PRIVACY NOTICE

Effective Date: 05.09.2022
Last Updated: 29.09.2026

Thank you for visiting the website of K.F. Fong & Co. (“K.F. Fong & Co.”, “we”, “us” or “our”).

K.F. Fong & Co. is committed to protecting the privacy and personal data of our clients, prospective clients, website visitors and other individuals with whom we interact.

This Privacy Notice explains how we collect, use, disclose, store and protect your personal data when you visit or use our websites, applications and related services, including:

* https://kffongco.com; and
* https://app.kffongco.com

(collectively, the “Website”).

This Privacy Notice is made in accordance with the Personal Data Protection Act 2010 (Act 709), as amended from time to time (“PDPA”), and other applicable Malaysian laws and regulations relating to personal data protection.

The Personal Data Protection Commissioner has also issued guidance and materials concerning privacy notices, cross-border transfers, data-breach notification, data protection officers, and automated decision-making and profiling. We may update this Privacy Notice from time to time to reflect applicable legal, regulatory, technological or operational developments. (PDP)

By accessing or using our Website or providing your personal data to us, you acknowledge that you have read and understood this Privacy Notice.

1. PERSONAL DATA WE COLLECT

We may collect personal data that you voluntarily provide to us when you:

* contact us through our Website, email, telephone or other communication channels;
* request information about our services;
* become or register as a client;
* use our online applications or client portals;
* create or maintain a user account;
* submit documents or information to us;
* make payments to us;
* communicate with our staff;
* subscribe to our newsletters or other communications;
* use the “Ask Fong AI” feature on our Website; or
* otherwise interact with us.

Depending on the nature of your relationship with us, the personal data we collect may include:

* name;
* identification or passport details;
* company or business details;
* company registration number;
* contact details, including telephone number, email address and correspondence address;
* occupation, position or job title;
* information relating to your business or employment;
* account login information;
* information contained in documents or records provided to us;
* billing and payment information;
* information required for accounting, audit, tax, payroll, company secretarial and other professional services;
* correspondence and communications with us;
* information required for regulatory, statutory or compliance purposes; and
* other information reasonably necessary for us to provide our services.

When you use Ask Fong AI, information you voluntarily submit may include:

* questions and messages;
* your selected language;
* information provided in an enquiry or lead form;
* your name, email address and/or telephone number if you choose to provide them;
* company or business information that you choose to provide;
* the area or service relating to your enquiry;
* information relating to the Website page or service from which your enquiry originated; and
* information contained in an image or other input that you voluntarily submit through the feature.

Incorporation Services Enquiries

When you submit an enquiry through our Incorporation Services page, we may collect the information you provide in the enquiry form, including your name, email address and/or telephone number, proposed company name, business nature and enquiry message.

We use this information to receive and manage your enquiry, contact you about your requirements, assess the services you may need, prepare or discuss a quotation, and maintain records of the enquiry.

Please provide only information reasonably necessary for your enquiry. Do not submit passwords, authentication credentials or confidential documents through the public enquiry form.

Please do not submit confidential or sensitive information through Ask Fong AI, including passwords, authentication credentials, bank account or payment credentials, tax portal credentials, identification numbers, confidential client documents, or other information that you would not ordinarily disclose through a public-facing website enquiry.

Where necessary for the provision of our professional services, we may also process personal data relating to individuals connected with our clients, such as directors, shareholders, employees, officers, authorised representatives, customers or suppliers.

You are responsible for ensuring that you have the necessary authority or consent to provide personal data relating to another individual to us where such authority or consent is required by law.

2. INFORMATION COLLECTED AUTOMATICALLY

When you visit or use our Website, certain technical information may be collected automatically.

This may include:

* IP address or information derived from your IP address for security and operational purposes;
* browser type and version;
* device type;
* operating system;
* language settings;
* date and time of access;
* pages visited;
* referring website;
* information regarding your interaction with the Website;
* information regarding your interaction with Ask Fong AI;
* session or conversation identifiers;
* selected language;
* Website page or service context;
* security and rate-limiting information;
* error and diagnostic information; and
* other technical information required for the operation, security and improvement of our Website and services.

