Privacy Policy

How Jomdana collects, uses, discloses and protects personal data when you use the Application and Services.

Last updated: June 2026

1. Introduction

1.1

Welcome to Jomdana ("Application" or "App"), a Shariah-compliant financing service operated by K & B Global Sdn. Bhd. and its affiliates and subsidiaries (individually and collectively, "Jomdana", "we", "us" or "our").

Jomdana takes its responsibilities under applicable privacy laws and regulations in Malaysia, including the Personal Data Protection Act 2010 ("Privacy Laws"), seriously and is committed to respecting the privacy rights and concerns of all users of our Application. We recognize the importance of the personal data you have entrusted to us and believe that it is our responsibility to properly manage, protect and process your personal data. This Privacy Policy ("Privacy Policy" or "Policy") is designed to assist you in understanding how we collect, use, disclose and/or process the personal data you have provided to us and/or we possess about you, whether now or in the future, as well as to assist you in making an informed decision before providing us with any of your personal data. Please read this Privacy Policy carefully. If you have any questions regarding this information or our privacy practices, please see the section entitled "Questions, Concerns or Complaints? Contact Us" at the end of this Privacy Policy.

1.2

"Personal Data" or "personal data" means data, whether true or not, about an individual who can be identified from that data, or from that data and other information to which an organization has or is likely to have access. Common examples of personal data could include name, identification number and contact information. Personal data includes sensitive personal data, which includes but is not limited to your race, religious beliefs, medical condition, etc., as applicable.

1.3

By using the Services (as defined below), registering for an account with us, visiting our Application, or accessing the Services, you acknowledge and agree that you accept the practices, requirements, and/or policies outlined in this Privacy Policy, and you hereby consent to us collecting, using, disclosing and/or processing your personal data (including, for the avoidance of doubt, sensitive personal data) as described herein. IF YOU DO NOT CONSENT TO THE PROCESSING OF YOUR PERSONAL DATA AS DESCRIBED IN THIS PRIVACY POLICY, PLEASE DO NOT USE OUR SERVICES OR ACCESS OUR APPLICATION. If we change our Privacy Policy, we will post those changes or the amended Privacy Policy on our Application. We reserve the right to amend this Privacy Policy at any time. Your continued use of the Services after such changes have been posted shall constitute your acceptance of the amended Privacy Policy.

1.4

The Jomdana Application is available for download on Google Play and Apple App Store and provides Shariah-compliant financing services, including the Jomdana financing facility, to eligible users in Malaysia (collectively, the "Services").

2. When Will Jomdana Collect Personal Data?

2.1

We will/may collect personal data about you:

  • (a) when you register and/or use our Services or Application, including applying for any financing products through our Services;
  • (b) when you submit any form, including, but not limited to, financing application forms or other forms relating to any of our products and services, whether through the Application or by way of a physical form;
  • (c) when you enter into any agreement or provide other documentation or information in respect of your interactions with us, including any Shariah-compliant financing agreement (such as the Commodity Murabahah Financing Agreement), or when you use our products and services;
  • (d) when you interact with us, such as via telephone calls (which may be recorded), letters, fax, face-to-face meetings, social media platforms and emails;
  • (e) when you use our electronic services, or interact with us via our Application. This includes, without limitation, through cookies which we may deploy when you interact with our Application;
  • (f) when you carry out transactions through our Services or Application;
  • (g) when you provide us with feedback or complaints;
  • (h) when you have given permission to disclose any information to our Application;
  • (i) when your personal information is provided by you to us in connection with the Services;
  • (j) when you register to participate in any activity with us;
  • (k) when you grant the Application access to your device's camera, microphone or location services, as described in Section 4 below; or
  • (l) when you submit your personal data to us for any reason.

The above does not purport to be exhaustive and sets out some common instances of when personal data about you may be collected.

2.2

When you visit, use or interact with our Application, we may collect certain information by automated or passive means using a variety of technologies, which technologies may be downloaded to your device and may set or modify settings on your device. The information we collect may include, without limitation, your Internet Protocol (IP) address, computer/mobile device operating system and browser type, type of mobile device, the characteristics of the mobile device, the unique device identifier (UDID) or mobile equipment identifier (MEID) for your mobile device, the address of a referring website (if any), and the pages you visit on our Application and the times of visit. We may collect, use, disclose and/or process this information only for the Purposes (defined below).

