Moby Malaysia Privacy Policy

Privacy and Policy

The documents below describe the personal information we collect, what we do with it, how we use it, who we disclose it to, and certain information privacy rights you may have.

Updated as of January 24, 2024

Moby Money Sdn. Bhd. Company No. 201901032761 (1342091-H), Together with its parent company, subsidiaries and affiliates (“Moby Money”, “us”, “we” or “our”), is the owner and operator of MOBY, the MOBY website (including any subdomain thereof) (“Website”), the related mobile application (“Apps”), and related databases and supporting software which you may access in the course of engaging with us (collectively, the “Platforms”). References to “Moby Money” throughout this Privacy Policy refer to the same entity described above.

We place significant emphasis on your needs, particularly in providing affordable payment plans and a seamless online shopping experience. To do this, we may collect various types of personal data associated with you, or that can be used to identify you (“Personal Data”), to tailor our Services to better meet your requirements. We understand you may have legitimate concerns about how your Personal Data is used and processed, and we want to assure you that safeguarding its privacy and security is of the utmost importance to us.

Section I of this Privacy Policy explains how we collect, disclose, use and process your Personal Data, and how we protect its security and privacy, in accordance with the Personal Data Protection Act 2010 and any other applicable data protection laws and regulations (“Applicable Data Protection Laws”). Section II explains your data privacy rights and how you can exercise control over your Personal Data.

This Privacy Policy applies automatically once you use our Platforms and Services. Your consent to the processing and disclosure of your Personal Data is obtained when you tick to accept our Terms of Service and this Privacy Policy, or when you create a MOBY account. We encourage you to read this Privacy Policy carefully before using our Platforms, products and Services.

Section I: Processing of Personal Data

A. What Is Personal Data?

For your understanding, we have grouped the categories of Personal Data we may collect as follows:

Identity information

Name, date of birth, age, gender, identification or passport number, identification documents such as identification card, passport or driving licence, social media handle, and proof of address such as utility bills and other documents capable of corroborating your identity.

Contact information

Residential, shipping and billing address, email address, phone number, and proof of address such as utility bills.

Purchase information

Bank account number, credit or debit card number, shopping and wishlist items, purchase history, browsing behaviour, product reviews, and purchase behaviour such as frequency, time and type of purchase.

Credit profile

Payment behaviour, default in payment, outstanding amount, income amount, proof of income (e.g. bank statements, income statements), credit information from credit reports (outstanding payments, number of loans, credit score), and employment documents such as your latest EPF statement, latest pay slip or business card.

Sensitive and biometric information

This category includes data relating to your health, religious or political views or other similar beliefs, as well as biometric identifiers such as fingerprints, facial images and voice recordings. Due to the nature of our products and Services, we do not typically need this category of Personal Data. Where its collection and processing becomes reasonably necessary to provide our Services, we will obtain your explicit consent before collecting, using, disclosing or otherwise processing it, and we will limit its use strictly to the purpose for which consent was given.

Other information

IP address, server logs, login and logout details, device information, geographical location, marketing and communication preferences and history, and other information you voluntarily provide, such as feedback and recommendations.

B. How and When Do We Collect Your Personal Data?

We may collect your Personal Data in the course of providing our Services or in the course of a transaction or engagement with you, including:

Your use of our Platforms, i.e. when you browse the Website and Apps and when you accept cookies on your device (see Section I.H – Cookies and Similar Technologies, below, for full details).

Your interaction with us on social media (e.g. Facebook, LinkedIn, Instagram, X/Twitter) by liking, commenting, sharing our posts, or messaging us directly.

Your direct engagement with us, e.g. via customer support, live chat, telephone, email, in-person meetings, events, roadshows, questionnaires, surveys or promotions.

From publicly available sites or directories.

From official sources in the financial services industry, e.g. bureaus or agencies under Bank Negara Malaysia, the Securities Commission, or other regulatory authorities, or the Association of Islamic Banks Malaysia.

From third-party affiliates, e.g. when you use our Services via affiliate online merchants, partnering businesses, financial institutions, or third-party credit service providers such as debt collection agencies.

From registered Credit Reporting Agencies or credit background verification providers, when we perform a credit risk assessment to determine your eligibility for our Services.

Your voluntary submission of Personal Data to us for any reason.

