PERSONAL DATA PROTECTION NOTICE
(For Customers, Service Providers and Business Associates)

This is Personal Data Protection Notice (hereinafter referred to as "Notice") list under this website or mobile apps (hereinafter referred to as "Services") of platform operator totalpay.com.my (hereinafter referred to as "Totalpay") is committed to keep individual information of people ("customers and clients") protected and secured. Totalpay is manage and develop by software provider Bright-Win Technology (M) Sdn. Bhd. including its branches in Malaysia. We trust this Notice causes you realise how we handle the individual information about our data subjects that we gather and how data subjects can control our revelation of such information. Totalpay is subject to the Personal Data Protection Act 2010 (hereinafter referred to as "PDPA") and this Notice seeks to outline how we intend to deliver all the rights and protections and on what data subjects are entitled to. This Notice is NOT overwrite and / or takeover any respective Business Associates (mean of licensed Pawnbrokers in Malaysia).

Security of Personal Information

The security of individual information about you is our importance. We secure this information by keeping up physical, electronic, and procedural protections that meet or surpass material laws. We train our representatives in the best possible treatment of individual information. When we utilize 3rd parties to give services to us, we expect them to ensure the privacy of individual information that is transmitted to them, to relevant Business Associates and Customers (mean of licensed Pawnbroker customers that use this Services in Malaysia).

What personal data we collect and how we collect your data?

Personal data refers to any information that relates directly or indirectly to an individual, who is identified or identifiable from that information or from that and other information in the possession of Totalpay, including any sensitive personal data and expression of opinion, video recordings made through close circuit security surveillance cameras placed for security reasons and audio recordings about the individual. The types of personal data we collect may include, but is not limited to your name, address, other contact details, sex, race, nationality, phone number, email, bank account(if any), age, occupation, purpose of transaction, marital status, financial information such as your income, or income tax particulars, your identity card or passport, place of birth, credit history and your transaction history. We may also store or use images that are taken using the built in app features. Furthermore, this is include the use of Services (including date, time and other related details). Failure to provide such personal data/sensitive personal data may result in Totalpay being unable to provide you with effective and continuous products and Services. Totalpay will collect your personal data through below:

• When you subscribe one of our Services/ products or activate an account with us and/or any 3rd party services provider engaged by us.
• When you register or use at Totalpay Services.
• When you contact any of Totalpay entities/ representatives through different approaches for example, application forms, emails and letters, telephone calls and conversations you have with us. In the event that you reach us or we get in touch with you utilizing phone, we may screen or record the telephone call for quality affirmation, training and security purposes
• We may likewise acquire your own information when you take an interest in client surveys or when you agree to accept to join any of our promotion campaigns/ competitions.
• When we acquire any information and data from approved associate/external parties (for example credit reference offices, administrative and enforcement offices, recruitment organizations, business owners, Business Associates subject to respective law requirement, schools, colleges, legitimate delegates).
• We may also collect images that you take in the “Image Search” or “Take Photo” section. This image will not be used for any other purpose other than to use it as reference guide for our AI program to run it against a database of images.
• We may also collect current location information, in accordance to the permissions set by your device and settings, in order to facilitate the location map guidance in the “Contact Us” page to the shop.

Link to privacy policy of third party service providers used by the mobile app and/or website.

• Google Play Services
• IPay88

* Product/services or company names mentioned herein may also be the trademarks of their respective owners.

The purposes for collecting your personal data:

The purpose for which personal data is collected will vary and further processed depends on the nature of your relationship with us and/or our third-party service providers. Your personal data may be used for the following purposes:

• To process applications for open your account with us for any product and Services.
• To verify your financial position through a 3rd party/ approved credit agencies.
• To process your payments made under this Services.
• For verification and security purposes that related to this Services
• To manage internal record keeping and maintain your account and facility of use.
• For internal analysing purposes to study our marketing initiative effectiveness, market survey, statistical analysis and modelling, reporting, compliance, audit and risk management, avoid fraud and any other purposes relating to business’ operations.
• For direct marketing and telemarketing purposes.
• To respond to inquiries & complaints.
• For such other purposes as permitted by applicable law or with your consent.
• To monitor, analyse, evaluate and improve your usage of the Services.
• To ensure the clarity of data given is according to the customers previous or new data.
• To refer to internal programs such as the Image Search AI Engine or to location management to guide you to the shop easier.

Disclosure of your personal data:

Your personal data will be kept confidential but such personal data may be provided to third parties who carry out functions on Totalpay behalf with whom we have contractual agreements for some of our functions, services and activities for the purposes set out below:

• Providing data to approved delivery partners, (Sea/ Air/ Land freight).
• Providing data to financial services (Insurance).
• Providing data to business professional advisors and external auditor.
• Providing data to customer service providers.
• Providing data to telemarketing agencies.
• Providing data to database system providers.
• Providing data to e-Commerce providers.
• Providing data to government agencies/ statutory bodies/ authorities (if any).
• Providing data to SMS service providers.
• To any of our affiliates in and outside Malaysia who is/are connected to Totalpay.
• To any Users associate with Business Associates, Service Providers in connection and/or during any merger, sale of company assets, related Services, consolidation, restructuring, acquisition of all or part of our business by/or into another company(if any).
• Providing an image reference to run the Image Search AI Engine against to obtain results.
• Providing data to online payment gateways partners such as Ipay88 to help handle the online payment feature within the Services.

The revelation of your information may include the exchange of your own information to places outside of Malaysia, and by giving us your own information you consent to such an exchange where it is required to give you the services/ products you have asked for, and for the execution of any legally binding commitments you have with Totalpay.

We may share your information for our Protection and the Protection of Others.

We reserve the right to disclose your personally identifiable information as required by law and when we believe that disclosure is necessary to protect our rights and/or comply with a judicial proceeding, court order, or legal process served on our Services; enforce or apply this Privacy Policy, our Services Terms of Use or other agreements; or protect the rights, copyright owners, property or safety of the Services, its Users or others.

Your Rights

a) Right to request access to personal data. You are entitled to request access to your personal data that is processed by us with reasonable written email notice and we will revert within 14 working days or direct to respective Business Associates during their operating hours.

b) Right to request correction of personal data. You are entitled to request the correction of your personal data that is held by us with reasonable written email notice or direct to respective Business Associates during their operating hours. With respect to this, you may:

1. request correction and/ or update of your personal data that is inaccurate, incomplete or out-of-date; and
2. request retention of your personal data only as long as necessary for the fulfilment of the purpose stated above.

c) Right to decline/delete of personal data. You are entitled to decline the request of your personal data by NOT accept this Services PDPA and Terms & Conditions or you may contact directly with your respective Business Associates during their operating hours.

Complaints and Disputes

If you have reason to believe that we have breached the principles as laid out in this notice, we urge you to raise it with your respective Business Associates (contact etail can get within the Services).

Your Privacy Preferences and How to Contact Us:

Please remember that we will protect your personal data regardless of your privacy preferences. If: you wish to find out more information, or raise any specific or general concerns about Totalpay and this Notice, you may:

Whatsapp: 016-2163761
Email: contact@totalpay.com.my

Totalpay has the right to refuse your requests to access and/or to make any correction to your Personal Data for reasons permitted under the law, such as the expense of providing access to you is disproportionate to the risks to your privacy. This Policy is subject to changes and we reserve the right to amend, alter and/or vary this Policy from time to time. Notification of changes would be made known to you through any suitable medium of communication or through our Services. In any event of conflict between the English and Bahasa Malaysia language versions of this Policy, the English version shall prevail.