Data Protection
Please read this document carefully. By using our services, you acknowledge and agree to the terms set out herein.
This Data Processing Policy (the "Data Terms") forms part of the contractual relationship between EXICASH SDN BHD (Registration No. 202601015752 (1677849-M)), 16-19, Menara Mutiara Sentral, No. 2, Jalan Desa Aman 1, Cheras Business Centre, 56000 Kuala Lumpur, Malaysia (the "Provider", "EXICASH", "we", "us" or "our") and the company, business or other legal entity that registers for, is approved for, or uses the Services (the "Merchant", "you" or "your").
These Data Terms apply to the Processing of Personal Data by either Party in connection with:
These Data Terms form part of the agreement between the Provider and the Merchant.
Terms defined in the TOS have the same meaning in these Data Terms unless expressly stated otherwise.
If there is any inconsistency between these Data Terms and the TOS concerning the Processing, protection, security, retention, transfer or handling of Personal Data, these Data Terms shall prevail to the extent of that inconsistency.
For all other matters, the TOS shall prevail.
In these Data Terms:
“Applicable Data Protection Law” means the Personal Data Protection Act 2010 of Malaysia, as amended from time to time, together with regulations, standards, binding requirements, orders and other Applicable Law concerning privacy or Personal Data applicable to the relevant Processing.
“Data Controller” means a person that processes Personal Data, has control over or authorises the Processing of Personal Data, or otherwise falls within the corresponding concept under Applicable Data Protection Law.
“Data Processor” means a person that Processes Personal Data on behalf of a Data Controller or otherwise falls within the corresponding concept under Applicable Data Protection Law.
“Data Subject” means an identified or identifiable individual to whom Personal Data relates.
“Personal Data” has the meaning given under Applicable Data Protection Law.
“Personal Data Breach” means any breach of Personal Data as defined by Applicable Data Protection Law, including any unauthorised or accidental access, collection, use, disclosure, alteration, loss, destruction or other compromise of Personal Data.
“Process”, “Processed” and “Processing” include any operation performed on Personal Data, whether by automated or non-automated means, including collection, recording, organisation, storage, access, retrieval, consultation, use, transmission, disclosure, matching, analysis, restriction, deletion, destruction or anonymisation.
“Sub-processor” means a third party appointed by the Provider to Process Personal Data on behalf of the Merchant where the Provider is acting as a Data Processor.
The Parties acknowledge that their respective roles may vary depending on the relevant Processing activity.
A Party may act as a Data Controller for certain Processing and as a Data Processor for other Processing.
Nothing in these Data Terms shall designate a Party as a Data Processor where, under Applicable Data Protection Law and having regard to the relevant Processing activity, that Party acts as a Data Controller.
The Provider may act as an independent Data Controller in relation to Personal Data that it determines is reasonably necessary to Process for its own legitimate legal, regulatory, security and business responsibilities in connection with the Services, including:
Where the Provider acts as a Data Controller, it shall be independently responsible for complying with the obligations applicable to it under Applicable Data Protection Law.
The Merchant will ordinarily act as a Data Controller in relation to Personal Data it collects or determines the purposes and means of Processing for in connection with:
The Merchant is responsible for complying with Applicable Data Protection Law in respect of those activities.
Where the Provider Processes Personal Data solely on behalf of the Merchant and on the Merchant’s documented instructions in connection with the Services, the Provider shall act as a Data Processor in respect of that Processing.
The provisions of these Data Terms relating specifically to Processing on behalf of the Merchant shall apply accordingly.
Nothing in these Data Terms transfers to the Provider any obligation that Applicable Data Protection Law places directly on the Merchant as a Data Controller.
Where the Provider acts as a Data Processor for the Merchant, the Provider shall Process Personal Data only on documented instructions from the Merchant, unless Applicable Law requires otherwise.
The Merchant’s documented instructions include:
The Merchant instructs the Provider to Process Personal Data as reasonably necessary to:
The Provider is not required to comply with an instruction that it reasonably believes would:
Where legally permitted and reasonably practicable, the Provider shall inform the Merchant of the relevant concern.
The Merchant represents and warrants that Personal Data disclosed or made available to the Provider has been lawfully collected and may lawfully be Processed for the purposes contemplated by the Services.
The Merchant is responsible for:
The Merchant shall not instruct the Provider to Process Personal Data:
The Merchant shall not submit Personal Data through the Platform that is unnecessary for the relevant Transaction or Service.
The Merchant shall not provide sensitive Personal Data to the Provider unless:
The Merchant is responsible for taking reasonable steps to ensure Personal Data supplied by it to the Provider is accurate, complete and current where required for the relevant Processing purpose.
Where the Provider acts as a Data Processor on behalf of the Merchant, the Provider shall:
The Provider shall ensure that personnel authorised to Process Personal Data are subject to appropriate obligations of confidentiality.
