Sabah Credit Corporation

1. Scope of Notice

1.1 This Privacy Notice applies to information, including personal data, collected about you by Sabah Credit Corporation ("SCC"), referred to in this statement either individually or collectively as "the Corporation", "we", "our" or "us".

1.2 This Privacy Notice outlines how we process your personal data collected by the Corporation through the channels below from the point we collect, use, share, dispose of and the security measures that we have established to ensure your personal data is well protected:

• 'Online' through our Website; and
• 'Offline' through our products and services offered over the counter, by the Corporation's Customer Service Representatives, and/or the Corporation's sales and marketing team and during on-going due diligence reviews by the Corporation's officers.
• Information extracted from commercial transactions that can reasonably identify you.

2. Our Privacy Commitment

2.1 This Privacy Notice is issued to inform you of the Corporation's commitment to the policy of protecting at all times the confidentiality, integrity and security of the information provided by you to us as we recognise the importance of the personal information we hold about customers and the trust they place in us.

2.2 Your personal data is classified as confidential and can only be disclosed by us where authorised by you, permitted by any laws (including regulations, standards, guidelines and/or obligations) applicable to the Corporation.

3. Source of Collection of Your Personal Information

3.1 We will collect information from a variety of sources including but not limited to the sources mentioned below, which may constitute personal data and/or "sensitive personal data*" which are relevant to our business relationship with you:

• Information we collect from you directly in person when you:
  • Apply for a product or service, submit a financing application, make repayments, participate in promotional activities or otherwise engage with SCC;
  • Speak to us over the phone or personally including the process of selling or marketing a product or service to you or when you call in for enquiries and/or through our telemarketing calls; and
  • Visit our sites, use our services, and view our online advertisements.
• Information we collect about you from other sources without your direct involvement where permitted by law:
  • From Credit Reference Agency for the purpose of credit assessment when considering credit applications;
  • From employers, payroll administrators, salary deduction agents, guarantors, government agencies and statutory bodies where permitted by law; and
  • From any court order or regulatory body having authority over the Corporation or any law enforcement agency for the purpose of considering your application for financing facilities or maintaining our business relationship with you.

4. Collection of Personal Information

4.1 The type of personal information collected varies depending upon the type of product or service you seek and collection may begin prior to your take-up or upon signing up or depending on how you access and use our products and services. Information collected will include:

• Information that identifies you:
  • Your name, salutation/title, correspondence address, e-mail address and other contact information such as telephone no., mobile no., etc.;
  • Your age, gender, date of birth, race, citizenship, marital status, particulars of identity documents such as identity card or passport, where applicable;
  • Your education and employment details;
  • Information captured on security systems [including a recording of your image on Closed Circuit Television ("CCTV")];
  • Names and particulars of the authorised officers, directors, shareholders, beneficial owners, business registration, country of incorporation and financial or commercial dealings of the company, where applicable;
  • Date of call to the Bar (applicable to lawyers only);
  • Relationship with other data subject/third parties; and
  • Goods and Services tax registration number (for tax input purposes).
• Information about your financial position:
  • Sources of income, expenses, savings, assets, liabilities, investment portfolio and borrowing history;
  • Account number/Income tax number;
  • Latest audited/Management financial statements;
  • Credit reports from credit reporting agencies, daily reconciliation reports; and
  • Information relating to your creditworthiness obtained from credit reporting agencies, financial institutions, employers and other lawful sources.
• Information about your intended use of our product or service.
• Information about your opinion about products, services or staff.

4.2 Under certain circumstances, we may also collect sensitive personal data if:

• We need it to provide you with a specific product or service; or
• You are applying for employment with us.

4.3 We may also collect personal data of a minor from the parent/legal guardian if we need to provide the minor with a specific product or service.

5. Personal Information about Third Parties

If at any time you supply us with personal information about another person or in the case where you are dependent on another person such as your spouse, parents or other third parties, you should ensure that you are authorised to do so and you agree to inform that person who we are, that we may use and disclose that personal information and that they may gain access to it should we hold that information.

6. Use of Personal Information

Although, the primary purpose of collecting your information is for its use in the normal course of the general business between the Corporation and you, the said information may also be applied for purposes connected with the said primary purpose including but not limited to the following:

