1. Introduction

CreditLens (“we”, “us”, or “our”) is committed to protecting the privacy and security of your personal data. This Privacy Policy describes how we collect, use, disclose, and safeguard information when you access or use the CreditLens platform (the “Platform”).

By registering for an account or using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

2. Information We Collect

2.1 We collect information that you provide directly, including:

– Full name and identity document number (NRIC or passport)
– Contact information such as email address and mobile number
– Business registration details, including company name and registration number
– Director and shareholder information
– Bank statements and supporting financial documents
– Any other information submitted during the onboarding or application process

2.2 We may also collect information automatically when you use the Platform, including:

– Log data such as IP address, browser type, and pages visited
– Device identifiers and operating system information
– Session duration and usage patterns
– Cookies and similar tracking technologies

3. How We Use Your Information

We use the information we collect for the following purposes:

– To verify your identity and the identity of your business
– To facilitate the submission and processing of your financing application
– To transmit your information to Partner Banks for credit assessment and evaluation
– To communicate with you regarding your application status or Platform updates
– To improve, personalise, and maintain the Platform
– To comply with applicable legal and regulatory obligations
– To detect, prevent, and investigate fraud or other unlawful activities

4. Disclosure and Sharing of Information

4.1 We may share your information with the following parties:

– Partner Banks — Licensed banks and financial institutions to whom your application is submitted for evaluation.
– Service Providers — Third-party vendors who assist us in operating the Platform, such as cloud hosting, analytics, and identity verification providers.
– Regulatory Authorities — Government agencies, law enforcement, or regulatory bodies when required by law or to protect our legal rights.
– Credit Reporting Agencies — Where applicable and with your consent, in accordance with the Credit Reporting Agencies Act 2010.

4.2 We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.

4.3 Once your information is transmitted to a Partner Bank, it becomes subject to that Partner Bank’s own privacy policies and practices.

5. Personal Data Protection Act (PDPA) 2010

5.1 We process your personal data in compliance with the Personal Data Protection Act 2010 (PDPA) of Malaysia. Our processing is based on the following grounds:

– Consent — Where you have given explicit consent for us to process your personal data for specified purposes.
– Contractual Necessity — Where processing is necessary to perform the services you have requested, including facilitating your financing application.
– Legal Compliance — Where processing is required for us to comply with a legal obligation under Malaysian law.
– Legitimate Interests — Where processing is necessary for our legitimate business interests, such as preventing fraud and ensuring platform security, provided these interests are not overridden by your rights.

5.2 You have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

6. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes outlined in this Privacy Policy, or as required by applicable law. Specifically:

– Account information is retained for the duration of your active account and for a reasonable period thereafter
– Application documents and financial data are retained for the period required by Malaysian financial regulations and the PDPA
– Log and usage data may be retained for a shorter period for operational and security purposes

When personal data is no longer required, we will securely delete or anonymise it in accordance with our data retention procedures.

7. Security of Your Data

We implement industry-standard technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

– Encryption of data in transit using Transport Layer Security (TLS)
– Encryption of sensitive data at rest
– Access controls and role-based permissions for platform users
– Regular security assessments and monitoring
– Staff training on data protection and security practices

Despite these measures, we are not responsible for breaches resulting from your own actions, such as sharing login credentials.

8. Marketing Consent

8.1 With your consent, we may use your data to send you personalised marketing communications and product updates about CreditLens. Your marketing consent preference defaults to opted-out when you register.

8.2 You can withdraw or reinstate your marketing consent at any time from the Settings page in your account. Withdrawing marketing consent does not affect the processing of your data for the core purposes described in Section 3.

9. Your Rights

Under the PDPA 2010, you have the following rights with respect to your personal data:
– Right of Access — You may request a copy of the personal data we hold about you.
– Right of Correction — You may request that we correct or update inaccurate or incomplete personal data.
– Right to Withdraw Consent — You may withdraw your consent to the processing of your personal data at any time, subject to legal and contractual restrictions.
– Right to Limit Processing — You may request that we restrict the processing of your personal data in certain circumstances.

To exercise any of these rights, please contact our Data Protection Officer at the details provided in Section 13.

10. Cookies

10.1 The Platform uses strictly necessary cookies to operate. These include session cookies required to authenticate you and maintain your login state across requests.

10.2 We do not use advertising, analytical, or third-party tracking cookies. Disabling cookies in your browser will prevent you from logging in to the Platform.

11. Third-Party Links and Services

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any third-party sites you visit.

Our third-party service providers are contractually obligated to handle your personal data only in accordance with our instructions and applicable data protection laws.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Platform. The revised policy will be published on this page with an updated “Last Updated” date.

We encourage you to review this Privacy Policy periodically. Continued use of the Platform after any changes constitutes your acceptance of the updated Privacy Policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact us:

– Via the contact form available at the Contact page on our Platform
– By email to our Data Protection Officer

We are committed to resolving any complaints or concerns regarding our data handling practices in a timely and transparent manner.