Personal Data Protection Notice

1. Interpretation

In this Notice, unless the context requires otherwise:

“personal data”

has the meaning given in the Act, and refers to any information relating to you that we process in connection with our Services.

“process”

means collecting, recording, holding, using, disclosing, transferring or otherwise handling personal data.

“Services”

means the financial planning, advisory, account-opening, investment-distribution and related services provided by the Firm.

“you” / “your”

means the individual whose personal data is processed, including a joint applicant, authorised person or beneficiary where applicable.

2. Personal Data We Collect

1. The categories of personal data we may collect and process include:

• Identity data — name, NRIC/passport number, date and place of birth, nationality, gender, race, marital status, mother’s maiden name, and images of your identity documents;
• Contact data — residential and correspondence address, email address and telephone number(s);
• Financial and employment data — occupation, employer, nature of business, income, estimated net worth, source of funds, and bank account details;
• Regulatory data — tax residency and self-certifications (CRS/FATCA), and politically exposed person (PEP) status;
• Suitability data — your responses to the investor suitability assessment, investment objectives, knowledge and experience;
• Transaction and interaction data — records of instructions, signatures, verification codes, and communications with the Firm or your adviser.

1. Where you provide personal data of a third party (including a joint account holder, beneficiary or emergency contact), you represent and warrant that you have obtained that person’s consent for the disclosure and processing of their personal data in accordance with this Notice.

3. Sources of Personal Data

1. We collect personal data primarily from you — directly, or through your appointed adviser — when you engage our Services and complete our forms.
2. We may also receive personal data about you from third parties, including product providers (such as iFAST Capital Sdn Bhd), regulatory and governmental authorities, sanctions and screening databases, and publicly available sources, where necessary to verify your identity or to meet our legal and regulatory obligations.

4. Purposes of Processing

1. Your personal data is collected and processed for the following purposes (“the Purposes”):

• to open, operate, administer and maintain your investment account(s) with iFAST Capital Sdn Bhd or other relevant product providers;
• to verify your identity and conduct customer due diligence, sanctions screening and ongoing monitoring as required under the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (“AMLA”) and the Securities Commission’s AML/CFT Guidelines;
• to assess the suitability of products and services recommended to you, as required under the Capital Markets and Services Act 2007 and relevant SC guidelines;
• to comply with applicable laws, regulations, guidelines, directives and lawful requests of regulatory and governmental authorities, including tax reporting obligations under CRS and FATCA;
• to maintain records, conduct internal audits, and manage complaints and disputes;
• to communicate with you regarding your account, transactions and periodic reviews of your information.

1. Obligatory provision. The provision of your personal data for the Purposes in clause 4.1 is obligatory. If you fail to provide such personal data, or withdraw your consent to its processing, we will be unable to establish or continue your account relationship or provide the Services to you.

5. Disclosure of Personal Data

1. Your personal data may be disclosed, strictly for the Purposes, to the following classes of recipients:

1. Within the Firm, access to your personal data is restricted to your servicing adviser and the Firm’s compliance and administrative personnel on a strict need-to-know basis. All access is logged.
2. We do not sell your personal data, and we do not disclose it to any party for that party’s own marketing purposes.

6. Direct Marketing

1. We do not use your personal data for third-party marketing. We may, from time to time and only where permitted, contact you about products and services related to the account you hold with us.
2. You have the right at any time to require us to cease processing your personal data for direct marketing purposes, at no charge, by writing to the contact set out in Section 13. We will give effect to any such request without undue delay.

7. Transfers Outside Malaysia

1. Your personal data is stored on secure infrastructure which may be located outside Malaysia. Where personal data is transferred to or stored in a place outside Malaysia, we ensure that it is protected by safeguards consistent with the standard of protection required under the Act.

8. Security

1. We implement appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised or accidental access, disclosure, alteration or destruction, including encryption of data in transit and at rest, unique expiring signing links protected by one-time verification codes, role-based access controls, and audit logging of access and changes.
2. While we take all reasonable precautions, no transmission over the internet can be guaranteed to be completely secure. You are responsible for keeping confidential any verification codes and links sent to you.

9. Retention of Personal Data

1. We retain your personal data for as long as necessary to fulfil the Purposes, and in any event for a minimum of seven (7) years after the end of your account relationship, in accordance with AMLA and the record-keeping requirements of the Securities Commission Malaysia.
2. Upon expiry of the applicable retention period, personal data is securely destroyed or permanently anonymised.

10. Accuracy of Personal Data

1. It is important that the personal data we hold about you is accurate, complete and current. Please inform us, or update your adviser, promptly of any change to your name, contact details, financial circumstances or regulatory status so that we can keep your records up to date.

11. Your Rights

1. Right of access. You may request access to the personal data we hold about you, subject to any fee permitted under the Act.
2. Right of correction. You may request the correction of personal data that is inaccurate, incomplete, misleading or not up to date.
3. Right to withdraw consent. You may, by notice in writing, withdraw your consent to the processing of your personal data. Please note the consequence in clause 4.2: withdrawal will result in our inability to continue providing the Services to you.
4. Right to limit processing. You may request that we limit the processing of your personal data, including for any purpose beyond those set out in this Notice.
5. Requests under this Section may be made in writing to the contact set out in Section 13. We will respond within twenty-one (21) days of receipt of a valid request, as required by the Act.

12. Amendments to this Notice

1. We may amend this Notice from time to time to reflect changes in the law or our practices. The current version will at all times be available on our website and through your adviser. Where changes are material, we will take reasonable steps to notify you.
2. This Notice is issued in English and Bahasa Malaysia. In the event of any inconsistency, the English version shall prevail. Sekiranya terdapat sebarang percanggahan antara versi Bahasa Inggeris dan Bahasa Malaysia, versi Bahasa Inggeris akan diguna pakai.