We may use cookies and similar technologies to maintain the functionality and security of the Website, remember preferences, understand how the Website is used and improve your user experience.

3. ASK FONG AI

Our Website may provide an artificial-intelligence-assisted feature known as “Ask Fong AI” (“Ask Fong AI”).

Ask Fong AI is designed to provide general information relating to Malaysian tax, accounting, business and related topics and to help users navigate relevant information and services available through our Website.

Ask Fong AI is not a human accountant, tax agent, auditor, lawyer or other professional adviser and does not create a client relationship with K.F. Fong & Co. Its responses are provided for general informational purposes only and should not be treated as professional advice or as a definitive conclusion on your particular circumstances.

Information processed through Ask Fong AI

When you use Ask Fong AI, information you enter may be processed for purposes including:

* understanding and responding to your question;
* providing general information;
* identifying the general subject or category of your enquiry;
* applying security, safety and abuse-prevention controls;
* determining whether an enquiry should be directed towards further professional assistance;
* improving the operation and reliability of the feature;
* maintaining appropriate technical and security records; and
* responding to a lead or consultation request where you voluntarily provide your contact details.

Ask Fong AI may process your question or other input using third-party artificial intelligence and technology service providers acting as service providers to us.

Where appropriate, information may be processed or transmitted to such service providers in accordance with our contractual, security and data-protection arrangements and applicable law.

Images and other inputs

Where Ask Fong AI permits image input, an image that you voluntarily submit may be processed for the purpose of extracting or understanding relevant information needed to respond to your question.

We do not intend to retain the original uploaded image as part of the Ask Fong AI conversation record. Where image processing is performed temporarily, the image data may be held only for the period reasonably necessary to process the request and is then discarded in accordance with the applicable technical process.

Users should nevertheless avoid submitting confidential documents or personal information through the image feature.

Voice input

Where voice-typing functionality is available, your device or browser may convert speech into editable text before the text is submitted to Ask Fong AI.

We do not intend to retain audio recordings as part of the Ask Fong AI conversation record.

The availability and processing of voice functionality may also depend on the browser, device and relevant third-party technology.

AI-generated responses

Ask Fong AI responses may be generated using artificial intelligence technology and may contain errors, omissions or outdated information.

Where appropriate, Ask Fong AI may provide references to sources available through our controlled knowledge resources. Such references are provided for informational purposes and should be independently considered where the matter is material or time-sensitive.

Ask Fong AI does not replace professional advice. For matters requiring consideration of your specific circumstances, professional judgement, interpretation of documents, tax planning, audit or investigation assistance, or other professional services, you may be directed to contact K.F. Fong & Co.

Confidential information

Please do not submit confidential information through Ask Fong AI.

This includes, without limitation:

* passwords or authentication credentials;
* bank account or payment credentials;
* tax portal login information;
* identification or passport numbers;
* confidential client records;
* confidential financial statements or working papers;
* confidential contracts;
* commercially sensitive information; and
* documents containing personal data that is not necessary for a general enquiry.

If you require assistance concerning confidential documents or information, please contact K.F. Fong & Co. through the appropriate professional-service channel.

4. THIRD-PARTY LOGIN SERVICES

Our web application may provide the option to sign in using a third-party authentication service, such as Google or Facebook.

If you choose to use a third-party login service, we may receive certain information permitted by that service, such as your name and email address, for the purpose of creating and maintaining your user account.

We do not intentionally collect additional information from the third-party account beyond the information necessary for authentication and account creation.

Where applicable, the third-party service providers’ own privacy policies will also apply to their processing of your personal data.

Third-party privacy policies may be accessed through the relevant service providers’ websites.

5. PAYMENT INFORMATION

If you make payments through our Website or through a payment service provider integrated with our services, payment information may be processed by the relevant third-party payment service provider.

Where payment processing is handled by a third-party payment provider, such as Stripe, payment card information may be processed directly by that provider in accordance with its own privacy and security practices.

We do not intend to retain full payment card details where such information is processed directly by the payment service provider.

6. HOW WE USE YOUR PERSONAL DATA

We may collect, use and process your personal data for purposes including:

Provision of professional services

* providing accounting and bookkeeping services;
* providing audit and assurance services;
* providing tax compliance and tax advisory services;
* providing payroll services;
* providing company secretarial and corporate compliance services;
* providing other professional, consultancy and business-related services;
* preparing reports, accounts, tax computations, forms and other documents;
* communicating with you regarding our services; and
* managing your client relationship with us.