3. What Personal Data Will Jomdana Collect?

3.1

The personal data that Jomdana may collect includes but is not limited to:

  • (a) full name;
  • (b) email address;
  • (c) date of birth;
  • (d) mailing and/or billing address;
  • (e) gender;
  • (f) bank account and payment information;
  • (g) contact information, including email address, telephone number, address, social media account information (if provided), and any other related information;
  • (h) government-issued identification information or any information (including but not limited to NRIC number, passport number, taxpayer identification number) which is necessary for us to provide the Services, for due diligence, including customer due diligence, know your customer, identity verification, and fraud prevention purposes;
  • (i) images of your identification documents (such as your NRIC, passport, or driver's license) captured through the Application's camera function, as further described in Section 4 below;
  • (j) sensitive personal data that you provide to us when you use our Services, including nationality and other sensitive personal data contained in cards or other documents issued by government agencies, such as your national ID card;
  • (k) employment and income information, including but not limited to payslips, bank account statements, Employee Provident Fund (EPF) statements, tax filings, and any other financial information relevant to your financing application;
  • (l) business-related documents (where applicable), including but not limited to the business registration certificate issued by the Companies Commission of Malaysia (SSM), business bank account statements, and any other documents we may reasonably require;
  • (m) financing-related information, including your financing limit, disbursement history, repayment records, and financing agreement details;
  • (n) location data, as described in Section 4.1 below;
  • (o) information sent or connected to the device used to access our Services or Application;
  • (p) communication and marketing information, such as your interest in receiving marketing information from us and others, your communication preferences and your communication history with us, our business partners, service providers and third parties;
  • (q) transaction and access information, including application details, transaction history, payment records, and other product and service information related to you;
  • (r) aggregate information about the content that users engage with; and
  • (s) biometric data, including facial images, video frames and device-related information collected through the Application's camera and the integrated liveness detection SDK, and any facial geometry (face templates) derived therefrom, which are processed only transiently during verification and are not persistently stored (see Section 4.4), for facial recognition and liveness verification, as further described in Section 4.4 below;
  • (t) any other information about you when you sign up to use our Services or Application, and when you use the Services or Application, as well as information related to how you use our Services or Application.

3.2

If you do not want us to collect the aforementioned information/personal data, you may opt out at any time by notifying us in writing about it. Further information on opting out can be found in Section 15 below entitled "How Can You Withdraw Consent, Request Access to or Correct Information You Have Provided to Us?". Note, however, that opting out of us collecting your personal data or withdrawing your consent for us to collect, use or process your personal data may affect your use of the Services. For example, opting out of the collection of location information will cause the location-based risk assessment features to be disabled, and opting out of the collection of identification document images will prevent us from completing your identity verification, which is required to provide the Services.

4. Device Permissions: Camera, Microphone and Location Access

This section explains the specific device permissions required by the Jomdana Application, why each permission is needed, and how you can control them.

4.1 Location Permission

4.1.1

Our Application may collect precise information about the location of your mobile device using technologies such as GPS, Wi-Fi, cell tower triangulation, and other location-based technologies.

4.1.2

Purpose of location data collection: We collect, use, disclose and/or process your location information exclusively for the following purposes:

  • (a) Fraud prevention and risk assessment: To verify that your financing application is submitted from a legitimate location and to detect and prevent potentially fraudulent or suspicious activities. Location data helps us identify unusual patterns, such as applications being submitted from locations inconsistent with your declared address or from high-risk jurisdictions;
  • (b) Regulatory compliance: To comply with applicable anti-money laundering and counter-terrorism financing laws and regulations that may require us to ascertain and verify the geographical context of transactions;
  • (c) Identity verification: To cross-reference your declared location information with other data points as part of our Know Your Customer (KYC) and customer due diligence processes.

4.1.3

We do NOT use your location data for:

  • Marketing or advertising purposes;
  • Tracking your movements in real time;
  • Sharing with third parties for any purpose other than fraud prevention and regulatory compliance;
  • Building behavioral profiles unrelated to risk assessment.

4.1.4

You are able to withdraw your permission for us to acquire location information through your device settings at any time. However, please note that disabling location services may affect our ability to complete your identity verification and fraud assessment, which are essential to providing the Services.

4.2 Camera Permission

4.2.1

Our Application may request access to your mobile device's camera.