C. Why Do We Collect Your Personal Data, and to Whom May We Disclose It?

To provide our products and Services effectively, we collect and, where necessary, disclose your Personal Data to certain third parties for the purposes summarised in the table below (each, a “Purpose”).

Purpose	Recipients of Personal Data	Personal Data Most Likely Disclosed
• To verify your identity and prevent identity theft • To perform Know Your Customer (KYC) checks • To create and administer your online account • To respond to enquiries, complaints and requests, and provide customer support • To diagnose problems with our servers and database and to administer our Platforms	• Moby Money’s relevant employees (customer support, Data Protection Officer, IT team) • Third-party agents who conduct KYC checks • Third-party IT service providers	• Identity Information • Contact Information • Purchase Information • Others
• To assess your creditworthiness by reviewing credit reports, credit score and past credit behaviour obtained from a registered Credit Reporting Agency • To determine your eligible spending limit by reviewing income, proof of employment and other checks • To perform alternative data modelling based on your payment and purchase behaviour to enhance our credit risk assessment	• Moby Money’s credit team • Registered Credit Reporting Agencies • Banks and financial institutions • Insurance providers • Credit card companies • Securities and investment services providers	• Identity Information • Contact Information • Purchase Information • Credit Profile
• To store, host and back up your data (whether for disaster recovery or otherwise) • To notify you of system maintenance or a suspected security incident • To detect, investigate and respond to security incidents affecting the Platforms	• Moby Money’s customer support, Data Protection Officer and IT team • Third-party IT service providers • Government and Regulatory Authorities (where required)	• Identity Information • Contact Information • Purchase Information • Credit Profile
• To monitor compliance with internal risk controls, our Terms of Service, and use of the Platforms • To conduct audits, business reporting and quality control • To comply with directions from regulatory or statutory authorities (e.g. Bank Negara Malaysia, Securities Commission, Bursa Malaysia) or as mandated by Applicable Laws • To assist Government and Regulatory Authorities with law enforcement, judicial proceedings and investigations, and to comply with court or tribunal orders	• Moby Money’s relevant employees • Professional advisors and auditors • Affiliate online merchants and partnering businesses • Government and Regulatory Authorities	• Identity Information • Contact Information • Purchase Information • Credit Profile • Sensitive Information • Others
• To conduct surveys for product and service development • To improve and personalise your experience on our Platforms • To perform data, trend and usage research to improve our Services • To produce statistics, reports and market analysis	• Moby Money’s relevant employees • Third-party IT service providers • Data analytics service providers • Investors (in aggregated or anonymised form where feasible)	• Identity Information • Contact Information • Purchase Information • Credit Profile • Sensitive Information • Others
• To send newsletters, alerts, updates, promotional materials and festive greetings from us or our partners, sponsors or advertisers • To share your name and contact number with partners, advertisers, event companies or sponsors for marketing purposes • To invite you to events or activities organised by us or our partners • To provide information on marketing campaigns and promotions • To process event registrations and related communications • To display your feedback or testimonials on our Platforms or share them with interested third parties • You may opt out of marketing at any time — see Section II.C below	• Moby Money’s customer support team and third-party agents • Affiliate online merchants and partnering businesses • Advertising companies, sponsors and event organisers	• Identity Information • Contact Information • Purchase Information • Others
• To investigate or report suspected crime such as money laundering, fraud or other prohibited activity • To track suspicious behaviour (e.g. rejected payments, repeated login failures) • To investigate actual or suspected violations of our Terms of Service or unlawful activity	• Moby Money’s relevant employees • IT service providers and consultants • Regulators, statutory authorities, government authorities, police and enforcement bodies	• Identity Information • Contact Information • Purchase Information • Credit Profile • Sensitive Information • Others
• To enforce our legal or contractual rights, including recovering debts owed to us via legal proceedings or debt collection agencies • To report default or payment behaviour to registered credit bureaus, which will be reflected on your credit report	• Moby Money’s relevant employees, professional advisors, auditors and consultants • Debt collection companies • Third parties involved in restructuring, sale of debts/assets or acquisitions • Registered Credit Reporting Agencies	• Identity Information • Contact Information • Purchase Information • Credit Profile • Sensitive Information • Others
• To collect instalment payments or other amounts owed to us • To process transactions with us or third parties, including refunds and complaints • To manage, operate and administer your account and use of the Services, including suspension or termination • To connect you to affiliate online merchants’ platforms • To audit your account, transactions and use of the Platforms	• Moby Money’s relevant employees • Third-party payment service and payment gateway providers • Affiliate online merchants • Auditors	• Identity Information • Contact Information • Purchase Information • Credit Profile • Sensitive Information • Others
• Any other purpose to which you have separately consented • Other purposes required or permitted under Applicable Data Protection Laws	• Moby Money’s relevant employees • Affiliate online merchants and partnering businesses	• Identity Information • Contact Information • Credit Profile • Others

