Personal Data Protection Act Policy

Personal Data Policy

1. As a company that deals regularly with the personal data of its customers, the Company is committed to upholding data protection and privacy in line with the Personal Data Protection Act 2010 (“the Act”).

2. To comply with the responsibilities under the Act, the Company sets out this policy as a framework for its obligations. The end objective is to ensure that all data processed by the Company is protected and managed in accordance with the latest applicable standards.

Scope

This Policy sets out the responsibilities and obligations of the Company, its Officers, affiliates and third parties acting on its behalf for the collection, processing, use, storage and management of personal data. Any references to the responsibilities of “Officers” shall also be interpreted as the responsibilities of all parties specified under this Policy.

Defining Personal Data

1. Personal Data means information that identifies customers and shall include but not be limited to the following information:

   1. name, job title and company name;

   2. age, gender, date of birth, identity card number, passport number, photograph;

   3. race, ethnic origin, nationality, physical and mental health;

   4. contact information including address, email address and phone number;

   5. marital status, details of children, occupation, work history, performance reviews, income, employer, references and any other details of past employers;

   6. type of loans applied for in relation to purchase of property;

   7. financial and credit card details, bank name and other pertinent banking information, tax file identification number, EPF number, SOCSO number, criminal history; and

   8. such other relevant information and data provided by the customer in the course of business relationship.

2. This definition includes information that has been obtained through any means, whether formally or informally, so long as the information is obtained in the course of the business relationship.

3. “Business relationship” includes all of the Company’s business process and execution, services, client relationship, management and business development activities.

Collection of Personal Data

1. Officers must collect personal data only by lawful and fair means that have been consented to by the customer, and not in an unreasonably intrusive way.

2. Officers may obtain personal data about customers from other sources so long as such sources are legal and credible. Examples of such sources are:

   1. official registration forms (either electronic or printed), newsletter subscription or any other promotional events;

   2. official request for information forms that are provided to customers by the Officers;

   3. any queries, emails or any correspondences that Officers have received from customer requesting for information or making enquiries;

   4. any ‘contact us’ forms that customers have submitted through the Company’s Platform;

   5. from a government agency or registry or any referrals that Officers may have obtained from existing customers with whom the Company has established a business relationship.

Maintaining the Integrity of Personal Data

The Company shall do the following to protect the personal data from any loss, misuse, modifications, unauthorized or accidental access or disclosure, alteration or destruction:

1. Register all Officers involved in the processing of personal data.

2. Terminate the Officer’s access rights in the event of resignation, termination or any adjustment to the Officer’s role in relation to personal data processing.

3. Control and limit the Officer’s access to personal data on a need-to-know basis. Officers whose role do not include the necessity of processing personal data shall not be given access. Any access shall be recorded in a register and properly maintained.

4. Provide user ID and password for Officers to access personal data.

5. Update the Back up/Recovery System and anti-virus to prevent personal data intrusion.

6. Safeguard the computer systems from malware threats to prevent attacks on personal data.

7. Ensure that all relevant agreements between the Company and its Officers, affliates and third parties include confidentiality obligations in respect of personal data.

Right to Access & Correct Personal Data

1. Customers have a statutory right to request for access and correction of personal data. The Company in upholding this right shall ensure that the personal data collected and processed is accurate, complete, not misleading and kept updated.

2. The Company shall provide an avenue for the correction of personal data, either by way of the Platform or any other means of communication.

3. The Officers shall update personal data records immediately once a data correction notice is received from a customer.

Disclosure of Personal Data

1. All personal data must generally be kept confidential by the Officers, save for disclosure to the following categories of parties on a need-to-know basis:

   1. Any persons, government agencies, statutory authorities and/or industry regulators where the Company is compelled to disclose Personal Data pursuant to any law or regulation;

   2. The Company’s affiliates, partners, third parties, service providers, representatives and agents, to provide related and/or supporting services in connection with the Company’s business activities;

   3. The Company’s customer’s auditors, consultants, accountants or any relevant financial institutions or professional advisers;

   4. Counterparties or counterparties’ advisers, agents and representatives in any legal and/or commercial transaction, financial institutions for loan documentation processing, relevant state authority and the Inland Revenue Board.

2. All disclosure requests must be reviewed by the Legal & Compliance team and approved by the CEO/CSO before the disclosure can be made.