4.2.2

Purpose of camera access: We request camera access exclusively for the following purpose:

  • (a) Capturing images of your identification documents: To allow you to take photographs of your government-issued identification documents (such as your NRIC, passport, or driver's license) directly within the Application for the purpose of identity verification, Know Your Customer (KYC) compliance, and fraud prevention.
  • (b) Facial recognition and liveness verification: To capture your facial images through the camera in real time to verify that the person applying for financing is a real, live person and matches the identity document you provided, as part of our Know Your Customer (KYC), customer due diligence and fraud prevention processes. Facial liveness verification is performed through an integrated liveness detection software development kit (SDK) on your device, as further described in Section 4.4.

4.2.3

We do NOT use your camera for:

  • Recording videos;
  • Taking photographs or recording video for any purpose other than capturing your identification documents or performing facial recognition and liveness verification;
  • Live streaming or any other purpose not expressly stated herein;
  • Any form of surveillance or background monitoring.

4.2.4

The images of your identification documents are encrypted and transmitted securely to our servers. They are used solely for identity verification purposes and are retained only for as long as necessary in accordance with applicable laws and our data retention policy (see Section 9 below).

4.2.5

You may withdraw camera access permission at any time through your device settings. However, please note that without camera access, you will not be able to capture and submit images of your identification documents through the Application, which may prevent us from completing your identity verification and providing the Services to you.

4.3 Microphone Permission

4.3.1

Our Application may request access to your mobile device's microphone for the purpose of facial recognition liveness verification, as part of our identity verification and fraud prevention processes.

4.3.2

Purpose of microphone access: We request microphone access exclusively for the following purpose:

  • (a) Liveness verification during facial recognition: To capture a short audio sample of your spoken response to a random on-screen prompt, in order to confirm that the person undergoing facial recognition is a real, live person physically present at the time of verification. The audio is processed for liveness checking purposes only and is not used for voice identification, recording, or any other purpose.

4.3.3

We do NOT use your microphone for:

  • Any purpose unrelated to liveness verification during facial recognition;
  • Voice assistant activation or any other background audio capture;
  • Recording phone calls, conversations, or any audio other than the short spoken response used for liveness verification;

4.3.4

You may withdraw microphone access permission at any time through your device settings. However, please note that without microphone access, we may not be able to complete the facial recognition liveness verification, which is required to provide the Services.

4.4 Biometric (Face) Data

4.4.1

What face data we collect. As part of identity verification, the Application uses an integrated liveness detection software development kit ("Liveness SDK") to perform facial liveness verification on your device. During the verification process, the Liveness SDK may collect facial images, video frames, and device-related information necessary for liveness detection and security risk analysis. After the liveness detection process is completed, the collected data is encrypted and securely transmitted via HTTPS to the liveness verification server for further processing and verification.

4.4.2

How we use face data. The collected facial data is used solely for identity verification purposes, including: (a) Liveness detection: to verify that you are a real person who is physically present during the verification process, rather than a spoofing attempt using photos, videos, or other presentation attacks; and (b) Face comparison: when applicable, the best-quality facial image captured during the liveness process may be compared with the facial image extracted from your identity document for identity verification purposes. The facial data is not used for any other purposes, including advertising, profiling, analytics, or unrelated services. The facial data is not used as a biometric credential for account login or ongoing authentication.

4.4.3

Disclosure and sharing of face data. The only recipient of your face data is our identity-verification service provider that operates the liveness verification server (the "Liveness Service Provider"), engaged solely to perform the verification described above. Your face data is not sold, rented, or transferred to advertisers, analytics providers, data brokers, or any other third party, and is not used by the Liveness Service Provider for any independent purpose. The Liveness Service Provider is contractually bound to process your face data only within the limited scope of performing identity verification for us, and to apply data-protection and security measures that provide the same or equal protection of your face data as described in this Privacy Policy, including compliance with ISO/IEC 27001 and ISO/IEC 27701. For the avoidance of doubt, biometric face data is not shared with Masyref or any other business partner, advertiser, or third party for any independent purpose.

4.4.4

Storage, location and retention of face data. The collected biometric data is processed temporarily in volatile memory during the verification process. After the verification is completed, the biometric data is immediately deleted and is not retained or stored in any persistent storage system. During processing, the encrypted data is transmitted securely via HTTPS and temporarily processed on the liveness verification server; the processing environment is located in Singapore. Facial biometric data is only temporarily stored in volatile memory for processing purposes and is deleted immediately after the verification process is completed. No persistent storage of facial images or video data is maintained. Biometric face data is expressly excluded from the "Retained Records" described in Section 15.3.4.