Administration and business operations

We may use your personal data to:

* process and manage client accounts;
* verify your identity and information;
* process payments and issue invoices;
* maintain accounting and business records;
* manage enquiries and requests;
* provide customer support;
* communicate administrative information;
* manage our Website and online applications;
* operate and maintain Ask Fong AI;
* monitor and maintain the security of our systems;
* detect and prevent fraud, unauthorised access and other unlawful activities;
* monitor service performance and reliability; and
* improve our services, systems and user experience.

AI and enquiry handling

Where you use Ask Fong AI, we may process information you provide to:

* respond to your enquiry;
* identify the general nature of your enquiry;
* determine whether further professional assistance may be appropriate;
* provide relevant information or direct you towards relevant services;
* process voluntary consultation or lead requests;
* maintain appropriate security and operational records; and
* monitor and improve the safety, reliability and performance of the service.

Legal and regulatory purposes

We may process your personal data where necessary to:

* comply with applicable laws and regulations;
* comply with requirements of government authorities and regulatory bodies;
* respond to lawful requests from authorities;
* fulfil statutory and regulatory obligations;
* maintain records required for accounting, tax, audit or other legal purposes;
* establish, exercise or defend legal rights or claims; and
* protect the rights, property and safety of K.F. Fong & Co., our clients and other persons.

Marketing and communications

We may communicate with you about an enquiry you have submitted, a quotation you have requested, our services you have asked about, or other administrative matters relating to your enquiry or engagement with us.

Where we seek your agreement to receive optional marketing communications through an enquiry form, that choice is separate from the processing necessary to respond to your enquiry. Choosing not to receive optional marketing communications will not, by itself, prevent you from submitting an enquiry or receiving a response to it.

Where you have provided the relevant consent, or where otherwise permitted by applicable law, we may use your contact details to send relevant information about our services, tax and business updates, articles or other service-related news.

You may contact us at [email protected] to request that we stop sending marketing communications. We will handle such requests in accordance with applicable law and our operational procedures.

We may continue to send communications reasonably necessary to respond to your enquiry, administer an engagement, meet legal obligations or provide requested services.

7. BASIS FOR PROCESSING PERSONAL DATA

We process personal data for the purposes described in this Privacy Notice where the processing is permitted or required under applicable law. Depending on the circumstances, this may include processing necessary to take steps at your request before entering into a contract, perform a contract, comply with legal obligations, protect or pursue legal claims, or carry out other processing permitted by applicable law.

Where consent is required for a particular purpose, we will seek that consent as appropriate. Consent to optional marketing communications is separate from an enquiry submitted to request information about our services.

The applicable basis for processing depends on the nature of the information, the purpose of processing and the circumstances in which the information is collected.

We may process your personal data where such processing is:

* necessary for the performance of a contract or to take steps at your request before entering into a contract;
* necessary for compliance with our legal or regulatory obligations;
* necessary for our legitimate business purposes, provided that such processing does not unjustifiably prejudice your rights and interests;
* carried out with your consent, where consent is required; or
* otherwise permitted or required under applicable law.

Where you voluntarily submit information through Ask Fong AI or a lead form, we may process that information for the purposes described in this Privacy Notice and the purpose for which you provided it.

8. DISCLOSURE OF PERSONAL DATA

We will not sell, rent or trade your personal data.

However, we may disclose or provide access to personal data where reasonably necessary for the purposes described in this Privacy Notice.

Recipients may include:

* our employees and authorised personnel;
* professional advisers and consultants;
* auditors;
* lawyers and other legal advisers;
* information technology and software service providers;
* artificial intelligence and technology service providers used to operate or support Ask Fong AI;
* cloud hosting and data storage providers;
* payment service providers;
* email and communication service providers;
* payroll and other service providers;
* third-party authentication providers;
* government departments and regulatory authorities;
* financial institutions, where necessary;
* business partners or service providers involved in providing services to you; and
* other persons where disclosure is required or permitted by law.

