Privacy Policy

• Personal details such as sensitive personal data, name, identity card or passport number, gender, race, nationality,date of birth or age, marital status, occupation, photo, credit card number, assets, financial,banking account details, IMEI number, etc.
• Contact details such as addresses, e-mail address, telephone number, mobile number, facsimile number, etc.
• Biometric data such as fingerprints, facial recognitions, etc.
• Information in connection with services provided by us or you have registered your interest with us for information, updates, inquiries, engagement, etc.
• Billing and payment status and records.
• Other information that are, have been or may be collected by SWAP or which you provide to us, from time to time, in connection with any service, transaction, survey, questionnaire or communications with SWAP.
• CCTV recording of image or images of individuals representing you or acting on your behalf, when you or such individuals visit our premises including our branches.
• When you visit our website, there is automatic collection of some information about your computer such as IP addresses, web browser software and other information about your visit.
• Personal data from credit reporting agencies, government agencies, credit bureau reports, etc.

1. Existing and/or potential clients/customers
   

   In order for us to provide our services effectively and efficiently, SWAP will collect Personal Date manually and/or electronically and further process Personal Data, where required, in connection to the delivery of our service,including the following but not limited to:

   • To verify your identity;
   • To process your request for to purchase our product and/or services, understand your needs and offering products and/or services to meet these needs;
   • To deliver our product to your desired address and location;
   • To resolve complaint or delivery problem (if any);
   • To communicate marketing and advertising materials with you in relation to our services (only with your consent);
   • To respond to enquiries from clients/customers;
   • To apply for relevant travel visas in the event of travel overseas;
   • To operate our premises in manner which is physically safe, secure and befitting of health and safety requirements;
   • To protect our rights or property and that of our users and, where appropriate, to comply with legal and regulatory requirements;
   • To maintain records required for as permitted to be collected by law, professional standards, security, claims or other legal purposes;
   • To provide individuals with information about SWAP's other services, as well as the services of its related companies;
   • For administration purposes including billings, payment and debt collection;
   • For insurance purposes;
   • For data processing purposes;
   • For risk management purposes;
   • For internal investigations, audit or security purposes;
   • For such other purposes as permitted by applicable law or with your consent;
   • For business planning and development;
   • For all other purposes incidental and associate with any of the above.
2. Existing and/or potential vendor, supplier and service providers

   Personal Data is collected and further processed by SWAP for the assessing, selection, administration, etc. of vendor, supplier and service providers.

3. Existing and/or potential employees

   Personal Data is collected and further processed by SWAP for recruitment purposes and updating of employee information in the personal files as required by the Employment Act.

4. SWAP may collect Personal Data directly from you when you:
   1. communicate with us (for example when you submit an application form to become our customer or when you contact us for any enquiries including by calling our customer service);
   2. submit an application form manually or electronically to purchase, register or subscribe for a specific product and/or service or our publications;
   3. participate in any of our surveys;
   4. register interest and/or request for information of (through our online portals or other available channels) or subscribe to our products and/or services;
   5. respond to any marketing materials we have send out;
   6. commence a business relationship with us (for example, as a service provider/business partner);
   7. visit any of our offices;
   8. use or interact via any of our digital applications, visit or browse our websites or social media pages;
   9. lodge a complaint with us; and
   10. provide feedback to us (for example via our websites or in person).
5. Other than Personal

   Data obtained from you directly (as detailed above), we may also obtain your Personal Data from third parties we deal with or are connected with you (credit reference agencies or financial institutions), and from such other sources where you have given your consent for the disclosure of information relating to you, and/or where otherwise lawfully permitted.