D. Cross-Border Transfer of Personal Data

We may transfer, store or process your Personal Data outside Malaysia, including with our cloud hosting providers and international affiliates, merchants and partnering service providers, in the following circumstances:

Cloud-based storage – to store your Personal Data on a designated, secure private network connection through a cloud computing provider located outside Malaysia (currently: [INSERT COUNTRIES/REGIONS, e.g. Singapore, EU]).

To share your Personal Data with our international affiliates, merchants and partnering service providers to enable the provision of our products and Services.

Any such transfer will only be made where at least one of the following applies, as permitted under the Personal Data Protection Act 2010: (i) you have consented to the transfer; (ii) the transfer is necessary for the performance of a contract between you and us; (iii) the transfer is necessary to protect your vital interests; (iv) we have taken reasonable steps to ensure the recipient jurisdiction has data protection laws substantially similar to, or affording an equivalent standard of protection as, the PDPA; or (v) another condition permitting transfer under the PDPA is satisfied. Where we rely on contractual safeguards with an overseas recipient, we require that recipient to protect your Personal Data to a standard comparable to this Privacy Policy.

I. Security of Personal Data

To protect your Personal Data from loss, misuse, modification, or unauthorised or accidental access or disclosure, we maintain processes, procedures and controls aligned with industry best practices, including:

Robust KYC processes to verify your identity;

Secure user login and password authentication to prevent unauthorised access;

Audit trails and logs to detect unusual activity and unauthorised access;

Limited, role-based access to our systems and databases;

Regular security and vulnerability assessments of our Platforms;

Regular maintenance of our Platforms to address bugs, errors or faults; and

Secure hosting of our servers, mainframes and other network assets.

While we implement these safeguards, we will not be responsible for unauthorised use of Personal Data by third parties arising from factors beyond our reasonable control.

E. Data Integrity

We take reasonable steps to ensure that the Personal Data we collect, use or disclose is accurate, complete, not misleading and kept up to date, having regard to the purpose for which it is collected and further processed. You can help us do this by promptly notifying us of any changes to your Personal Data using the contact details in Section II.H.

F. Data Breach Notification

We maintain procedures to detect, investigate and respond to any incident that may compromise the security or confidentiality of your Personal Data. In the event of a data breach that is likely to result in significant harm to you, we will, in accordance with Applicable Data Protection Laws: (i) take prompt steps to contain and assess the breach; (ii) notify the relevant regulatory authority where required; and (iii) notify affected users without undue delay, describing the nature of the breach, the Personal Data likely affected, and the steps we recommend you take to protect yourself.

G. Automated Decision-Making

As part of our credit risk assessment process described in Section I.C, we may use automated tools, scoring models and alternative data modelling (based on your payment and purchase behaviour, credit reports and related information) to help assess your creditworthiness and determine your eligible spending limit. If you wish to understand the general factors behind an automated credit decision that affects you, or to request a manual review of that decision, you may contact our Data Protection Officer using the details in Section II.H.

H. Cookies and Similar Technologies

Cookies are small pieces of data that a website sends to your browser, which may then be stored on your device. We and our service providers use the following categories of cookies and similar technologies on our Platforms:

Strictly necessary cookies – required for core functionality such as login, security and shopping cart operation. These cannot be switched off.

Performance and analytics cookies – help us understand how visitors use our Platforms (e.g. via tools such as Google Analytics), so we can improve performance and user experience.

Functional cookies – remember your preferences (e.g. language, saved items) to personalise your experience.

Advertising and targeting cookies – used by us or third-party advertising partners (e.g. Meta Pixel, Google Ads) to deliver relevant marketing and measure campaign effectiveness.

On your first visit, you will be presented with a cookie banner allowing you to accept all cookies, reject non-essential cookies, or manage your preferences by category. You may also adjust your browser settings to block or delete cookies, or to be notified when a cookie is set; please note that disabling certain cookies may affect the functionality of our Platforms. Please refer to your browser’s documentation for instructions.

