INCARD MARKETING SND BHD'S PERSONAL DATA PROTECTION POLICY

Please read this Personal Data Protection Policy ("Policy") or the Policy as amended at any time by INCARD ("We", "Us" or "Our") at its sole discretion (which supersedes prior Policy(s)), to appreciate Our handling of Personal Information (defined below).

In accordance with the Personal Data Protection Act ("PDPA") 2010 and in accordance to the GDPR, a Customer ("You" or "Your") has the right to know the reasons We collect and use such Personal Information, and whom We may share the Personal Information with.

What Personal Information do We Handle?

In this Policy, "Personal Information" means only the information which You provide and which information relates, directly or indirectly, to a natural person, who is identified or identifiable, from that information or from that and other information, in Our possession. Such Personal Information includes the person's:

• name, home address, business address, date of birth, gender, nationality, race, identity records (including National Registration Identity Card or passport details), spoken language, telephone number, fax number, mobile phone number and e-mail address;
• credit card or debit card or banking details;
• details or usage or analytics of the usage (for example including but not limited to the sent or received, amount of data, IP addresses, transmission details, details of the hardware used, the time of use, duration of use, clickstream data of pages browsed, personal settings, interest and preferences), of the subscribed, Services or third party services;
• details or usage or analytics of the usage of mobile devices (for example including but not limited to the mobile device's unique identifier and the location) if used to access the subscribed, Services or third party services;
• CCTV recordings of Your visits at any of our branches;
• Recordings of Your phone calls to Us (at Our help desk or at any of Our other contacts).

Why We Collect Your Personal Information?

We require the aforementioned obligatory Personal Information for, communicating with You, tailoring Services for Your needs, improving our services and the proper functioning of Our business, when providing Your requested Service including but not limited to:

• for the purpose of verifying Your identity;
• if We believe it is relevant, to process Your application for or in providing You, the Services;
• if We believe it is relevant to operate Our business including but not limited to:
  • managing "Our System" which includes Our, network, servers or employed software;
  • maintaining the security of Our system (including against security breach);
  • detecting, rogue activities or fraudulent activities or activities that might reduce our reputation, and stopping such activities;
  • verifying credit worthiness;
  • processing credit card payments;
  • administering the Services provided to You by collecting analytic information for, billing purposes, collecting payments due, monitoring Our performance (service levels, service issues and its resolution, or QA/QC)

What is Your Obligation in Providing Personal Information?

As such, You are responsible for providing such Personal Information as required by Us. Please note that as a condition to use of Services, You shall ensure that the Personal Information at all times is, complete and accurate, failing which We shall not take responsibility nor are we liable for any inaccuracy of such Information provided and We reserve the right to terminate Your Agreement without notice.

What are Your Options in Providing Personal Information?

You, however, have the right to decline providing certain information. However, in the event that You refused to provide such information, may prevent us from providing our full capacity of the Service rendered depending on the information that You choose not to provide.

What About Other Information You Provide?

For the avoidance of doubt, "Other Information" is any information which You provide and NOT requested by us and which such information may relates, directly or indirectly, to a natural person, who is identified or identifiable, from that information or from that and other information, in Our possession. We will not be responsible for the Other Information's security.

How do We Collect Your Personal Information?

Such Personal Information may be collected:

• when You, visit our offices, communicate with Us, subscribe to Services, use such Services (which includes but is not limited to any analytics from the background, infrastructure or network), participate in Our programmes, register Your interest in requesting for information, enter a business relationship with Us, visit Our website or give Us by any other means; or
• from other sources, which You have consented Us to collect from (for example including but not limited to credit rating agencies) or where legally permitted.

How do We Handle Your Personal Information?

If We believe it is necessary, to fulfil any of the purposes mentioned above for collecting Personal Information, we may at any time, without notice to You, pass such Personal Information to:

• Our employees or, companies or organizations or businesses, affiliated with Us;
• the appropriate, credit card company or finance institution, processing payment transactions;
• Government agencies, judicial bodies, regulators or law enforcement agencies; or
• such parties as per Your, express or implied, consent;

What About Up-Dating of Personal Information?

We make every effort to up-date Personal Information and You are responsible for, such up-dating. Subject to verification, You may assess Personal Information which you had provided in response to Our request and update the same.

How Do We Handle Cookies at Our Website?

When You, use Our website or access Our content through another website, We collect information of the usage from cookies. The cookies, which are stored on the device accessing Our website, only identifies the device and not the user.

What is Our Security Assurance?

We make every effort to implement a security system that prevents unauthorized access of Personal Information (including by Our staff without clearance). For example:

• when You transmit Personal Information to Us, We encrypt the input by use of [128 bit] Secure Sockets Layer (SSL) software;
• only the last four digits of your credit number is shown for the purpose of confirming a payment transaction;
• We employ firewalls to prevent unauthorized hacking.

What are the Security Measures You Should Consider?

The internet is not a secure environment. Whilst We make the aforementioned efforts to prevent breach, You should transmit confidential information only if You have taken appropriate security steps to protect the transmission.

Is Personal Information Transferred Outside Malaysia?

We do not transfer Personal Information outside Malaysia save for instances the parties mentioned above to whom we pass Personal Information are "Overseas Entities" located outside Malaysia. You consent to passing such Personal Information to Overseas Entities where necessary.