• The appointed courier company to deliver the purchased product;
• Our clients who appoint us to carry out our services or on our behalf (such as auditors, lawyers, company secretary, consultants, contractors, professional advisors, etc.) which involves your Personal Data;
• Law enforcement agencies, regulatory or other government agencies or to other third parties, in each case to comply with legal or regulatory obligations or request by relevant governmental authorities, statutory authorities, local council and industry regulations (such as Securities Commission, Bursa Malaysia Security Berhad, Companies Commission of Malaysia, etc.);
• Companies and/or organisations that assist us in processing and/or otherwise fulfilling transactions and providing you or our clients our services;
• Our business associates and other parties who may jointly provide services requested for purposes that are related to our purpose of collecting and using Personal Data, subject at all times to any laws (including regulations, guidelines and/or by-laws) applicable to SWAP; and
• Personal Data may also be disclosed to other parties in respect of whom you have given your express or implied consent to such parties as we or our business units may be required by law, court, regulator or legal process to disclose.

When disclosing your Personal Data with third parties, we will identify the type of data and restrict the access to only what is necessary. We will conduct due diligence and establish contractual safeguards to ensure your Personal Data is processed and handled in accordance with the law.

It may be necessary for SWAP to transfer Personal Data outside of Malaysia for data storage, backup and/or if our clients or business associates involved in the provision of our services are located outside of Malaysia or if you are located outside of Malaysia and require our services, in order for us to perform our service. We shall take reasonable steps to ensure that any such transfers of Personal Data are adequately secure and in compliance with the Act. The transfer of your Personal Data outside of Malaysia may be executed by SWAP to a country with laws that are substantially similar or with equivalent protection to the Act in the following manner :

• The transfer of your Personal Data for the performance of obligations under a contract between you and SWAP;
• The transfer of your Personal Data for the conclusion or performance of a contract between SWAP and third party;
• The transfer of your Personal Data for the purpose of legal proceedings;
• The transfer of your Personal Data under reasonable grounds to do so;
• The transfer of your Personal Data after having taken all reasonable measures and exercised due diligence to the cross-border transfer; and
• The transfer of your Personal Data is necessary to protect your vital interests.

In accordance with the Act, individuals have rights to access, delete and correct your Personal Data held by us, if you are of the opinion that such Personal Data held by us is inaccurate, incomplete, misleading or not up-to-date, may make a written request to SWAP by contacting us at the contact details provided below:

DataProtectionOfficer@swap-asia.com

Please provide us proof of your identity, address and other sufficient information to enable us to identify you when submitting your request. On receipt of your written request, we may comply or refuse your request to access or rectify your Personal Data. If we refuse, we will notify you

the reason for such refusal or charge a fee for processing your request for access or rectification permitted by law to help us defray administration cost.

In accordance with the Act, you have rights to request for the transfer of Personal Data held by us to another organization (data controller) of your choice, subject to technical feasibility and compatibility of the data format within fourteen (14) to thirty (30) days subject to the terms of this clause 6.0.

Your data portability right does not apply to Personal Data that are available on hard copies. The Personal Data must be in a structured, commonly used and machine-readable format. Your data portability right does not extend to data inferred by or derived by us from the information provided by you including data generated through the analysis of your Personal Data. For the avoidance of doubt, your request of data portability shall be subject to the original consent and purpose for which it was disclosed to SWAP.

Once your Personal Data is transmitted by SWAP to the data controller of your choice, SWAP is no longer accountable for the security and handling of your Personal Data. You are advised to take all reasonable measures to secure lawful processing of the Personal Data and to ensure the data controller of your choice understands its legal responsibilities.

If you wish to to exercise your rights under this clause, you may make a written request to SWAP by contacting us at the contact details provided below :

DataProtectionOfficer@swap-asia.com

Please provide us proof of your identity, address and other sufficient information to enable us to identify you when submitting your request. On receipt of your written request, we may either grant or refuse your request for data portability. Where your request for data portability is not possible, we will notify you on the reason for such refusal. Alternatively, should the request be approved, we may impose a fee to cover the administration costs associated with processing your request.

SWAP will take reasonable steps to make sure that Personal Data it collects uses or discloses is accurate, complete, not misleading and up-to-date. SWAP may review your Personal Data as and when required, to ensure its accuracy and completeness.