• Provision of financing facilities and related services to you;
• Offering, cross-selling and marketing products and services of SCC, our affiliates such as subsidiaries, related corporations, business partners, insurance providers, takaful operators and service providers engaged by SCC ("Affiliates");
• Conducting credit and other status checks at the time of application and periodically during the tenure of the credit to ensure on-going credit worthiness of customers;
• Creating and maintaining the Corporation's credit scoring and risk related models;
• Maintaining credit history of customers;
• Customising and improving SCC products, financing facilities and related services;
• Internal monitoring and control, including but without limitation to determining amounts owed to or by customers;
• Enforcement of customer's obligations, including but without limitation to collection of amounts outstanding from customers and other parties having liability to the Corporation;
• Where disclosure is required under any law, rule, regulation, court orders or any guidelines issued by a regulatory body having authority over the Corporation or any law enforcement agency;
• Enabling an actual or proposed assignee of the Corporation, or participant or sub-participant of the Corporation's rights in respect of the customer to evaluate the transaction intended to be the subject of the assignment, participation or sub participation;
• Research and statistical analysis (including behavioural analysis);
• Engaging with legal firms to perfect the Corporation's security documentation for customer's loan and advances;
• Process lawyer's data to enable the Corporation to evaluate their suitability to be appointed to the Corporation's Panel of Solicitors;
• Assist authorised vendors to perform onsite maintenance and support for IT systems and equipment;
• Due diligence check for employees, suppliers, vendors, IT hardware and software providers prior to contracting their services or purchasing their products;
• Design and organise campaigns/promotions/events for customers' participation including the process of selecting winners, distribution/delivery of gifts and prize giving ceremonies;
• Retrieving, recording and storing for internal/external audit purposes;
• Satisfying the terms and conditions of employment contracts with the Corporation;
• Administration and management of salary, medical and other employment benefits;
• Administration of salary deduction arrangements with employers, payroll administrators and authorised deduction agents;
• Verification of employment, salary, pension and related information with government agencies, statutory bodies and employers where permitted by law;
• CCTV footage, in particular, may also be used for the following purposes:
  • Quality assurance purposes;
  • Public safety and security;
  • Detecting and deterring suspicious, inappropriate or unauthorized use of our financing facilities, products, services and/or premises;
  • Detecting and deterring criminal behaviour; and/or
  • Conducting incident investigations;
• Empanelment, appointment and review of valuers, insurance companies and developers; and
• Complaint resolution.

7. Consent

7.1 We only collect personal information about you that is necessary to perform our functions and activities. Where indicated by the Corporation, the provision of your personal data is mandatory.

7.2 If you do not provide this information, fail to answer necessary declarations, provide inaccurate/incomplete documentation, or object/withdraw your consent to the processing of your personal data, the Corporation shall have the right to:

• Reject or refuse to process your application for employment, financing facilities, or business dealings;
• Refuse to deliver or continue providing the services or products you want; and/or
• Suspend, recall, or terminate any existing financing facilities, accounts, or contractual arrangements granted or entered into between you and the Corporation.

7.3 Your consent can be expressed verbally or in writing, or implied by your actions.

7.4 Where indicated by SCC, provision of personal data is mandatory. Failure to provide such information may prevent SCC from processing applications, providing financing facilities or delivering services.

8. Data Confidentiality and Sharing of Personal Information

8.1 We may share your personal information with our Affiliates in order to offer you products and services of the Corporation and our Affiliates which may interest you. To enable us to do the same, we will obtain your consent and only share your personal information for the purposes to which you have agreed.

8.2 Data (except data already in the public domain) held by the Corporation relating to you will be kept confidential, but we may need to share your personal information in the normal course of general business and connected with the primary purpose for which your information was collected with the following parties, subject at all times to any laws (including regulations, standards, guidelines and/or obligations) applicable to us:

• The Corporation and our Affiliates;
• Any agent, contractor, developer, third party service provider, financial guarantee provider, adviser, liquidators/Receivers and Managers, auditors, auctioneer, vehicle dealers/distributors/traders/manufacturers or consultant who provides administrative, telecommunications, electronic payment, data processing and analysis, payment, debt collection, valuation, facilitating insurance and takaful products associated with SCC financing facilities, research, legal, financial, accounting, taxation, audit or refers business to us or other services to the Corporation;
• Any other person who has expressly or impliedly undertaken to keep such information confidential or otherwise is under a duty of confidentiality to the Corporation;
• Any financial institution, credit reporting agency or other organisation with whom the customer has or proposes to have financial dealings;
• Any party jointly with whom the Corporation launches, organises or offers any product, function or service and any other party having business arrangements with the Corporation in connection with the services, products, customer feedback survey and functions offered or organised by or through the Corporation;
• Credit reporting agencies, and, in the event of default, to debt collection agencies;
• Any person, which is required by law, rule, regulation, court order and under any guidelines issued by regulatory or other authorities;
• Any party giving or proposing to give a guarantee or third party security to guarantee or secure the customer's obligations;
• Any party making any request mentioned in paragraph 6(k) above;
• Any actual or proposed assignee of the Corporation or participant or sub participant or transferee of the Corporation's rights in respect of the customer;
• Marketing campaigns prize winners' names to the media and Corporation's website; and
• Legal and other professional advisers of any party mentioned in item 8.2 (a) to (k) above.

