send you service reminders, statutory deadline notices and updates relevant to your engagement;
- to send you newsletters, regulatory updates and information about our services, where you have agreed to receive them;
- to operate, maintain, secure and improve our website and understand how visitors use it;
- to comply with legal, regulatory, accounting and audit requirements, and to respond to lawful requests from authorities; and
- to establish, exercise or defend legal claims.
6. Disclosure of Personal Data
We do not sell your personal data. We may disclose personal data, only as needed for the purposes above, to:
- government agencies, statutory bodies and regulators, including SSM, LHDN, EPF, SOCSO, HRD Corp, the Registrar of Societies, MIDA and CIDB;
- banks and financial institutions, for account opening, payments and payroll disbursements;
- professional advisers such as auditors, tax agents, lawyers and licensed company secretaries working with us;
- service providers who support our business, such as IT, cloud hosting, email, website, document storage and courier providers, under contractual confidentiality obligations;
- your company, its directors, shareholders or authorised representatives, where relevant to the engagement;
- a purchaser or successor entity in the event of a merger, acquisition or restructuring of our business; and
- any other party where required or permitted by law, or with your consent.
7. Transfer of Personal Data Outside Malaysia
Some of our service providers (such as cloud, email and analytics providers) may store or process data outside Malaysia, and we may transfer data abroad where needed to serve foreign clients or their overseas representatives. Where we do so, we take reasonable steps to ensure that the personal data receives a level of protection comparable to that required under the PDPA, or that the transfer is otherwise permitted under the PDPA.
8. Data Security
We take practical steps to protect personal data from loss, misuse, modification, unauthorised or accidental access or disclosure, alteration or destruction. These include access controls, password-protected systems, secure storage of physical files, confidentiality obligations for staff and service providers, and secure (HTTPS) connections on our website. No method of transmission over the internet or electronic storage is completely secure, but we work to protect your data using measures appropriate to its sensitivity.
In the event of a personal data breach, we will act promptly to contain it and, where required by the PDPA, notify the Personal Data Protection Commissioner and affected individuals.
9. Retention of Personal Data
We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Statutory and corporate records are generally kept for at least seven (7) years, in line with the Companies Act 2016, tax laws and anti-money laundering requirements. When personal data is no longer needed, we will securely destroy it or permanently anonymise it.
10. Your Rights
Subject to the PDPA and any exemptions it provides, you have the right to:
- access the personal data we hold about you and request a copy;
- correct personal data that is inaccurate, incomplete, misleading or out of date;
- withdraw consent to our processing of your personal data, in whole or in part;
- limit processing, including asking us to stop sending you direct marketing;
- prevent processing likely to cause you substantial damage or distress; and
- data portability – request that we transmit your personal data to another data user, where technically feasible.
To exercise any of these rights, please contact us using the details in Section 15. We may need to verify your identity before acting on your request, and may charge a fee for data access requests as permitted under the PDPA. We will respond within the time required by law. Please note that withdrawing consent or limiting processing may affect our ability to continue providing services to you.
11. Cookies and Analytics
Our website uses cookies and similar technologies to make the site work properly, remember your preferences and understand how visitors use our pages. We use Google Tag Manager and Google Analytics to collect anonymised or aggregated statistics about website traffic and usage. These tools may set cookies and process your IP address and device information. You can learn more about how Google uses data at Google’s Privacy & Terms.
Our pages may also embed third-party content such as Google Maps, which may set its own cookies. You can block or delete cookies through your browser settings, though some parts of the website may not function properly if you do.
12. Third-Party Links and Messaging Services
Our website contains links to third-party websites and services, including Facebook, LinkedIn and WhatsApp. If you contact us through WhatsApp or social media, your messages are also subject to the privacy policies of those platforms. We are not responsible for the privacy practices or content of third-party websites and encourage you to review their privacy policies.
13. Children’s Privacy
Our services are intended for businesses and adults. We do not knowingly collect personal data from individuals under the age of 18 except where required to deliver our services (for example, a minor’s details lawfully provided by a parent or guardian), and only with appropriate consent.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in the law, our services or our practices. The updated version will be posted on this page with a revised “Last updated” date. We encourage you to review this page periodically.
15. Contact Us
If you have any questions, requests or complaints about this Privacy Policy or how we handle your personal data, please contact our Data Protection Officer:
Keeyaa Corporate Services Sdn. Bhd.
Attn: Data Protection Officer
Lot 2-2-43, Second Floor, Wisma Rampai,
Jalan 34/26, Rampai Town Centre,
53300 Kuala Lumpur, Malaysia.
Tel: +603-4143 0018 / +603-4143 0019
Email: biz.advisory@keeyaa.com.my