How We Protect Personal Data

1. Introduction

Info Data ("we", "us") is a Malaysia-based provider of KYC identity verification and KYB business verification for Chinese national individuals and companies. This Privacy Policy explains how we collect, use, disclose and protect personal data in connection with our services, in accordance with the Personal Data Protection Act 2010 and its amendments.

Depending on the service, we act as a data processor on behalf of our customers (such as financial institutions) or as a data user for our own business operations, including website enquiries and demo requests.

2. Personal Data We Process

Depending on the verification requested, we may process:

• Name, identity document number and document images
• Facial images for facial verification
• Mobile number and bank card details
• Company registration and ownership information
• Business contact details from demo and contact forms
• Technical data such as IP address and access logs

3. Purposes of Processing General Principle

We process personal data only for purposes directly related to our services, including:

• Performing identity and business verification checks requested by our customers.
• Supporting customer onboarding, identity consistency checks and due diligence.
• Responding to enquiries and arranging product demonstrations.
• Maintaining audit logs and meeting our legal and regulatory obligations.

4. Notice and Consent Notice & Choice Principle

Where we collect personal data directly, we inform individuals of the purposes, the types of third parties to whom data may be disclosed, and their rights. For verification services, our customers are responsible for obtaining the consent of individuals before submitting their data to us, and we process data only on their documented instructions.

Individuals may withdraw consent by written notice, subject to legal or contractual restrictions. Withdrawal may affect our ability to provide certain services.

5. Disclosure Disclosure Principle

We do not sell personal data. We disclose it only to:

• The customer that requested the verification.
• Authorised data sources and service providers needed to complete the verification.
• Regulators, courts or law enforcement where required by law.

6. Cross-Border Transfers

Verifying Chinese nationals and companies requires data to move between Malaysia and the People's Republic of China. Such transfers are carried out only where permitted under the PDPA, with appropriate safeguards including encryption in transit, contractual protections and restricted access, and subject to the specific use case.

7. Security Security Principle

We apply practical technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction.

In the event of a personal data breach likely to cause significant harm, we will notify the Personal Data Protection Commissioner and affected parties as required by law.

8. Retention Retention Principle

Personal data is kept only as long as necessary to fulfil the purpose for which it was collected, or as required by law and our customer agreements. When no longer needed, it is securely deleted or anonymised.

9. Data Integrity Data Integrity Principle

We take reasonable steps to ensure personal data is accurate, complete, not misleading and kept up to date, relying on authoritative national, telecom and corporate registry sources where available.