• SWAP will take reasonable steps to protect the personal data it holds from loss, misuse, modification, unauthorised or accidental access or disclosure, alternation or destruction.
• SWAP will review, on an ongoing basis, its collection and storage practices to ascertain how improvements to security and protection of Personal Data can be achieved.
• SWAP will implement organizational training and awareness on Personal Data protection to ensure its employees are informed and well-versed in Personal Data protection practices as part of the company's security measures.
• Your Personal Data is protected when it comes into our possession regardless of whether it is in electronic or hard copy format, in accordance with the Personal Data Protection Act and industry accepted security standards which are implemented by SWAP. This includes physical security at our premises and storage electronically on a server which is situated in protected and controlled facilities.
• You should note that, except in the case of certain encrypted information, the information you transmit across public internet or other facilities may not be secure and SWAP will not be responsible for or liable for any loss you suffer during transmission. Once the Personal Data you have transmitted to us has passed through our firewall or otherwise into our control, it is then our responsibility to ensure that it is treated in the manner required under this Privacy Policy. If we transfer your Personal Data to another entity, we will only do so in accordance with this Privacy Policy and in a manner that is secure as between SWAP and that other entity.
• SWAP will, to the extent technically practicable, destroy or de-identify Personal Data once it is no longer required by us for use, within as short a time as is reasonably possible (taking into account any specific requirements of its clients), unless the law requires otherwise.
• SWAP will only allow our employees and contractors access to your Personal Data in order to perform their duties and obligations and we will take all reasonable steps to ensure that those employees and contractors handle your Personal Data in a manner that is consistent with this Privacy Policy and SWAP's legal responsibilities in relation to privacy including performing contract with the contractors.
• You should note that whilst our website may link to other websites, those other websites are not under our control and we are not responsible for the conduct of the operator of those websites including how they handle and protect your Personal Data. Before accessing those websites, we recommend you review the terms and conditions of or access to such websites including the relevant privacy policy or provisions.

Nevertheless, you are required to ensure the security of your password and not to disclose it to another party to reduce the risk of data breaches.

The Personal Data collected will only be retained for as long as it is required for the purposes for which it was collected or as required to comply with legal or regulatory purposes. SWAP shall retain your Personal Data for a maximum period of ten (10) years from the date of collection. After the expiry of this retention period, SWAP shall ensure to securely destroy, dispose and delete your physical or digital Personal Data in accordance with legal requirements.

• right to access your Personal Data provided to us;
• right to correct and/or update your Personal Data;
• right to data portability of your Personal Data held by us to another organization;
• right to withdraw your consent for us to process your Personal Data, in which the consequences are, we shall delete all information pertaining to your Personal Data and we may not be able to provide you with our required services or to consider you for the employment opportunities.
• right to prevent processing likely to cause damage or distress; and
• right to prevent processing for purposes of direct marketing.

In exercising your rights, you may complete and submit us the request form as set forth in Appendix 2 (Personal Data Access Request Form), Appendix 3 (Personal Data Correction Request Form), Appendix 4 (Data Subject Data Portability Request Form) and Appendix 5 (Prevent Processing of Personal Data Form) or contact us directly at the email address set out under ‘Contact Details’ section given below.

If you wish to unsubscribe to any marketing communications, please contact us. Alternatively, you may also update your preferences in our websites and apps settings. Please be aware that once we have received your request to unsubscribe, it may take up to fourteen (14) working days for us to process your request and to be reflected in our systems. Therefore, you may still receive marketing communications during this period of time.

We may modify or amend this Policy from time to time at our discretion. The updated version shall apply and supersede any and all previous version. We will update the latest version on our website.

Our website may have links to websites maintained by third parties. This Policy applies solely to SWAP’s website and does not apply to any third party websites. To determine which third party websites deal with your Personal Data, it is recommended that you read their respective Personal Data Protection Policies.

In the event of any conflict between this English language Personal Data Protection Policy and its corresponding Bahasa Malaysia “Polisi Perlindungan Data Peribadi”, the terms in this English language Policy shall prevail.