9. International Transfers

9.1 SCC may engage service providers or business partners located outside Malaysia and, where necessary, personal data may be transferred outside Malaysia in accordance with applicable laws if:

• You have given consent to the transfer;
• The transfer is necessary for the performance of a contract between you and the Corporation;
• The transfer is necessary for the conclusion or performance of a contract between the Corporation and a third party which is entered into at your request or is in your interest;
• The transfer is for the purpose of any legal proceedings or for the purpose of obtaining legal advice or for establishing, exercising or defending legal rights;
• The Corporation has reasonable grounds for believing that in all circumstances of the case that:
  • The transfer is for the avoidance or mitigation of adverse action against you;
  • It is not practical to obtain your consent in writing to the transfer; or
  • If it is practical to obtain such consent, you would have given your consent;
• The Corporation has taken all reasonable precautions and exercised all due diligence to ensure that your personal information will be processed in that place in accordance with Malaysian law;
• The transfer is necessary in order to protect your vital interests; or
• Where the Government deem that the transfer of your personal information is necessary in the public interest.

9.2 Our Privacy Notice and our practices are designed to provide a consistent level of protection for personal information. This means that even in countries whose laws provide for less protection for your information, the Corporation will still handle your information in the manner described here.

10. Personal Information Security

10.1 The Corporation is committed to protecting the security of your personal information by implementing adequate and stringent security controls, measures and protocols in line with existing industry practices and legal requirements to safeguard and secure your personal information against any loss, misuse, modification, unauthorised or accidental access or disclosure, alteration or destruction.

10.2 To achieve this objective, regular reviews of the risks to personal information would be conducted and any security flaws or weaknesses identified would be promptly addressed and rectified.

10.3 We employ security measures regardless of the media on which information is stored (paper, computer disks, etc.), the systems which process it (microcomputers, mainframes, voice mail systems, etc.), or the methods by which it is moved (electronic mail, face-to-face conversation, etc.). Such protection includes restricting access to information on a need-to-know basis. The Corporation devotes sufficient time and resources to ensure that information is properly protected.

10.4 As a source of reference for the Corporation's information security needs, information security policies, standards and procedures are fully documented and maintained. All employees, including new recruits, are educated as to their obligations with regard to your personal information. Consultants or other external parties contracted to carry out work for the Corporation must also conform to these requirements and where appropriate, are also bound by non-disclosure agreements to ensure the confidentiality of the Corporation's information assets.

10.5 We also require you to help us by complying with the security measures designed to protect your personal identification numbers and passwords by keeping it secret and confidential. These are set out in the terms and conditions of your financing facilities, online services or other products and services. You may be able to limit your liability for unauthorised use of your account if you observe these requirements.

10.6 SCC retains personal data only for as long as necessary to fulfil the purposes stated in this Privacy Notice, comply with legal and regulatory requirements, resolve disputes, and enforce agreements. If we no longer require your personal information for any of the purposes stated in the Privacy Notice and pursuant to any agreements entered into between you and us, after the expiry of the relevant retention period, whether pursuant to any laws and regulations or based on the requirement under our policies, or otherwise, we will take reasonable steps to destroy it in a secure manner or remove identifying features from it.

11. Personal Information Accuracy

11.1 The Corporation will take all practicable and reasonable steps to ensure that your personal information is accurate, complete and up-to-date.

11.2 You can help the Corporation to keep accurate and up-to-date records by informing us in writing of any changes so that records on you could be updated promptly.

12. Access to Personal Information

12.1 As a customer, you can exercise the following rights:

• To check whether the Corporation holds personal information about you and have access to such data;
• To require us to correct any data relating to you which is inaccurate;
• To ascertain our policies and practices in relation to your data and to be informed of the kind of personal data held by us;
• To withdraw your consent for the Corporation to process your personal data; and
• To request SCC to cease or limit the processing of your personal data for direct marketing purposes, subject to applicable laws.

12.2 The Corporation reserves the right to charge a reasonable fee for the processing of any data access request.

12.3 Should you have any query in relation to this privacy notice or how we handle your personal data, kindly:

• Visit your account holding branch; or
• Submit your query to any of the following contact points:

13. Direct Marketing/Telemarketing

13.1 The Corporation may with your consent use your personal information to provide you with Corporation offers, newsletters and marketing materials/information about products, services or other events that may be of interest to you.

13.2 If at any time you choose not to receive such marketing information from us, you may visit any of our branches to instruct us not to send you any further such material.

14. Website Links

Please note that this website may contain hyperlinks to other sites that are not affiliated with the Corporation. The hyperlinked websites may or may not meet the same privacy standards that we set for ourselves and you are to take care to understand and evaluate their particular privacy standards and procedures. A link to such websites is not an endorsement of the contents of such websites and makes no warranties as to the information contained in such websites.

15. Changes to this Privacy Notice

The Corporation will occasionally update this Privacy Notice to reflect changes to our policies, processes and systems in relation to how we handle your personal information. When we post changes to this notice we will revise the "Last Reviewed Date" appearing in this Privacy Notice. By continuing to utilize the Corporation’s financing facilities, products, or services after the effective date of any modifications or updates to this Privacy Notice, you shall be deemed to have accepted and agreed to such modifications.

16. Cookies and Tracking Technologies

SCC websites, online portals and digital platforms may use cookies, web beacons, analytics tools and similar technologies to improve user experience, monitor website performance, maintain security and analyse usage trends.