Privacy Policy

1. Who we are and how to contact us

We are the data controller for the personal data described in this Policy. For any privacy question or request, including matters for our data protection officer, email us at [email protected] with the subject line "Privacy".

2. Scope

This Policy applies to our borrower website and mobile app, our lending services, and our communications with you. It covers applicants, borrowers, and people who act for a company borrower. People named as guarantors should also read our Guarantor Notice. It does not apply to third-party websites or apps linked from our services.

3. Personal data we collect

• Identity and contact: full name, NRIC or passport number, date of birth, gender, nationality, address, email and mobile number.
• Financial and employment: employment and employer details, education level, income and affordability information, bank account details, and your applications, loans, repayments and payment history.
• Credit and screening: credit reports and scores from registered credit reporting agencies (such as CTOS and Experian), and fraud, sanctions and politically exposed person (PEP) screening results.
• Identity verification (e-KYC): images of your identity document, and a selfie or liveness check and its result.
• People you tell us about: emergency contacts, guarantors and company representatives. You must have their permission before giving us their details.
• Technical and usage: device type and operating system, app version, IP address, log and crash data, cookies, and how you use our services.
• Communications: messages, emails, call notes and support requests between you and us.

4. Sensitive personal data, including biometrics

The facial images and liveness data used to verify your identity are biometric data, which the PDPA treats as sensitive personal data. We process biometric data only with your explicit consent, only to confirm your identity and prevent fraud, and through verification providers bound by confidentiality and security obligations. We may also process other sensitive data where the law requires it, for example for anti-money laundering checks.

5. How we collect it

• directly from you, through forms, e-KYC, uploads and your messages to us;
• automatically, through cookies, logs and app software development kits (SDKs);
• from third parties such as credit reporting agencies, identity verification, screening and payment providers, and people who apply with or for you, with your consent or as permitted by law.

6. Why we use it

• To provide our services: account setup, identity verification, assessing applications and affordability, preparing and signing agreements, disbursing loans, taking repayments and servicing your loan.
• To assess your credit: we use the information in your application to assess it, including your age (from your date of birth) and your education level as declared in your application. This assessment includes automated risk analysis. Transactions in the bank statements you upload are analysed for affordability and spending patterns as part of this assessment. Documents you upload (such as payslips, employment letters and company extracts) may be read by TrueStack's document service so we can pre-fill your details; you choose whether to use what was read.
• To meet legal obligations: the Moneylenders Act 1951 and KPKT requirements, the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA), record keeping and reporting to authorities.
• To protect you and us: fraud prevention, security, and recovering overdue amounts.
• To keep you informed: service messages, payment reminders and important notices by email, SMS, WhatsApp, app notification or letter.
• Marketing: we may tell you about our products, promotions and offers through the app, WhatsApp or email. You can switch this off at any time in Settings → Notifications → Offers and promotions, or by emailing us. Switching it off does not affect your loan or the service messages we must send you.

We do not sell your personal data, and we do not use it for advertising profiles.

7. Information you must give us

Information marked as required in our forms, and identity verification, is needed to assess and provide a loan and to comply with the law. If you do not provide it, we may not be able to process your application or continue providing our services. Other information is optional.

8. How we handle personal data (PDPA principles)

• Notice and choice: we tell you what we collect and why, and ask for consent where it is required.
• Purpose and minimisation: we collect only what we need for the purposes above.
• Accuracy: you can update your details in your profile, and we verify key information with trusted sources.
• Accountability: management is responsible for data protection, staff are trained, and our practices are reviewed regularly and when the law or KPKT guidance changes.

9. Who we share it with

• service providers that help us operate: identity verification, e-signature and screening, payments and banking, messaging, IT and hosting;
• other third parties we work with, including technology and data partners, only for fraud prevention and credit risk assessment, under confidentiality and data protection safeguards;
• credit reporting agencies, for credit checks and to report your repayment record, including missed payments, under the Credit Reporting Agencies Act 2010;
• your guarantor, limited to what they need to know about the loan they guarantee;
• our lawyers, auditors, advisers and debt recovery agents;
• regulators, courts and law enforcement, including KPKT, when the law requires it;
• a buyer or successor of our business, under confidentiality safeguards.

Anyone processing personal data for us must protect it under a written agreement and use it only for our instructions.

10. Transfers outside Malaysia

Some of our providers store or process data outside Malaysia. When data leaves Malaysia, we make sure it is protected to a standard comparable to the PDPA, for example through contractual safeguards, as permitted by the PDPA and the Commissioner's guidelines.

11. Security and data breaches

We protect personal data with administrative, technical and physical safeguards, including encryption in transit and at rest, access controls, role-based permissions, logging and monitoring, and vendor checks. No system is completely secure.

If a personal data breach occurs, we act to contain it and notify the Personal Data Protection Commissioner as the PDPA requires. If the breach is likely to cause you significant harm, we will also tell you without unnecessary delay, including what happened and what you can do to protect yourself.

12. How long we keep it

We keep personal data only as long as needed for the purposes above. Lending, repayment, identity verification and anti-money laundering records are kept for 7 years after your last loan is fully settled or your account is closed, whichever is later, or longer while a dispute, investigation or legal claim is unresolved. After that, we securely delete or anonymise it. See Account & Data Deletion for details.

13. Your rights

Subject to the PDPA and our legal obligations, you have the right to:

• access the personal data we hold about you and get a copy;
• correct personal data that is inaccurate, incomplete or out of date;
• withdraw consent you have given, although we may then be unable to provide some services;
• stop us using your personal data for direct marketing (Settings → Notifications, or email us);
• ask us to stop processing that is causing, or likely to cause, you substantial damage or distress;
• ask us to transmit your personal data to another data controller of your choice, where technically feasible (data portability);
• ask us to delete your personal data, except what we must keep by law.

To close your account and delete your data, go to Settings, then Close account & delete data, in the app or website. For any other request, or if you do not have an account, email us. We will verify your identity before acting on a request and respond within the time the PDPA requires.

14. Cookies

We use cookies and similar technologies to keep you signed in, keep our services secure and understand how they are used. See our Cookie policy.

15. Children

Our services are only for people aged 18 or over. We do not knowingly collect personal data from anyone under 18.

16. Concerns and complaints

If you are unhappy with how we handle your personal data, email us first. If you are not satisfied with our reply, you can contact the Personal Data Protection Commissioner at pdp.gov.my. See also Complaints & Disputes.

17. Language, changes and governing law

This Policy is available in English and Bahasa Melayu. If the two versions differ, the English version prevails. We may update this Policy and will publish changes here with a new "Last updated" date; we will tell you about significant changes. This Policy is governed by the laws of Malaysia.

Questions or requests can be sent to [email protected] or via www.aventiscapital.com.my.