Personal Data Protection Policy

Well Chip Data Protection Policy (“Policy”) – October 2018

Well Chip comprises the entities set out in Annex A (collectively “Well Chip”, “Group”, “we”, “us”, “our” or similar expression).  We are committed to complying with our obligations under the Personal Data Protection Act 2012 (“PDPA”).  Your privacy is important and this Policy demonstrates our commitment to protecting your personal data.

Introduction

This Personal Data Protection Policy explains how we collect, use, disclose, and manage your personal data in compliance with the Personal Data Protection Act (PDPA).

Collection of Personal Data

1. What is Personal Data?

   Personal Data refers to any information that can directly or indirectly identify you. This includes details like your name, address, contact number, identification or passport number, date of birth, email, and other personal information. It may also include sensitive data such as your health status or religious beliefs, as defined under the Personal Data Protection Act (PDPA).

2. How We Collect Personal Data

   We may collect your personal data through various methods, such as:

   • Forms or documents you submit to us.
   • Interactions with our website, mobile apps, or social media platforms.
   • Communication with our customer service team via phone, email, or in-person visits.
   • Participation in events, promotions, surveys, or contests organized by us.
   • Payment transactions or funding-related processes.
   • Information provided by third parties like public agencies, credit bureaus, or employers.
   • Images or audio recordings captured by CCTV or during phone calls made to our service lines.
   • Sharing your location through our apps or using GPS in vehicles we lease or finance.

3. Use of Cookies

   We may use cookies on our website to enhance your experience. Cookies are small text files stored on your computer that help us remember your preferences and monitor website usage. You can choose to disable cookies in your browser settings, but doing so might limit some functionalities of our website.

4. Third-Party Data

   If you provide personal data about someone else (e.g., a family member or employee), please ensure that you have their consent and that the information is accurate.

5. Data from Other Sources

   In some cases, we may receive your personal data from external sources such as regulatory authorities, credit agencies, or public databases. This data helps us comply with legal requirements or improve our services.

Purpose of Acquiring and Processing Your Personal Data

1. Why We Use Your Personal Data

   We collect and process your personal data to support our operations, services, and legal obligations. These include, but are not limited to:

   • Providing services such as pawnbroking, moneylending, retail, vehicle financing, and bullion trading.
   • Verifying your identity and performing due diligence.
   • Managing transactions, accounts, and relationships.
   • Conducting credit checks, assessments, and fraud prevention.
   • Responding to your queries, feedback, or complaints.
   • Contacting your representatives, agents, or next-of-kin when necessary.
   • Ensuring the safety and security of our premises and operations.
   • Conducting research, analysis, and surveys to improve our products and services.
   • Archiving, storing, or backing up data within or outside the country.
   • Complying with legal and regulatory requirements.
   • Disclosing information to authorized parties, such as banks, courts, regulatory bodies, or credit bureaus.
   • Protecting and enforcing our legal rights.

2. Employment-Related Purposes

   If you are applying for a job or are an employee, we process your data for purposes such as:

   • Conducting interviews and background checks.
   • Managing employment, including salary, benefits, training, and performance reviews.
   • Organizing company events and managing HR operations.

3. For Vendors and External Providers

   If you are a vendor or service provider, we process your data to:

   • Assess your suitability as a partner.
   • Manage contracts, payments, and records.
   • Ensure compliance with regulations and security requirements.

Disclosure of Your Personal Data

1. Purpose-Driven Disclosure

   The handling of your personal data is tailored to specific circumstances. If a purpose is not outlined in this policy, we will inform you when obtaining your consent, unless the law or PDPA permits processing without consent.

2. Third-Party Data

   If you provide personal data about another person (e.g., family member or representative), you are responsible for informing them and securing their consent for us to handle their data.

3. For Job Applicants

   If you provide personal data for employment purposes, we may use it to:

   • Arrange and conduct interviews.
   • Verify qualifications and perform background checks.
   • Assess suitability for the position.
   • Facilitate workforce planning and human resource management.
   • Comply with legal, regulatory, and governance requirements.

4. For Current Employees

   If you are a current employee, your personal data may be processed to:

   • Manage employment matters, including salary, benefits, and reimbursements.
   • Evaluate performance and provide training.
   • Organize company events and activities.
   • Facilitate audits and accreditation.
   • Ensure compliance with legal and regulatory obligations.

5. For Vendors and External Providers

   If you are a vendor or external service provider, your personal data may be used to:

   • Assess your organization’s suitability as a partner.
   • Process and manage contracts, payments, and records.
   • Facilitate security clearances.
   • Comply with legal, regulatory, and governance requirements.

We handle and disclose your personal data responsibly, ensuring it is used only for relevant purposes and in compliance with applicable laws.

Consequences of Not Consenting to This Policy

The collection of your personal data may be either mandatory or voluntary, depending on the purpose for which it is collected. If providing your personal data is required and you fail or choose not to provide it, or if you do not consent to this policy:

• We may not be able to deliver the products or services you have requested.
• We may be unable to proceed with transactions or fulfill our contractual or legal obligations.
• Our ability to engage with you or provide support may be impacted.

Your consent is essential for us to ensure seamless and compliant service delivery.