J. Personal Data of Minors

Our Services are intended for use by individuals who are at least 18 years old and who have the legal capacity to enter into binding contracts under Malaysian law. We do not knowingly collect Personal Data from minors. If we become aware that we have inadvertently collected Personal Data from a minor without the consent of a parent or legal guardian, we will take reasonable steps to delete that data, save where retention is required by Applicable Laws.

Section II: Know Your Rights

A. Consent and Provision of Consent

You are deemed to have consented to the collection, use, disclosure, transfer and retention of your Personal Data for the Purposes described above, to the extent permitted under Applicable Data Protection Laws, when:

You use our Platforms and Services;

You use platforms operated by our affiliate online merchants and partnering businesses to engage with or learn about our products and Services; or

You directly provide your Personal Data to us.

We may also collect your Personal Data in circumstances where consent is not required under Applicable Data Protection Laws. Before submitting the Personal Data of any other person, you undertake that you have obtained their authorisation to disclose their Personal Data and their consent to this Privacy Policy.

We treat Sensitive Information and biometric identifiers as highly confidential and will only use them to provide the specific service you signed up for. Where we collect, use, maintain or disclose Sensitive Information or biometric identifiers, we will obtain your express consent beforehand.

B. Withdrawal of Consent

Your consent remains valid until you withdraw it or request that we stop sending new promotional materials, in writing. If you no longer consent to our collecting, disclosing, using or processing your Personal Data for the Purposes described above, you may withdraw your consent by submitting a written request to our Data Protection Officer at pdpa@mobypay.my.

You may specify the scope of your withdrawal, e.g. limiting it to a particular category of Personal Data or purpose. Following withdrawal, we will stop collecting, disclosing, using or processing your Personal Data accordingly, except to the extent we are required to retain it for compliance, regulatory or other legal purposes.

Please note that withdrawing consent may mean we are unable to continue providing some or all of our products or Services, or keep you updated about new or enhanced offerings.

C. Marketing Preferences and Opt-Out

You may opt out of receiving marketing communications from us or our partners at any time, without affecting your ability to continue using our Platforms and Services, by:

Clicking the “unsubscribe” link in any marketing email we send you;

Updating your communication preferences in your MOBY account settings; or

Submitting a written request to our Data Protection Officer at pdpa@mobypay.my.

We will process opt-out requests promptly. Please note this does not affect service-related communications (e.g. transaction confirmations, account or security notices), which are necessary for us to provide the Services.

D. How Can I Access or Correct My Personal Data?

If you wish to access Personal Data we hold about you, or to correct Personal Data you believe is inaccurate, incomplete, misleading or outdated, you (or a person you have duly authorised, the “Requestor”) may submit a written request to our Data Protection Officer at pdpa@mobypay.my. We will endeavour to respond within 21 days of receipt. We may request further information to verify your identity, or the Requestor’s identity and authority, before processing the request. If we are unable to comply with a request for reasons recognised under Applicable Laws, we will generally inform you of those reasons.

A nominal administrative fee may be charged for data access requests, where permitted by law.

Correction requests will not be subject to any fee.

E. How Long May We Retain Your Personal Data?

We will not retain your Personal Data for longer than necessary to fulfil the Purpose for which it was collected, subject to the following:

Where retention is required under Applicable Laws;

Where legal proceedings have arisen and remain ongoing.

Where we disclose your Personal Data to authorised agents or service providers, we require them to appropriately safeguard it. We will take reasonable steps to ensure Personal Data is destroyed or permanently deleted once it is no longer required for the Purpose, even if you stop using the Platforms or terminate your account, subject to what is permitted under Applicable Laws.

F. Right to Lodge a Complaint

If you believe we have handled your Personal Data in a manner that does not comply with this Privacy Policy or Applicable Data Protection Laws, you may lodge a complaint with our Data Protection Officer using the contact details in Section II.H. If you remain unsatisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi), whose contact details are available at www.pdp.gov.my.

G. Notification of Changes

This Privacy Policy may be amended from time to time in accordance with Applicable Laws, and such variations may apply to you. The latest version will be made available on our Platforms. Where changes are material, we will take reasonable steps to notify you (e.g. by email or an in-app/website notice) in addition to updating the “Last Updated” date at the top of this Privacy Policy. Please revisit the “Privacy Policy” section of our Platforms periodically for updates.