PRIVACY POLICY

The Personal Data Protection Act 2010 (“Act”), which regulates the processing of personal data in commercial transactions, applies to AhaRetail Solutions Sdn. Bhd., Company Registration No.: 202401018053 (1563902-M) (“Company”). For the purpose of this written policy (“Policy”), the terms “personal data” and “processing” shall have the same meaning as prescribed in the Act. The User shall mean any person using this platform for any reason whatsoever and shall include any third party acting on behalf of an individual, company or entity (“User”).

1 Consent

1.1 This Policy serves to inform the User that his personal data is being processed by the Company or on the Company’s behalf when the User accesses the Company’s website at ahapay.my or the Company's mobile application (collectively known as the “Platform”) and the User hereby gives the User’s consent to the processing of the User’s personal data.

2 Description of Personal Data

2.1 The Company may collect a variety of the User’s personal data including but not limited to the User’s name, Malaysian Identification Card number, passport number, e-mail address, geolocation data, contact number, income, credit card and/or debit card details, bank account details including specimen signatures, race, nationality, gender, marital status, education and employment details and history including working experience and employer’s details, credit record (present or historical), source of income or financial circumstances, financial positions, activities or history including payment history and account activities, details of guarantors and legal representatives, litigation and criminal records, details and background of family members and other personal data the User submitted to the Company through the Platform or otherwise and/or in connection with the use of the Platform or the Company’s products and services, and all other personal data the Company again collects from the User on any subsequent occasion.

3 Purpose

3.1 The User’s personal data is being or is to be collected and further processed for:

performing the Company’s pre-contractual and contractual obligations with the User; granting the User access to the Platform and/or in connection with the use of the Platform; assessing the User’s application for any of the Company’s products and/or services; verifying the User’s financial standing through credit reference checks; verifying and carrying out financial transactions in relation to payments the User makes online; providing the Company’s as well as its affiliates, subsidiaries, holding companies products and/or services to the User (or the User’s company, if applicable) and/or in connection with the Company’s and its affiliates, subsidiaries, holding companies products and/or services; communicating with the User; responding to the User’s inquiries and resolving disputes; conducting internal activities; market surveys and trend analysis; improving the Company’s services, content and advertising on the Platform; providing the User (or the User’s company, if applicable) with information on the Company’s products and/or services, promotional offers and of the Company’s related corporations and business partners; conducting other legitimate business activities; complying with any legal or regulatory requirements; and such other purposes directly related to the foregoing,

(collectively, the “Purposes”).

4 Source of Personal Data

4.1 The Company will collect the User’s personal data from a variety of sources including those mentioned below:

a) Information collected from the User directly: When the User registers or applies for the Company’s services, whether as customer, merchant or otherwise, and/or purchases any of the Company’s products and/or services. When the User browses or visits or registers on the Company’s Platform, and/or uses any of the Company’s services, and/or purchases any of the Company’s products and/or services. Via any verbal, written or electronic communications with the Company or the Company’s authorised agents. When managing or transacting the User’s accounts and when making transactions. When the User takes part in surveys, promotions, and advertisements on the Platform.

b) Other sources: Credit reporting agencies and publicly available sources such as searches at government authorities or agencies. Any other sources which have the User’s consent to disclose the User’s information. Other sources where permitted by law or not otherwise restricted.

5 Cookies

5.1 The User agrees and consents that the Company may from time to time set up cookies on the User's computer and may access those cookies. Cookies can be disabled and enabled in the User’s web browser and/or mobile settings.

5.2 Any information so collected by the Company will be non-personal and anonymous and such information is obtained solely to understand the User’s use of the Platform.

6 Right to Access the User’s Information

6.1 The User may e-mail the Company’s customer support at [email protected] if the User wishes to do any of the following:

request to update/ change/ delete/ amend/ correct the User personal data held by the Company by providing the Company with the specific details if the same cannot be done via the User's profile page; make any complaint or inquiry the User has in respect of the use of the User's personal data; check or request from the Company any of the User's personal data being held or processed by the Company; and/or request from the Company a copy of the User's personal data being held or processed by the Company.

6.2 The User's request above is however subjected to:

the Company's right to refuse the User's request as allowed under the Act; and the User's payment of charges imposed by the Company for processing the above mentioned request(s) made by the User.

It shall be the User's responsibility to update and check the accuracy of the User’s personal data supplied to the Company or held by the Company and the Company shall not be responsible for any inaccuracy or error found in the User's personal data.

7 Limiting Information Processing

7.1 The User has the option of withdrawing the User’s consent or limiting or preventing distribution or processing of the User’s personal data, or personal data relating to other persons or entities who may be identified from the User’s personal data, by e-mailing the Company’s customer support at: [email protected].

