PRIVACY POLICY
Karwai Risk Management
In accordance with the Personal Data Protection Act 2010 (Malaysia)
Important Notice
This Privacy Policy governs the collection, use, storage, and disclosure of personal data by Karwai Risk Management. By engaging our services, visiting our website, or submitting your personal information, you acknowledge that you have read, understood, and agreed to the terms of this Policy. If you do not agree, please refrain from submitting your personal data through our platforms.
01Identity of the Data Controller
| Field | Details |
|---|---|
| Business Name | Karwai Risk Management |
| Business Type | Licensed General Insurance Intermediary |
| Operating Location | Penang Island, Pulau Pinang, Malaysia |
| yuming@wkwconsultancy.com | |
| Phone / WhatsApp | +6017-983 5873 |
| Website | www.KarwaiRiskManagement.com |
| Appointed Insurers | GEGM, MSIG, Generali, CHUBB, Etiqa, HLA, HLMT (Hong Leong MSIG Takaful) |
02Scope of This Policy
This Privacy Policy applies to all personal data collected by Karwai Risk Management through the following channels:
- •Our official website and any digital forms hosted therein
- •WhatsApp, telephone, email, and other direct communication channels
- •Physical meetings, industry events, and networking interactions
- •Insurance application and documentation processes conducted on your behalf
This Policy applies to individual clients, corporate clients, and any person whose personal data is shared with us in connection with an insurance enquiry or application.
03Categories of Personal Data Collected
| Category | Examples |
|---|---|
| Identity Data | Full name, position or job title |
| Contact Data | Email address, mobile number, office number |
| Business Data | Company name, business industry, size of operations |
| Insurance Data | Type of coverage required, existing policies, asset or liability details relevant to quotation |
| Communication Data | Records of enquiries, correspondence, and instructions given to us |
| Technical Data | Browser type, IP address, pages visited (collected automatically via analytics tools — anonymised) |
04Purposes of Processing
To respond to your insurance enquiry and prepare a personalised quotation on your behalf.
To submit insurance proposals and applications to our appointed insurers.
To communicate with you regarding policy terms, renewals, endorsements, claims procedures, and any amendments to your coverage.
To comply with our legal and regulatory obligations as a licensed insurance intermediary under the Financial Services Act 2013 and guidelines issued by Bank Negara Malaysia (BNM).
To maintain accurate business records and conduct internal administration, including invoicing, reconciliation, and correspondence archiving.
To improve our advisory services through the review of anonymised and aggregated service feedback and website usage data.
05Disclosure of Personal Data
(a) Appointed Insurers
Your data will be shared with one or more of our appointed insurers — GEGM, MSIG, Generali, CHUBB, Etiqa, HLA, and/or HLMT (Hong Leong MSIG Takaful) — for the purpose of obtaining quotations and processing insurance applications on your behalf. Each insurer operates under their own privacy obligations and is subject to Malaysian data protection law.
(b) Regulatory Authorities
We may disclose personal data to Bank Negara Malaysia, the Department of Personal Data Protection (JPDP), or any other competent authority where required by law, court order, or regulatory direction.
(c) Professional Advisors
In limited circumstances, we may share information with legal counsel, auditors, or compliance consultants who are bound by professional confidentiality obligations.
(d) Service Providers
We may engage third-party service providers (e.g. website hosting, email services) who process data on our behalf. Such providers are contractually bound to process data only on our instructions and to maintain appropriate security standards.
06Retention of Personal Data
| Data Category | Retention Period |
|---|---|
| Active client records | Duration of the policy relationship, plus 7 years after lapse |
| Insurance application documents | 7 years from date of last transaction (FSA 2013 requirement) |
| Non-converting enquiry data | 12 months from date of initial enquiry |
| Website analytics (anonymised) | 26 months (standard Google Analytics retention) |
| Correspondence and emails | 7 years from date of last correspondence |
07Security of Personal Data
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, alteration, or disclosure. These measures include:
- HTTPS encryption for all data transmitted through our website
- Access controls limiting data access to authorised personnel only
- Password-protected and encrypted storage of client records
- Regular review of our data handling practices
Whilst we take reasonable precautions, no method of electronic transmission or storage is entirely secure. We cannot guarantee the absolute security of data transmitted over the internet and do so at your own risk.
08Your Rights as a Data Subject
| Right | What It Means |
|---|---|
| Right of Access | You may request confirmation of whether we hold your personal data, and obtain a copy of that data. |
| Right of Correction | You may request that inaccurate, incomplete, or outdated personal data be corrected without undue delay. |
| Right to Withdraw Consent | Where processing is based on consent, you may withdraw that consent at any time. |
| Right to Limit Processing | In certain circumstances, you may request that we restrict how we use your personal data. |
| Right to Complain | You have the right to lodge a complaint with the Department of Personal Data Protection (JPDP) Malaysia if you believe your rights have been violated. |
09Cookies and Website Analytics
Our website may use cookies and third-party analytics tools (such as Google Analytics) to help us understand how visitors interact with the site. These tools collect anonymised, aggregated data including:
- Pages visited and time spent on each page
- Referring website or search query
- Browser type, device type, and approximate geographic region
This information is used solely to improve the performance and usability of our website. It does not identify you personally.
10Changes to This Privacy Policy
We reserve the right to update or amend this Privacy Policy at any time to reflect changes in our business practices, legal obligations, or regulatory requirements. The revised Policy will be published on our website with an updated effective date.
11Governing Law
This Privacy Policy is governed by and construed in accordance with the laws of Malaysia, including but not limited to the Personal Data Protection Act 2010 and the Financial Services Act 2013.
Contact Us
If you have any questions, concerns, or feedback regarding this Privacy Policy or our data handling practices, please contact us at:
Karwai Risk Management
Penang Island, Pulau Pinang, Malaysia
yuming@wkwconsultancy.com
+6017-983 5873