Access to Personal Data shall be limited, where reasonably practicable, to personnel who require access for:
The Provider shall maintain reasonable measures designed to ensure personnel with access to Personal Data understand and comply with applicable confidentiality, privacy and information-security requirements.
The Provider shall maintain reasonable administrative, technical and organisational safeguards appropriate to:
The Provider’s security measures shall be designed to protect Personal Data against:
Depending on the relevant system, Processing activity and risk, the Provider’s security programme may include measures relating to:
The Merchant acknowledges that security measures may vary according to the relevant Service, environment, Payment Partner, architecture and risks.
Nothing in these Data Terms constitutes a warranty that a security incident will never occur.
The Merchant shall maintain reasonable security measures for Merchant Systems and shall be responsible for:
Where either Party stores, Processes or transmits payment card data, that Party shall comply with the Payment Card Industry Data Security Standard and applicable Payment Network security requirements to the extent applicable to its environment and responsibilities.
The Provider shall maintain reasonable procedures to identify, investigate, contain and respond to suspected Personal Data Breaches affecting Personal Data Processed in connection with the Services.
Where the Provider acts as a Data Processor and becomes aware of a Personal Data Breach affecting Personal Data Processed on behalf of the Merchant, the Provider shall notify the Merchant without undue delay where such notification is reasonably necessary to enable the Merchant to comply with its obligations under Applicable Data Protection Law.
To the extent reasonably available and legally permitted, the Provider’s notification may include:
Information may be supplied in phases as the investigation progresses.
Notification of a Personal Data Breach does not constitute an admission of fault, liability or breach of these Data Terms.
Each Party shall be responsible for determining whether it is required to notify:
in respect of a Personal Data Breach for which that Party is the relevant Data Controller or otherwise bears the applicable notification obligation.
The Parties shall reasonably cooperate where information held by one Party is required for the other Party to comply with legally applicable Personal Data Breach obligations.
The Merchant shall notify the Provider without undue delay if it becomes aware of a security incident that may materially affect:
The Merchant authorises the Provider to engage Payment Partners, cloud infrastructure providers, data-centre providers, fraud-prevention providers, security providers, communications providers, customer-support providers and other service providers reasonably necessary to provide and operate the Services.
Where the Provider appoints a Sub-processor to Process Personal Data on behalf of the Merchant, the Provider shall impose appropriate contractual data-protection and security obligations to the extent required by Applicable Data Protection Law.
Where required by Applicable Data Protection Law, the Provider shall remain responsible for obligations expressly applicable to it regarding Processing performed by its Sub-processors.
The Merchant acknowledges that certain Payment Partners may Process Personal Data as independent Data Controllers for their own:
Such Processing may be subject to the Payment Partner’s own terms and privacy practices.
The Provider may add, replace or remove service providers and Payment Partners in the ordinary course of operating the Services.
Where Applicable Data Protection Law requires notice, consent, authorisation or another procedure in connection with a new Sub-processor, the Provider shall comply with the applicable requirement.
The Merchant acknowledges that Personal Data may be Processed, transmitted, accessed or stored outside Malaysia where reasonably necessary for:
A Party transferring Personal Data outside Malaysia shall take such steps and implement such safeguards as are required by Applicable Data Protection Law.
To the extent required for the Provider to perform the Services and permitted by Applicable Data Protection Law, the Merchant authorises the Provider to facilitate cross-border Processing in accordance with these Data Terms.
The Merchant remains responsible for ensuring that any instruction it gives requiring an international transfer of Personal Data is lawful.
Each Party is responsible for responding to Data Subject requests to the extent required by Applicable Data Protection Law having regard to its role in relation to the relevant Personal Data.
Where the Provider:
the Provider may refer the Data Subject to the Merchant where legally permitted.
Taking into account the nature of the Processing and information reasonably available to the Provider, the Provider shall provide reasonable assistance to the Merchant where necessary for the Merchant to respond to applicable requests concerning:
Where a request requires material bespoke technical work beyond functionality ordinarily provided through the Platform, the Provider may charge reasonable costs for such assistance where permitted by Applicable Law and agreed with the Merchant in advance.
Where the Merchant is required by Applicable Data Protection Law to carry out a data protection impact assessment concerning the Provider’s Processing on behalf of the Merchant, the Provider shall provide reasonable information and assistance relating to the Provider’s Processing activities, taking into account:
Where Applicable Data Protection Law requires consultation with a competent authority concerning Processing carried out through the Services, the Parties shall reasonably cooperate to the extent relevant to their respective responsibilities.
Each Party shall cooperate reasonably with lawful requests or investigations by competent data-protection authorities relating to Processing for which that Party has responsibility.
Nothing requires a Party to disclose legally privileged, security-sensitive or unrelated confidential information except where required by Applicable Law.
Each Party shall appoint a Data Protection Officer where required by Applicable Data Protection Law.
