Legal
Effective date: 16 August 2026
01
Cross-Border Real Estate Advisory is an independent, fee-only advisory practice operated by Andrew May, based in Kuala Lumpur, Malaysia. We provide cross-border real estate intelligence and advisory services to private clients, family offices, and qualified intermediaries across multiple jurisdictions globally.
Contact: andrew@crossborderrealestate.io
02
We collect information you provide directly when you submit an enquiry through this website, correspond with us by email, or enter into an advisory engagement. This includes your name, organisation, contact details, and the nature of your enquiry. We do not use tracking pixels, advertising networks, or behavioural analytics tools. This site does not set cookies beyond those set automatically by Cloudflare as part of the infrastructure on which the site is hosted. Cloudflare acts as a data processor on our behalf and may collect standard server log data including IP addresses. A data processing agreement with Cloudflare is in place governing that processing.
03
We process your personal data to respond to enquiries, assess whether an engagement is appropriate, and fulfil our obligations under any advisory agreement. The governing framework for our processing is the Malaysian Personal Data Protection Act 2010 (Act 709). The legal basis for processing is your consent where you have submitted an enquiry, and the performance of a contract where an engagement proceeds.
If you are located in the United Kingdom or European Economic Area, the UK GDPR and EU GDPR respectively apply to our processing of your personal data in addition to the PDPA. Under those instruments we rely on the same legal bases of consent and contract performance. Individuals in other jurisdictions may have additional rights under their applicable local data protection law, which they may exercise by contacting us directly.
04
Our practice receives personal data from individuals located in multiple jurisdictions globally. That data is processed in Malaysia where our practice is based. Where we engage professional advisers (legal, accounting, or compliance) in connection with an engagement, we share only the minimum information necessary and require those advisers to maintain confidentiality. We do not transfer personal data originating from individuals in the United Kingdom or European Economic Area to third parties outside those regions without ensuring an appropriate transfer mechanism is in place, including Standard Contractual Clauses where required.
05
We use your information solely to communicate with you about your enquiry or engagement. We do not sell, rent, or share your personal data with third parties for marketing purposes. We do not use your data for automated decision-making or profiling.
06
In the event of a personal data breach affecting individuals located in the United Kingdom or European Economic Area, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach where required under the applicable GDPR, and will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
07
Enquiry correspondence is retained for two years from the date of last contact, reflecting the period during which an enquiry may reasonably be reactivated and within which any dispute arising from initial contact would ordinarily be raised. Engagement records are retained for seven years from the date of engagement completion in line with accounting and professional practice obligations under Malaysian law. After the applicable retention period, records are securely deleted.
08
Under the Personal Data Protection Act 2010, you have the right to request access to the personal data we hold about you and to correct inaccurate data. We will respond to any such request within 21 days of receipt, as required by Section 31 of the Act. You may also withdraw consent for processing where consent is the legal basis, by written notice to us.
If you are located in the United Kingdom or European Economic Area, you additionally have the rights to erasure, restriction of processing, data portability, and to object to processing under the applicable GDPR. You also have the right to lodge a complaint with your local supervisory authority - the Information Commissioner's Office in the United Kingdom, or the relevant national data protection authority in your EU member state.
To exercise any of these rights, contact us at andrew@crossborderrealestate.io.
09
This policy and any dispute arising from it are governed by the laws of Malaysia. Any dispute that cannot be resolved by correspondence will be referred to arbitration seated in Kuala Lumpur under the rules of the Asian International Arbitration Centre. Nothing in this clause affects the statutory rights of individuals under the UK GDPR or EU GDPR, including the right to bring a complaint before the relevant supervisory authority.
10
We may update this policy from time to time. The effective date above reflects the most recent revision. Material changes will be communicated by email to anyone with an active engagement at the time of the change.