DocuFlow

1. Introduction

BSSMC GROUP (M) SDN BHD ("BSSMC", "we", "our", or "us") is committed to protecting your personal data in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia. This Privacy Policy explains how we collect, use, store, and disclose your personal information when you use the DocuFlow platform.

2. Personal Data We Collect

We may collect the following categories of personal data:

• •Identity Data: Full name, NRIC number (new and old), date of birth.
• •Contact Data: Mobile number, email address, company name.
• •Financial & Credit Data: Credit reports, CCRIS, DCHEQS, and information obtained through CTOS Data Systems Sdn Bhd.
• •Technical Data: IP address, device information, browser user agent, geolocation (with consent), timestamps of access.
• •Signature Data: Digital signature images captured during form signing.
• •Document Data: Uploaded identity card images and signed document files.

3. Purpose of Data Processing

Your personal data is collected and processed for the following purposes:

• •Processing loan or financial consultancy service applications.
• •Evaluating financial eligibility and creditworthiness.
• •Internal risk assessment, compliance, and audit purposes.
• •Complying with applicable Malaysian laws and regulations.
• •Identity verification and fraud prevention.
• •Communication regarding your application or account.

4. Sharing of Personal Data

We may share your personal data with:

• •CTOS Data Systems Sdn Bhd — a registered credit reporting agency under the CRA Act 2010.
• •Our Group of Companies — parent companies, subsidiaries, affiliates, or companies under our ultimate holding company.
• •Regulatory Authorities — Bank Negara Malaysia, relevant government agencies, as required by law.
• •Service Providers — third-party processors acting on our behalf under strict data protection agreements.

5. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes outlined in this policy, or as required by Malaysian law. When data is no longer required, it will be securely destroyed or anonymized.

6. Security Measures

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or alteration. This includes encrypted data transmission, access controls, and audit logging of all system activities.

7. Your Rights

Under the PDPA, you have the right to:

• •Access your personal data held by us.
• •Request correction of inaccurate personal data.
• •Withdraw consent for data processing (subject to legal limitations).
• •Inquire about our data protection practices.

8. Contact Our Data Protection Officer

9. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be published on this page with an updated revision date. Continued use of DocuFlow after changes constitutes acceptance of the revised policy.