4.4.5

Your rights: revoking consent and deleting face data. Because face data is not persistently stored (it is deleted immediately after each verification, as described in Section 4.4.4), there is no retained face data for us to delete after verification is complete. You may, however, revoke your consent to the collection and use of face data, or request confirmation that no face data relating to you is retained, at any time by contacting us at cs@jomdana.my (attention: Data Protection Officer). Please note that face-data collection is required to complete identity verification, which is mandatory to provide the financing Services; withdrawing consent may therefore mean we are unable to open or continue your account or provide the Services. On a verified request, we will confirm the absence of retained face data or, where any face data happens to be held, delete it within 30 days and notify you.

5. Viewing Web Pages

As with most platforms, your computer/mobile device sends information which may include personal data about you that gets logged by a web server when you browse our Application. This typically includes, without limitation, your computer's IP address, operating system, browser name/version, the referring web page, requested page, date/time, and sometimes a "cookie" (which can be disabled using your browser preferences) to help the Application remember your last visit. If you are logged in, this information is associated with your personal account. The information is also included in anonymous statistics to allow us to understand how visitors use our Application.

6. Cookies

6.1

We may from time to time implement "cookies" or other features to allow us or third parties to collect or share information that will help us improve our Application and the Services we offer, or help us offer new services and features. "Cookies" are identifiers we transfer to your computer or mobile device that allow us to recognize your computer or device and tell us how and when the Services or Application are used or visited, by how many people and to track movements within our Application. We may link cookie information to personal data.

6.2

You may refuse the use of cookies by selecting the appropriate settings on your browser or device. However, please note that if you do this you may not be able to use the full functionality of our Application or the Services.

7. Community & Support

We provide customer service support through email, in-app messaging, and feedback forms. In order to provide customer support, we will ask for your email address, mobile phone number, and such other information as may be necessary to address your enquiry. We only use information received from customer support requests, including, without limitation, email addresses, for customer support services and we do not transfer to or share this information with any third parties except as necessary to resolve your enquiry.

8. How Do We Use the Information You Provide Us?

8.1

We may collect, use, disclose and/or process your personal data for one or more of the following purposes:

  • (a) to consider and/or process your financing applications with us for products and/or services, or your transactions or communications with business partners or third parties through our Services;
  • (b) to manage, operate, provide and/or administer your use of and/or access to our Services and our Application;
  • (c) to manage, operate, administer and provide you with as well as to facilitate the provision of our Services, including, without limitation, remembering your preferences;
  • (d) to assess your eligibility for our Shariah-compliant financing products, including evaluating your creditworthiness, repayment capacity, and risk profile;
  • (e) to execute and administer your Commodity Murabahah Financing Agreement and any other financing-related agreements;
  • (f) to enforce our Terms of Service or any applicable end user license agreements;
  • (g) to protect personal safety and the rights, property or safety of others;
  • (h) for identification and/or verification or due diligence, including Customer Due Diligence, Know Your Customer (KYC), and anti-money laundering checks;
  • (i) for fraud detection and prevention, including the use of location data as described in Section 4.1 above;
  • (j) to maintain and administer any software updates and/or other updates and support that may be required from time to time to ensure the smooth running of our Services;
  • (k) to deal with or facilitate customer service, carry out your instructions, deal with or respond to any enquiries given by (or purported to be given by) you or on your behalf;
  • (l) to contact you or communicate with you via voice call, text message and/or fax message, email and/or postal mail or otherwise for the purposes of administering and/or managing your relationship with us or your use of our Services;
  • (m) to conduct research, analysis and development activities (including, but not limited to, data analytics, surveys, product and service development and/or profiling), to analyse how you use our Services, to improve our Services or products and/or to enhance your customer experience;
  • (n) to allow for audits and surveys to, among other things, validate the size and composition of our target audience, and understand their experience with Jomdana's Services;
  • (o) where you give us your prior consent, for marketing and in this regard, to send you marketing and promotional information and materials relating to products and/or services that Jomdana (and/or its affiliates or related corporations) may be selling, marketing or promoting;
  • (p) to respond to legal processes or to comply with or as required by any applicable law, governmental or regulatory requirements of any relevant jurisdiction;
  • (q) to produce statistics and research for internal and statutory reporting and/or record-keeping requirements;
  • (r) to comply with the rules and regulatory policies of Bank Negara Malaysia and/or any other relevant regulatory bodies;
  • (s) to carry out due diligence or other screening activities (including, without limitation, background checks, credit checks, and CCRIS checks) in accordance with legal or regulatory obligations or our risk management procedures;
  • (t) to audit our Services or Jomdana's business;
  • (u) to share your data with third parties for the fulfilment of your financing transaction or for collections purposes;
  • (v) to prevent or investigate any actual or suspected violations of our Terms of Service, fraud, unlawful activity, omission or misconduct;
  • (w) to store, host, back up (whether for disaster recovery or otherwise) of your personal data on servers located within Malaysia, with remote access by authorized personnel located outside of Malaysia as described in Section 11 below;
  • (x) to deal with and/or facilitate a business asset transaction or a potential business asset transaction; and/or
  • (y) any other purposes which we notify you of at the time of obtaining your consent.