Where a Party is required to appoint a Data Protection Officer, it shall maintain appropriate contact information for that officer in accordance with Applicable Data Protection Law.
The Data Protection Officers or other designated privacy contacts of the Parties may communicate directly where reasonably necessary concerning:
Personal Data may be retained for the period reasonably necessary for:
Following termination of the Services, Personal Data Processed solely by the Provider as a Data Processor on behalf of the Merchant shall be deleted, anonymised, returned or otherwise handled in accordance with:
The Provider may retain Personal Data after termination where retention is reasonably necessary or required for:
Personal Data retained for such purposes shall remain subject to applicable confidentiality and security obligations.
Personal Data contained in backups may remain until overwritten or deleted in accordance with the Provider’s normal backup and retention cycle, provided such Personal Data remains appropriately protected and is not restored for ordinary business use except where necessary for recovery, legal or security purposes.
Upon reasonable written request, the Provider shall make available information reasonably necessary to demonstrate compliance with its applicable Data Processor obligations under these Data Terms.
Such information may include, where appropriate and available:
Where additional audit rights are required by Applicable Data Protection Law and the information provided under Clause 16.1 is insufficient, the Parties shall reasonably cooperate regarding an appropriate audit arrangement.
Any audit or review shall:
Unless an audit identifies a material breach by the Provider of these Data Terms, each Party shall bear its own costs and the Merchant shall bear any reasonable external costs specifically incurred by the Provider in facilitating a Merchant-requested bespoke audit.
Each Party shall take reasonable steps, having regard to the purpose for which Personal Data is Processed, to ensure that Personal Data under its control is sufficiently accurate, complete and current for that purpose where required by Applicable Data Protection Law.
The Provider may rely on Personal Data supplied by the Merchant, Customer, Beneficiary, Payment Partner or other authorised source unless the Provider knows or reasonably should know that the relevant information is materially incorrect.
The Provider may take reasonable data-protection and security considerations into account when:
Where appropriate to the nature and risk of the Processing, this may include consideration of:
Nothing in these Data Terms prevents the Provider from generating or using information that has been aggregated or anonymised so that it no longer constitutes Personal Data under Applicable Data Protection Law.
Such information may be used for:
provided that the Provider does not use such information to re-identify a Data Subject contrary to Applicable Data Protection Law.
The Provider may disclose Personal Data where reasonably necessary to:
subject to Applicable Data Protection Law.
Where legally prohibited from informing the Merchant of such disclosure, the Provider shall not be required to do so.
Each Party shall maintain such records concerning its Processing activities as are required by Applicable Data Protection Law.
The Provider may maintain electronic records concerning:
The Provider may amend these Data Terms where reasonably necessary to reflect:
Where an amendment materially affects the rights or obligations of the Merchant concerning Personal Data, the Provider shall provide such prior notice as is reasonably practicable or required by Applicable Law.
An updated version shall take effect on the date specified in the relevant notice or updated Data Terms.
Where Applicable Law requires new consent or acceptance for a particular change, the Provider shall obtain such consent or acceptance before relying on the change to the extent required by law.
The allocation, exclusions and limitations of liability applicable to these Data Terms shall be governed by the liability provisions of the TOS unless Applicable Law requires otherwise.
Nothing in these Data Terms excludes or limits liability to the extent that such liability cannot lawfully be excluded or limited.
These Data Terms commence when they first become applicable to the Merchant and continue for so long as the Provider Processes Personal Data in connection with the Services.
These Data Terms terminate when:
subject to applicable retention obligations.
Provisions concerning:
shall continue for so long as relevant Personal Data remains Processed or retained.
These Data Terms may be accepted electronically together with the TOS or through another electronic acceptance mechanism made available by the Provider.
Except where Applicable Law expressly provides otherwise, a person who is not a Party has no right to enforce these Data Terms.
If any provision is invalid or unenforceable, it shall be modified to the minimum extent necessary to make it valid and enforceable or, where modification is not possible, severed without affecting the remaining provisions.
These Data Terms are governed by the laws of Malaysia.
The dispute and jurisdiction provisions of the TOS apply to these Data Terms.
Processing of Personal Data in connection with the provision, operation, security and administration of the Services.
Processing may occur throughout the term of the Merchant relationship and thereafter for applicable retention periods.
Personal Data may relate to:
Depending on the Services used, Personal Data may include:
Processing may include:
Personal Data may be Processed for:
Processing may occur continuously, periodically or on an event-driven basis depending on Merchant use of the Services and the relevant Processing activity.
Personal Data may be retained for the period reasonably necessary for:
after which Personal Data shall be deleted, anonymised or otherwise handled in accordance with Applicable Data Protection Law and applicable retention procedures.
The Provider shall maintain security measures appropriate to its systems, responsibilities and risk profile.
Such measures may include, as relevant: