Personal Data Protection Act (PDPA)

Privacy Notice

At HIDUIT, we are committed to ensure the processing of personal data by HIDUIT is in

accordance with the Personal Data Protection Act 2010 (“PDPA”), this Privacy Notice and the
privacy terms in the agreements(s) entered between you and HIDUIT. This notice is issued
pursuant to PDPA’s requirements to all persons who enter any dealings or transactions with
HIDUIT.

Please take the time to familiarise our practices and if you require further information, please
contact our HIDUIT Careline at +603 8888 8888 or email at careline@hiduit.com

For the purposes of this Privacy Notice, please note that:

“We” or “Us” or “HIDUIT” refers to HIDUIT which is a service made available by BP Supply
Base Sdn Bhd to customers for application for personal loans.

“Personal Data” refers to any information or data relating to you directly or

indirectly and/or the transactions between you and HIDUIT. Such
information or data includes but not limited to your name, address,
occupation, contact details, the details of your account(s), the type
of products and/or services you subscribed to and such other
necessary information regarding yourself and the transaction(s)
between you and HIDUIT. For the avoidance of doubt, please note
that this Privacy Notice is applicable only if you are an individual.

1. Our Duties

1.1. In compliance with the Personal Data Protection Act 2010, it is our duty to ensure the
safety and security of your personal data which are under our care.

1.2. The collection and use of customers’ information will be limited to as may be required to
deliver superior service to our customers, which includes advising our customers about
our products, services and other opportunities, and to administer our business.

1.3. Only our authorised employees, who are trained in the proper handling of customer
information are permitted to have access to that information.

1.4. All other organisations that we hire to provide support services are required to conform
to our privacy standards.

1.5. We shall ensure that our HIDUIT employees follow strict privacy and security guidelines
and safeguards within the company to ensure that your Personal Data is secured.

2. Types of Personal Data Processed

2.1. You must be at least eighteen (18) years old. HIDUIT shall not be liable for any loss or
inconvenience to you if you are below eighteen (18) years old.

2.2. In order for us to provide you with our services, offers and products, we may require
information or Personal Data to enable us to process your applications which includes
but not limited to the following:-

a. Your name, address details, identity card number or passport details, nationality,
date of birth, age, telephone number, mobile phone number, email address and
bank account details;
 b. Your profile picture, photos or avatar, gender, ethnicity, marital status, educational
level, occupation, salary range, interests, hobbies, precise location-based
information, device ID or serial numbers, and passwords when you created an
account for our services or products, and any other information you furnish us
through the HIDUIT portal or any other platforms that may be introduced by
HIDUIT including your views or opinions or complaints made known to us via
feedback or surveys;

c. Personal Data that is obtained indirectly through other sources (if any), of which
you have consented for them to disclose your personal information or Personal
Data and/or where they are not otherwise restricted including but not limited to,
information about your interactions with HIDUIT or Bank Account linked to HIDUIT
and other merchants as well as other HIDUIT services or products that you may
have subscribed to or purchased;

d. Personal Data to establish your identity and background including your particulars,
images and biometrics;

e. digital or electronic signatures including but not limited to specimen signatures as

defined under the applicable laws and regulations;

f. information with regards to your financial standing, risk profile, and/or business
interests and assets;

g. the selected language used in HIDUIT services or products, its unique device
identifier and the location of which HIDUIT services or product are used including
postcode, area code, and the time zone;

h. information obtained through customer activities on our websites and from our
other services or products such as your activities, habits, preferences and
interests; and/or

i. other electronic data or information including but not limited to IP addresses,

cookies, activity logs, online identifiers and location data through your usage of our
services or products.

2.3. We may obtain your information and/or Personal Data from a variety of sources,
including but not limited to:

a. through transactions made between you and HIDUIT which includes information
provided by you in application forms (physical or online through HIDUIT Portal),
during registration, when you operate your account and use our services or
producs\ts, when taking part in customer surveys, competitions and promotions,
when providing feedback or making complaints;

b. through verbal and written communications between you and HIDUIT and/or our
authorised agents through any appropriate communication channels including but
not limited to SMS, phone or mobile device, email, mail, websites or browsers
and/or social media;

c. through analysis of the usage and management of your account(s) including but
not limited to the transactions, payments made and your use of our services or
products;

d. from recordings of Closed-Circuit Television (CCTV) installed at our premises;

 e. from Malaysia Department of Insolvency, other relevant government authorities
and/or law enforcement agencies in order to ascertain your current and past
financial standing;

f. from other sources that provide credit reports and/or referencing agencies,
including but not limited to CCRIS, Financial Information Services (FIS) and/or any
other bureaus or agencies established or to be established by Bank Negara
Malaysia or any of its subsidiaries, or by any other authorities and/or from any
financial institution;

g. information acquired from refund, settlement or reconciliation claims or other

documents; and/or

h. from the data collected via cookies as well as your devices’s IP address and any
other information that is supplied and/or collected from your visits to our websites
and/or from downloading our mobile device applications.

2.4. Cookies (or equivalent technologies) are used to store your preference for certain
products as well as assist us with further analysis and/or improvement of our services or
products. Cookies collect information with regards to website traffic, website or mobile
application (“app”) usage, visitors’ Internet protocol (IP) address, how visitors arrive at
the website and navigation within the website or app.

2.5. Third parties may be used to track advertisements across the website. The purpose of
this is merely for identifying the general effectiveness of such online advertising. As
such any personal information or Personal Data is not collected by these third parties.

2.6. Third-Party Sites and Services

a. Kindly be informed that our websites, applications, services or products may

contain links to third party websites, products and services. Furthermore, our
services or products may also use or offer services or products from third parties.
The information or data collected by third parties are governed by their own
privacy practices which means that our policy does not cover third party websites
that is linked through our websites. HIDUIT shall not be responsible nor liable for
the third party websites.

3. Usage of Personal Data

Purpose of Personal Data Processing:

3.1. Your Personal Data will be collected, recorded, held, stored, used, disclosed and/or
otherwise (“processed”) by us for the following purposes:

a. to assess, address, resolve, respond or fulfil your registration, orders usage,

request(s), application(s), enquires, feedback, issues, disputes or complaints for
our services or products;

b. to process refunds;

c. to verify information relating to personal particulars;

d. to enable us to perform our services, offer our new products, open, operate,
manage and maintain an account for you and/or to carry out partly or all of the
services requested by you as well as to improve the management of our business
and your relationship with us;
e. to enable us to provide comprehensive information to our customers and for better
understanding of our websites, products and services;

f. to store your preference for certain types of information or products, to further

understand and/or analyse your behaviour in order to improve our current and
future products, services, advertising needs and/or to personalize our services to
you;

g. to conduct credit checks (including but not limited to ensure our business partners
are financially sound) and to update, consolidate and improve the accuracy of our
records;

h. to market and/or to provide you with information regarding products, services,

promotions, offers and/or contest which may be of interest to you that is
administered by HIDUIT or our selected third parties, agents, affiliates, service
providers, contractors (including sub-contractors), merchants and business
partners.

i. to send out notifications regarding benefits and changes to the features of our
services or products;

j. to conduct surveys and customer research, provide customer service then assess
your interest in HIDUIT services or products;

k. to enforce and/or protect and/or defend any rights or property of HIDUIT including
other rights of our business partners, suppliers, clients, or others where there are
reasonable grounds to believe that such rights or property already have or will
potentially have an effect on HIDUIT, or to comply with any judicial proceeding,
court order, or legal process;

l. to produce anonymised or aggregated data, reports and statistics;

m. to conduct analytical researches such as information processing, management and

enhancement of data, data mining, transaction analysis and other types of
analytical researches;

n. to organise and create a system in order to maintain and manage risk related
models relating to audit, compliance and financial risks assessment;

o. for credit and repayment behaviour analysis purposes;

p. to transfer or assign our rights, interests and obligations under any agreement(s)
entered between you and HIDUIT;

q. to protect or enforce our rights regarding debt recovery;

r. to conduct checks relating to anti-money laundering and crime detection including

making necessary investigation, preventive measures and prosecution;

s. to comply with any sanction or law enforcement requirements or any obligatory

disclosure requirements;

t. for any other purpose that is required or permitted by any law, regulations,
guidelines and/or the order of any court and/or relevant regulatory authorities.
 3.2. For the usage of your personal information or Personal Data for purposes not set forth in
this Privacy Notice and in the privacy terms of the agreement(s) entered between you
and HIDUIT, HIDUIT will directly acquire your additional consent prior to such usage.

4. Disclosure Of Personal Data

4.1. For the purposes set forth in this Privacy Notice, you consent and authorise the
disclosure of your personal information or Personal Data and/or your accounts with us
to:

a. other entity related to HIDUIT such as BP Supply Base Sdn Bhd which is the
company that owns HIDUIT;

b. companies and/or persons that act as our agents, affiliates, service providers,
contractors, merchants, business partners, lawyers, and/or professional advisers
(including the employees, directors, sub-contractors, service providers, agents and
professional advisors of all the aforesaid companies and/or persons);

c. companies, banks, financial institutions and/or organisations that we have

appointed or hired to process and/or otherwise carry out transactions that you have
requested including but not limited to BP Supply Base Sdn Bhd.

d. companies and/or organisations that we appointed or hired to provide value added

services that was requested by you;

e. companies and/or organisations that we appointed and/or hired to deliver or

communicate information regarding our services or products to you;

f. any authority, central depository or depository agent in relation to the securities

industry;

g. any insolvency department and our appointed debt recovery agents;

h. any other person under a duty of confidentiality to HIDUIT and undertook to keep
such information confidential or has signed any non-disclosure agreement(s)
entered between them and HIDUIT;

i. any trustees, beneficiaries, administrators or executors;

j. your personal advisers that are appointed and/or authorised by you including but
not limited to accountants, auditors, lawyers, financial advisers or other
professional advisers;

k. any other person notified by you as authorised to give instructions or to use the
account(s) or products or services on your behalf;

l. any law enforcement, government, courts, dispute resolution bodies and regulatory
bodies including Bank Negara Malaysia and their appointed personnel or party;
and/or

m. any persons or authorities connected to the enforcement or preservation of any

rights under the agreement(s) entered between you and HIDUIT, subject at all
times to any laws applicable to HIDUIT whether in or outside Malaysia.

5. Marketing
 5.1. HIDUIT may collect, store and use your Personal Data for marketing purposes. The
Personal Data or information related to you that is in possession of HIDUIT may be
extracted, disclosed and released as mentioned in this Privacy Notice.

5.2. Moreover, you may be contacted by HIDUIT regarding products, services and offers that
may be of interest to you or would financially benefit you.

5.3. In addition, please be informed that your Personal Data (which will not include
information relating to your affairs or accounts) may be disclosed to third parties such as
merchants appointed/hired by us and strategic partners for marketing and promotional
purposes where your prior consent has been obtained and subject to any laws
applicable to HIDUIT.

5.4. If you do not wish to receive direct marketing communications from us and/or from our
merchants and strategic partners, you may inform us at any time by notifying us at the
address/telephone number/ fax number/ email address given at the end of this Privacy
Notice.

5.5. Your Personal Data will be treated as private and confidential. HIDUIT will not disclose
your Personal Data to any third party outside HIDUIT and/or their business partners
except:

a. in the event that you have given your express consent as set forth in our
application form(s) or during your application(s) and/or pursuant to your consent
and authorisation as laid out in this Privacy Notice and/or in the terms and
conditions of the products and services in which you use or that you receive from
us and/or under any agreement(s) entered between you and HIDUIT;

b. where it is required or permitted to do so by law;

c. where required or authorised by any order of court, tribunal or authority, whether

governmental or quasi-governmental so long as it has jurisdiction over HIDUIT;

d. where rights and obligations may be transferred pursuant to the agreement(s)

entered between you and HIDUIT; and/or

e. where it is required in order to meet obligations of any relevant regulatory authority

(whether in or outside Malaysia).