(collectively, the "Purposes").

8.2

You acknowledge, consent and agree that Jomdana may access, preserve and disclose your Account information and content if required to do so by law or pursuant to an order of a court or by any governmental or regulatory authority having jurisdiction over Jomdana or in a good faith belief that such access preservation or disclosure is reasonably necessary to: (i) comply with legal process; (ii) comply with a request from any governmental or regulatory authority having jurisdiction over Jomdana; (iii) enforce the Jomdana Terms of Service or this Privacy Policy; (iv) respond to any threatened or actual claims asserted against Jomdana or other claim that any content violates the rights of third parties; (v) respond to your requests for customer service; or (vi) protect the rights, property or personal safety of Jomdana, its users and/or the public.

8.3

As the purposes for which we will/may collect, use, disclose or process your personal data depend on the circumstances at hand, such purpose may not appear above. However, we will notify you of such other purpose at the time of obtaining your consent, unless processing of the applicable data without your consent is permitted by the Privacy Laws.

9. How Does Jomdana Protect and Retain Customer Information?

9.1

We implement a variety of security measures and strive to ensure the security of your personal data on our systems. User personal data is contained behind secured networks and is only accessible by a limited number of employees who have special access rights to such systems. We employ industry-standard encryption protocols to protect your personal data in transit and at rest. However, there can inevitably be no guarantee of absolute security.

9.2

We will retain personal data in accordance with the Privacy Laws and/or other applicable laws. That is, we will destroy or anonymize your personal data as soon as it is reasonable to assume that (i) the purpose for which that personal data was collected is no longer being served by the retention of such personal data; and (ii) retention is no longer necessary for any legal or business purposes. If you cease using the Application, or your permission to use the Application and/or the Services is terminated or withdrawn, we may continue storing, using and/or disclosing your personal data in accordance with this Privacy Policy and our obligations under the Privacy Laws. Subject to applicable law, we may securely dispose of your personal data without prior notice to you.

10. Does Jomdana Disclose the Information It Collects to Outside Parties?

10.1

In conducting our business, we will/may need to disclose your personal data to our third party service providers, agents and/or our affiliates or related corporations, and/or other third parties, for one or more of the above-stated Purposes. Such third parties include, without limitation:

  • (a) our subsidiaries, affiliates and related corporations;
  • (b) contractors, agents, service providers and other third parties we use to support our business. These include but are not limited to those which provide administrative or other services to us such as mailing houses, telecommunication companies, information technology companies and data centres, all located within Malaysia;
  • (c) credit reporting agencies, including but not limited to the Central Credit Reference Information System (CCRIS) operated by Bank Negara Malaysia, and other credit rating agencies, for the purpose of conducting credit checks, assessing your creditworthiness, and fulfilling our regulatory reporting obligations;
  • (d) a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution or other sale or transfer of some or all of Jomdana's assets;
  • (e) third parties to whom disclosure by us is for one or more of the Purposes and such third parties would in turn be collecting and processing your personal data for one or more of the Purposes;
  • (f) government or regulatory authorities, including but not limited to Bank Negara Malaysia, the Companies Commission of Malaysia (SSM), the Royal Malaysia Police, the Malaysian Anti-Corruption Commission, and any other authority having jurisdiction over Jomdana or its operations, as required by applicable law; and
  • (g) our business partners, including Masyref, for the purpose of facilitating and administering your financing arrangement and ensuring Shariah compliance of our products and operations. For the avoidance of doubt, this sub-section does not apply to biometric face data collected for liveness verification, which is governed exclusively by Section 4.4.

10.2

This may require, among other things, sharing statistical and demographic information about our Users and their use of the Services with suppliers of advertisements and programming.

10.3

For the avoidance of doubt, in the event that Privacy Laws or other applicable laws permit an organization such as us to collect, use or disclose your personal data without your consent, such permission granted by the laws shall continue to apply.

10.4

Third parties may unlawfully intercept or access personal data transmitted to or contained on the Application, technologies may malfunction or not work as anticipated, or someone might access, abuse or misuse information through no fault of ours. We will nevertheless deploy reasonable security arrangements to protect your personal data as required by the Privacy Laws; however, there can inevitably be no guarantee of absolute security.

11. Will Jomdana Transfer Your Information Overseas?

Your personal data is stored and processed on servers located within Malaysia. We do not transfer or store your personal data to servers located outside of Malaysia, except as expressly described in Section 4.4: the ephemeral facial data collected during liveness verification is temporarily transmitted to and processed on the Liveness Service Provider's verification server located in Singapore, where it is deleted immediately after the verification result is returned and is not retained. Such cross-border processing is performed under a contract requiring the Liveness Service Provider to provide the same or equal protection of your face data as described in this Privacy Policy.

However, please be aware that some of Jomdana's authorized employees and personnel may be located overseas, outside of Malaysia, and may access your personal data through controlled remote access for the purposes of operating, maintaining, and providing customer support and technical services for the Services, as well as for the other Purposes described in this Policy. All such remote access is subject to strict technical and organizational security measures, including encrypted transmission, least-privilege access controls, access audit logging, and binding confidentiality obligations, and is conducted only to the extent necessary for the stated Purposes.

Jomdana ensures that such cross-border access complies with the requirements of the Privacy Laws, and that authorized personnel located overseas are bound by contractual obligations to provide a level of protection to your personal data that is no lower than that required under the Privacy Laws of Malaysia. We remain fully responsible for the personal data that is accessed remotely from overseas. Biometric face data is not retained by us (see Section 4.4); the only cross-border handling of such data is the ephemeral Singapore processing described in Section 4.4, which is deleted immediately and is not subject to the ongoing remote access described in this Section.

12. Information on Children

The Services are not intended for children under the age of 18. We do not knowingly collect or maintain any personal data or non-personly-identifiable information from anyone under the age of 18 nor is any part of our Application or other Services directed to children under the age of 18. As a parent or a legal guardian, please do not allow such children under your care to submit personal data to Jomdana. In the event that personal data of a child under the age of 18 in your care is disclosed to Jomdana, you hereby consent to the processing of the child's personal data and accept and agree to be bound by this Policy on behalf of such child. We will close any accounts used exclusively by such children and will remove and/or delete any personal data we believe was submitted without parental consent by any child under the age of 18.

13. Information Collected by Third Parties

13.1

Our Application may use analytics services that store and process data on servers located within Malaysia. These services use cookies or similar technologies to help us analyse how users use the Application. The information generated (including your IP address) is stored and processed exclusively on servers located within Malaysia and is not transferred outside of Malaysia. The analytics service provider will use this information for the purpose of evaluating your use of the Application, compiling reports on Application activity for us, and providing other services relating to Application activity and Internet usage.

13.2

We, and third parties, may from time to time make software application downloads available for your use on or through the Services. These applications may separately access, and allow a third party to view, your identifiable information. Third party products or services provided through these applications are not owned or controlled by Jomdana. You are encouraged to read the terms and other policies published by such third parties on their websites or otherwise.

14. Disclaimer Regarding Security and Third Party Sites

14.1

WE DO NOT GUARANTEE THE SECURITY OF PERSONAL DATA AND/OR OTHER INFORMATION THAT YOU PROVIDE ON THIRD PARTY SITES. We do implement a variety of security measures to maintain the safety of your personal data that is in our possession or under our control. Your personal data is contained behind secured networks and is only accessible by a limited number of persons who have special access rights to such systems, and are required to keep the personal data confidential.

14.2

In an attempt to provide you with increased value, we may choose various third party websites to link to, and frame within, the Application. These linked sites have separate and independent privacy policies as well as security arrangements. We have no control over these linked sites, each of which has separate privacy and data collection practices independent of us.