Security of Your Personal Data

1. Our Commitment

   We are dedicated to protecting your personal data and preventing unauthorized access, disclosure, loss, or damage. To do this, we implement robust technical, physical, electronic, and procedural security measures that comply with applicable laws and industry standards.

2. Continuous Improvement

   We regularly review and update our security practices to adapt to emerging threats and ensure that authorized third parties use your personal data strictly for the purposes outlined in this policy.

3. Internet Communication Risks

   While we take precautions to secure online communications, such as encryption where possible, please note that the internet is not inherently secure. Emails and other communications may pass through multiple countries and are subject to risks of interception.

4. Limitations of Control

   We are not responsible for unauthorized access, interception, or loss of data that occurs beyond our reasonable control.

5. Confidentiality Obligations

   All employees, contractors, and third-party service providers with access to your personal data are required to respect its confidentiality and use it responsibly.

Retention of Your Personal Data

1. Retention Period

   We retain your personal data only for as long as it is needed to fulfill the purposes for which it was collected or to comply with legal, regulatory, tax, or accounting requirements.

2. Secure Disposal

   Once your personal data is no longer needed, we will securely destroy or anonymize it in accordance with our retention policy.

3. Compliance with Laws

   Our data retention practices comply with applicable laws and regulations to ensure that your personal data is managed responsibly and securely.

Data Integrity

1. Our Commitment

   We are committed to ensuring that all personal data is accurate, complete, up-to-date, and reliable. The accuracy of your data largely depends on the information you provide to us.

2. Your Responsibility

   Please ensure that the personal data you submit is complete, accurate, and true. Accurate data helps us:

   • Provide you with the correct products or services.
   • Deliver the requested products or services promptly.
   • Avoid unnecessary delays.
   • Contact your representatives, next-of-kin, or intermediaries efficiently.

Maintaining accurate and reliable data benefits both you and us in ensuring seamless service delivery.

Your Rights

1. Access and Update Your Personal Data

   You have the right to:

   • Request access to or a copy of your personal data held by us.
   • Request corrections or updates to ensure your data is accurate and current.

   To process your request, we may require proof of your identity and charge a reasonable fee to cover the administrative costs involved.

2. Refusal of Requests

   In some cases, we may decline your request to access or correct your data, as permitted by law. Examples include situations where:

   • Granting access poses a risk to the privacy of others.
   • The cost of providing access is disproportionate to the benefits.

3. Limit Processing of Your Data

   You can request us to limit the use of your personal data, such as stopping marketing communications or promotional activities.

4. Withdraw Consent

   You can withdraw your consent for the processing of your personal data at any time by providing written notice. However:

   • Legal or contractual obligations may restrict immediate withdrawal.
   • Withdrawing consent could impact our ability to provide certain services.

   We will not be liable for any consequences arising from the withdrawal of your consent, including the inability to deliver services or products.

Contact and Policy Updates

Contact

If you have any questions or requests regarding your personal data, please contact our Data Protection Officer (DPO). The DPO is responsible for ensuring compliance with this policy and addressing your concerns.

Policy Updates

This policy may be updated periodically.

• Changes will be posted on our website.
• Significant updates will be communicated directly where applicable.We encourage you to review this policy regularly to stay informed of any changes.

---

Annex A: Well Chip Entities

Pawn Outlets

• Kedai Pajak Well Chip Sdn Bhd, Pandan
• Kedai Pajak Well Chip Sdn Bhd, Taman Daya
• Kedai Pajak Well Chip Sdn Bhd, Senai
• Pajak Gadai Bintang Sdn Bhd, Perling
• Pajak Gadai Berlian Sdn Bhd, Seri Orkid
• Pajak Gadai Shinegold Sdn Bhd, Taman Universiti
• Pajak Gadai Grand Chip Sdn Bhd, Johor Jaya
• Pajak Gadai Fajar Tebrau Sdn Bhd, Desa Tebrau
• Pajak Gadai Mutiara Pesona Sdn Bhd, Masai
• Pajak Gadai Cahaya Damai Sdn Bhd, Puteri Wangsa
• Pajak Gadai Jubli Intan Sdn Bhd, Kluang
• Rubi Kristal Sdn Bhd, Batu Pahat
• Thye Shing Pawnshop Sdn Bhd, Batu Pahat
• Thye Shing Pawnshop Sdn Bhd, Gelang Patah
• Pajak Gadai Bintang Sdn Bhd, Larkin
• Pajak Gadai Delima Sdn Bhd, Setia Indah
• Pajak Gadai Nilam Sdn Bhd, Kulai
• Pajak Gadai Well Chip (1) Sdn Bhd, Ulu Tiram
• Well Chip (2) Sdn Bhd, Nusajaya
• Well Chip (3) Sdn Bhd, Pasir Gudang
• Pajak Gadai Well Chip (4) Sdn Bhd, Nusa Damai
• Pajak Gadai Well Chip (6) Sdn Bhd, Skudai Baru

Retail Outlets

• Kedai Emas Well Chip Sdn Bhd, Pandan
• Kedai Emas Well Chip Sdn Bhd, Taman Universiti
• Kedai Emas Well Chip Sdn Bhd, Gelang Patah
• Kedai Emas Well Chip Sdn Bhd, Larkin

This list includes all other subsidiaries and associated or related companies of Well Chip.