6. Security Of Personal Data

6.1. HIDUIT shall keep all Personal Data confidential and endeavours to implement the
appropriate administrative and security safeguards and procedures in accordance with
the applicable laws and regulations to protect your Personal Data or personal
information against loss, theft and misuse, as well as prevent unauthorised access,
disclosure, alteration and destruction. When processing your Personal Data or personal
information, regular reviews are conducted and latest technical and organisational
security measures shall be implemented.

Be rest assured that employees of HIDUIT are trained to handle the personal information
securely and with utmost care and respect.

7. Retention Of Personal Data

7.1. Your Personal Data or personal information will be retained by HIDUIT in compliance
with this Privacy Notice and/or the terms and conditions of the agreement(s) entered
between you and HIDUIT. HIDUIT will continue to retain your Personal Data or personal
 information for the duration of your relationship with us and/or for the continued use of
our services or products or for as long as your account is active, or as necessary to
perform our obligations to you or to enforce or defend the interests of HIDUIT and/or its
customers as may be deemed necessary, or as required to comply with legal or
regulatory obligations and HIDUIT’s policies in relation to data retention.

8. Incomplete Personal Data Or Failure to Provide Personal Data

8.1. It is necessary for you to provide us your Personal Data or personal information to
enable us to process your application for our services or products. We may be unable
process your application, registration, requests and complaints or provide you with our
services or products should you fail to furnish us such obligatory personal information.
You shall ensure that your personal information accurate, complete, and up to date.
Please update and immediately furnish us the revised or corrected information of your
Personal Data held by HIDUIT.

9. Rights To Access And Correct Personal Data

9.1. You have the right to access your Personal Data held by HIDUIT to ensure that the
Personal Data is accurate, complete, not misleading or up-to-date. If you wish to
exercise such rights and request access to your Personal Data, please contact us
through the following channels:

a. online via HIDUIT’s website; or

b. contacting HIDUIT Careline at +603-8888 8888; or

c. visiting the nearest HIDUIT Service Centres and/or Hubs.

9.2. Please note that HIDUIT has the discretion to withhold access to your Personal Data
in the event that we are unable to confirm your identity or where the information
requested is of a confidential commercial nature or if we have received repeated
requests for the same information. Nevertheless, you will be notified of the reason(s) if
your request has been rejected.

9.3. Please also note that HIDUIT has the discretion to allow correction requests and/or
require you to furnish further documentary evidence of the new information. It is
HIDUIT’s top priority to do the necessary to avoid fraud and inaccuracy.

9.4. If you no longer consent to the usage of your Personal Data or wish to limit the usage
of your personal data in anyway whatsoever, you may request it by contacting us at
careline@hiduit.com. However, please note that HIDUIT may not be able to proceed
with the provisions of the relevant product or services and you may not be able to use
such services or products thereafter as such Personal Data requested by HIDUIT are
mandatory for the relevant services or products.

10. Option to Disclose, Retain And Use Of Personal Data

10.1. You have the option in respect of the disclosure, retention and use of your personal
information or Personal Data subject always to our contractual rights and obligations
under relevant laws and regulations. Kindly contact us at the address/telephone
number/ email address provided at the end of this Privacy Notice should you wish to
do so.

11. Revisions To Privacy Notice

 11.1. HIDUIT may update this Privacy Notice from time to time. HIDUIT will notify you of any
changes by posting the new Privacy Notice on HIDUIT’s website and/or by such other
means of communication deemed suitable by HIDUIT. You are advised to review this
Privacy Notice periodically for any changes.

12. Contacting HIDUIT Regarding Your Personal Data

12.1. Should you have any inquiry or require further information in relation to this Privacy
Notice, kindly contact Head of Customer Resolution Unit at the following:

Telephone +60399999999
Fax +60388888888
E-Mail careline@hiduit.com
Address HIDUIT (owned by BP Supply Base Sdn Bhd)
Level 12, Tower 5, Avenue 9,Bangsar South No. 9, Jalan Kerinchi, 12345
Kuala Lumpur, Malaysia