14.3

We therefore have no responsibility or liability for the content, security arrangements (or lack thereof) and activities of these linked sites. These linked sites are only for your convenience and you therefore access them at your own risk.

15. How Can You Withdraw Consent, Request Access to or Correct Information?

15.1 Withdrawing Consent

15.1.1

To modify your email subscriptions, please let us know by sending an email to us at the address listed below in Section 16.

15.1.2

You may withdraw your consent for the collection, use and/or disclosure of your personal data in our possession or under our control by sending an email to us at the email address listed below in Section 16, and we will process such requests in accordance with this Privacy Policy and our obligations under the Privacy Laws and other applicable laws.

15.1.3

Once we have your clear withdrawal instructions and verified your identity, we will process your request for withdrawal of consent, and will thereafter not collect, use and/or disclose your personal data in the manner stated in your request.

15.1.4

However, your withdrawal of consent could result in certain legal consequences arising from such withdrawal. In this regard, depending on the extent of your withdrawal of consent, it may mean that we will not be able to continue providing the Services to you, and we may need to terminate your existing relationship and/or the contract you have with us.

15.2 Requesting Access and/or Correction of Personal Data

15.2.1

If you have an account with us, you may personally access and/or correct your personal data currently in our possession or control through the Account Settings page on the Application. If you do not have an account with us, you may request to access and/or correct your personal data by submitting a written request to us via the email address listed below in Section 16.

15.2.2

For a request to access personal data, once we have sufficient information from you to deal with the request, we will seek to provide you with the relevant personal data within 21 days.

15.2.3

For a request to correct personal data, once we have sufficient information from you to deal with the request, we will: (a) correct your personal data within 21 days; and (b) send the corrected personal data to every other organization to which the personal data was disclosed by us within a year before the date the correction was made.

15.2.4

Notwithstanding sub-paragraph (b) immediately above, we may, if you so request, send the corrected personal data only to specific organizations.

15.2.5

We will/may also be charging you a reasonable fee for the handling and processing of your requests to access your personal data.

15.2.6

We reserve the right to refuse to correct your personal data in accordance with the provisions as set out in Privacy Laws.

15.3 Account Deletion

15.3.1

You may delete your JomDana account at any time through the in-app "Delete Account" function, available under Profile → Settings → Delete Account within the Application.

15.3.2

You may also request deletion of your account by sending an email to cs@jomdana.my with your deletion request. You do not need to access the Application to submit this request; please include the email address or mobile number associated with your account so that we can verify your identity before processing the deletion.

15.3.3

Before your account is deleted, we will verify your identity to confirm that the deletion request is made by you. Deletion takes effect after successful verification.

15.3.4

Upon deletion of your account, we will delete or anonymize your personal data that is no longer required to be retained. However, we will retain certain records as required by applicable laws and regulations — including the requirements of Bank Negara Malaysia and the Personal Data Protection Act 2010 — such as financing agreements, disbursement and repayment records, and transaction histories (collectively, "Retained Records"). Retained Records are stored securely for the period required by law and are thereafter securely disposed of. Retained Records will not be used for any purpose other than legal compliance and the resolution of disputes. Biometric face data collected for liveness verification is expressly excluded from the Retained Records and is deleted in accordance with Section 4.4.4.

15.3.5

Deletion of your account will terminate your access to the Services. Deletion is irreversible.

16. Questions, Concerns or Complaints? Contact Us

16.1

If you have any questions or concerns about our privacy practices or your dealings with the Services, please do not hesitate to contact us.

16.2

If you have any complaint or grievance regarding how we are handling your personal data or about how we are complying with Privacy Laws, we welcome you to contact us with your complaint or grievance.

Please contact us through:

Email: cs@jomdana.my

Please send all legal notices to the above email address, with attention to the "Data Protection Officer".

16.3

Where it is an email or a letter through which you are submitting a complaint, your indication at the subject header that it is a Privacy Law complaint would assist us in attending to your complaint speedily. For example, you could insert the subject header as "Privacy Complaint".

We will certainly strive to deal with any complaint or grievance that you may have fairly and as soon as possible.

17. Terms and Conditions

Please also read all applicable terms and conditions establishing the use, disclaimers, and limitations of liability governing the use of the Application and the Services and other related policies.