Where third-party service providers process personal data on our behalf, we will take reasonable steps to require them to protect the personal data and process it only for authorised purposes.

9. GOVERNMENT AND REGULATORY AUTHORITIES

As an accounting, audit, tax and professional services firm, we may be required to provide information to government departments, regulatory bodies and statutory authorities.

This may include, where applicable, the Inland Revenue Board of Malaysia (LHDN), Companies Commission of Malaysia (SSM), the Personal Data Protection Commissioner, courts, law enforcement agencies and other competent authorities.

Such disclosure may be made where required or permitted by applicable law or where necessary for the provision of our services.

10. CROSS-BORDER TRANSFER OF PERSONAL DATA

Some of our service providers, technology providers, cloud infrastructure providers, artificial intelligence providers, email providers or other third parties may process or store personal data outside Malaysia.

Where personal data is transferred outside Malaysia, we will take reasonable steps to ensure that the transfer and processing are carried out in accordance with applicable requirements of the PDPA and other applicable laws.

This may include transfers to third-party service providers used for:

* hosting;
* cloud storage;
* artificial intelligence and AI-assisted services;
* email and communications;
* authentication;
* payment processing;
* security;
* software; or
* other business functions.

The location and processing arrangements of individual service providers may change from time to time as our technology and service requirements develop.

The Personal Data Protection Commissioner has issued guidance concerning cross-border transfer of personal data, which we will take into account where applicable. (PDP)

11. COOKIES AND SIMILAR TECHNOLOGIES

We may use cookies and similar technologies on our Website.

Cookies may be used for purposes including:

* enabling essential Website functions;
* maintaining login sessions;
* remembering user preferences;
* improving Website performance;
* understanding Website usage; and
* maintaining security.

You may configure your browser to refuse or delete cookies. However, disabling certain cookies may affect the functionality of the Website or certain services.

12. DATA RETENTION

We retain personal data for as long as reasonably necessary for the purposes for which it was collected or processed, subject to applicable legal, regulatory, accounting, tax, professional and other requirements.

The retention period may differ according to the type of information and our relationship with the individual. For example, records relating to client engagements may need to be retained differently from enquiries that do not result in an engagement, technical security records or records required to resolve a dispute.

We will review the need to retain personal data and take reasonable steps to delete, destroy or anonymise it when it is no longer required, subject to applicable legal and operational requirements.

The actual retention period depends on the relevant record category and applicable requirements. Where a specific retention period applies, we will handle the relevant records in accordance with that requirement and our applicable retention procedures.

We may retain personal data for longer periods where necessary to:

* comply with legal, statutory, tax, accounting or regulatory requirements;
* maintain appropriate business and professional records;
* resolve disputes;
* establish, exercise or defend legal claims;
* prevent fraud or misuse;
* maintain appropriate security and audit records; or
* comply with our contractual or professional obligations.

Ask Fong AI conversation, message, lead and technical records may be retained for appropriate operational, security, audit, enquiry-management and service-improvement purposes, subject to our applicable retention practices.

Where image processing is performed temporarily through Ask Fong AI, the original image data is not intended to be retained as part of the conversation record after the processing required for the relevant request has been completed.

Voice audio is not intended to be retained as part of the Ask Fong AI conversation record.

When personal data is no longer required, we will take reasonable steps to delete, destroy or anonymise the information, subject to applicable legal and operational requirements.

13. SECURITY OF PERSONAL DATA

We take reasonable technical and organisational measures to protect personal data against unauthorised access, collection, use, disclosure, alteration, loss, misuse or destruction.

Depending on the nature of the information and our systems, security measures may include:

* access controls;
* authentication mechanisms;
* encryption;
* system monitoring;
* rate limiting and abuse prevention;
* security updates;
* backups;
* access restrictions;
* logging and monitoring; and
* other appropriate safeguards.

For Ask Fong AI, we apply controls designed to minimise the collection and retention of unnecessary information and to prevent the submission or processing of certain prohibited or high-risk information.

However, no transmission or storage system over the Internet can be guaranteed to be completely secure. Accordingly, while we take reasonable measures to protect your personal data, we cannot guarantee absolute security.

You should also take appropriate measures to protect your account credentials and devices, including keeping your passwords confidential and using secure devices and networks.

14. PERSONAL DATA BREACHES

We maintain reasonable procedures for identifying, assessing and responding to personal data breaches.

Where a personal data breach occurs, we will take appropriate steps in accordance with the PDPA and applicable regulatory requirements, including notifying the Personal Data Protection Commissioner and/or affected individuals where notification is required by law.

15. PERSONAL DATA OF MINORS

Our services are generally intended for businesses and individuals who are legally capable of entering into contracts.

We do not knowingly collect personal data from children where such collection is prohibited by applicable law.

If you believe that we have inadvertently collected personal data from a minor without appropriate authority or consent, please contact us using the details provided below.

16. YOUR RIGHTS

Subject to applicable laws and any relevant exemptions, you may have rights in relation to your personal data, including the right to:

* request access to personal data held by us;
* request correction of inaccurate, incomplete or outdated personal data;
* request information about how your personal data is being processed;
* withdraw consent where processing is based on consent, subject to applicable legal or contractual restrictions;
* request deletion of personal data in circumstances permitted by law; and
* exercise other rights available under applicable Malaysian data protection laws.

We may need to verify your identity before processing a request.

Certain requests may be subject to applicable legal, regulatory, contractual or professional requirements.

17. DATA PORTABILITY

Where applicable under the PDPA and subject to the relevant legal, technical and operational requirements, you may have the right to request the transmission of your personal data to another data controller.

Any such request will be handled in accordance with applicable requirements of the PDPA, including any applicable technical, legal and operational requirements.

18. ACCOUNT INFORMATION

If you have an account with our Website or web application, you may request to review or update certain information associated with your account.

You may also contact us if you wish to terminate your account.

Where an account is terminated, we may continue to retain certain information where necessary to comply with legal, tax, accounting, regulatory, professional or other legitimate requirements.

19. MARKETING COMMUNICATIONS

Where you have consented to optional marketing communications, or where such communications are otherwise permitted by applicable law, you may request that we stop sending you marketing communications by contacting [email protected].

We will handle your request in accordance with applicable law and our operational procedures.

Withdrawing consent to marketing communications does not affect the lawfulness of processing carried out before withdrawal, and does not prevent us from processing personal data for other lawful purposes, including responding to your enquiry, administering an engagement or complying with legal obligations.

Where applicable, we will distinguish marketing communications from service-related, administrative or transactional communications.

20. AUTOMATED DECISION-MAKING AND PROFILING

Ask Fong AI may use automated processing to classify the general nature or risk level of an enquiry for purposes such as safety, routing, escalation, abuse prevention and determining whether a user should be directed towards further professional assistance.

Such automated processing is not intended to make legally binding or similarly significant decisions about individuals.

Ask Fong AI does not independently determine whether a person is entitled to a particular tax treatment, whether a particular transaction is lawful, whether a person is liable for tax, or whether K.F. Fong & Co. will accept a person as a client.

Where a matter requires professional judgement, the user may be directed to seek assistance from K.F. Fong & Co. or another appropriate professional.

21. CHANGES TO THIS PRIVACY NOTICE

We may update this Privacy Notice from time to time to reflect changes in:

* our business practices;
* our services;
* Ask Fong AI or other technology;
* applicable laws and regulations;
* our service providers;
* data-processing arrangements; or
* personal data protection requirements.

Any updated version will be published on our Website together with the revised “Last Updated” date.

Where appropriate, we may notify you of material changes through our Website, email or other suitable communication channels.

We encourage you to review this Privacy Notice periodically.

22. CONTACT US

If you have any questions, concerns or requests relating to this Privacy Notice or your personal data, please contact us:

K.F. Fong & Co.

Email: [email protected]

Website: https://kffongco.com

Data Protection Officer

K.F. Fong & Co. has appointed a Data Protection Officer (DPO). For enquiries relating to personal data protection, including requests concerning your personal data, you may contact us at:

Email: [email protected]

We will handle enquiries and requests in accordance with applicable laws and may request information reasonably necessary to verify your identity before processing a request.

23. GOVERNING LAW

This Privacy Notice shall be governed by and interpreted in accordance with the laws of Malaysia.

Last Updated: 29.09.2026