Subject to provisions of the Act:

the User may, upon payment of a prescribed fee, make a data access request in writing to the Company; and the Company may refuse to comply with a data access request or a data correction request and shall, by notice in writing, inform the User of the Company’s refusal and the reasons of the Company’s refusal.

8 Disclosure of Personal Data

8.1 The Company will disclose or may disclose the User’s personal data to any other users of the Platform, the Company’s related corporations, business partners, service providers, credit reporting agencies, the Company’s financial and professional advisors, banks, governmental departments and/or agencies, regulatory and/or statutory bodies and any such third party requested or authorized by the User for any of the Purposes.

9 Third Party Personal Data

9.1 In the event that personal data of any third party is supplied by the User to the Company, the User shall ensure that such third party has read this Policy and consented to the Company collecting his personal data for any of the Purposes prior to the supply of his personal data to the Company. The Company may also require the User’s assistance if the personal data relating to other persons are required to process the User’s personal data for the Purposes and the User hereby agree to use the User’s best endeavors to assist the Company when required.

10 Disclosure to Third Parties

10.1 Apart from the Company’s staff, employees, affiliates, subsidiaries, holding companies, the Company may share and disclose the User’s personal data to certain third parties including but not limited to those mentioned below:

any person who requires the services of the Company; any person proposing to give a guarantee or security to guarantee the party's obligations; any of the Company’s agents, representatives, advisers, consultants, operators, programmers, developers, engineers or system providers who are employed or engaged to run, process, or administer the Platform and goods and/or services offered under the Platform; other external professionals providing services to the Company or on the User’s behalf such as auditors, solicitors and advocates, trustees, valuers, tax consultants, banks, financial institutions and accountants; liquidators, receivers and managers, auctioneers; prospective buyers, dealers of any business or assets; creditor reporting agencies, debt collection agencies, regulatory authorities, police, officers and/or public authorities; any person as required by any applicable laws, rules, regulations, court orders or guidelines; any of the Company’s assignees or transferees of the Company’s rights, interests or obligations; and any other person as required and authorised by the Company to run the Company’s day-to-day operations of the business and goods and/or services offered via the Platform.

Save for the relevant parties stated above, the Company will not otherwise disclose the User’s personal data without the User’s consent.

11 Mandatory or Voluntary Information

11.1 It may be mandatory or optional for the User to supply the User’s personal data to the Company, depending on the situation.

Mandatory Information Where such information is compulsory and MUST be provided by the User, if the User refuses to do so the Company will NOT be able to offer the Company’s services and/or products to the User. Voluntary Information Where such information is optional and the User may choose whether to provide the Company with such information or otherwise, if such information is not provided, it will not affect the User’s use of services and/or purchase of the products and/or services.

12 Transfer of Personal Data Outside Malaysia

12.1 The Company may transfer the User’s personal data to a place outside Malaysia and the User hereby gives the User’s consent to such transfer.

13 Security of the User’s Personal Data

13.1 The Company ensures that all information collected will be safely and securely stored for a maximum of 7 years.

13.2 The Company uses advanced technology, secure third-party suppliers, and well-defined employee practices to help ensure that the User’s personal data is processed promptly, accurately, completely, and securely. The processing of the User’s personal data will be performed by manual and automated means. In order to maintain the effectiveness and security of these systems, policies and procedures, the Company may also from time to time process the User’s personal data for internal testing purposes.

13.3 The User does however acknowledge that the transmission of personal data via the internet is not completely secured. Although the Company will do the Company’s best to protect the User’s personal data as set out above, the Company cannot completely guarantee the security of the User’s personal data transmitted to the Company’s Platform. Once the Company has received the User’s personal data, the Company will use strict procedures and security features to try to prevent unauthorised access.

14 Changes to Privacy Policy

14.1 Please note that this privacy policy may be amended from time to time at the Company’s own discretion and it is the User’s responsibility to visit the Platform on a regular basis to keep themselves informed of updates and changes. By continuing to use the Platform and the services provided therein or by omitting to withdraw the User’s consent, the User is deemed to have accepted and consented to any such revision and updates.

15 Accuracy of the User’s Personal Data

15.1 The User is responsible for ensuring that the information the User provides to the Company is accurate, complete, not misleading and kept up to date. If the User fails to supply the Company the compulsory personal data, the Company may cease, refuse or be unable to provide, the User with the services and/or products requested.

16 Conflict

16.1 This Privacy Policy is issued in both English and Bahasa Malaysia. In the event of any inconsistencies or discrepancies between the English version and the Bahasa Malaysia version, the English version shall prevail.