At Kenanga Group (consists of Kenanga Investment Bank Berhad and its group of companies including subsidiaries and related companies), we respect your Personal Data and strive to ensure that your Personal Data is protected in accordance with the laws of Malaysia. The security of your Personal Data is important to us and we shall maintain appropriate physical, technical and organizational measures needed to ensure the security and confidentiality of your Personal Data.

We may store and process your Personal Data on our computers and/or systems wherever located and in any other medium. We may retain your Personal Data up to the maximum period permitted for legitimate business purposes, legal, regulatory and internal requirements. We may, over time, delete these records if they are no longer necessary or permissible by law.

Some pages on our website may include links to third party websites. These sites are governed by their own privacy statements and we are not responsible for their privacy practices, operations and contents of the said links. You are advised to review the privacy statements of these sites before furnishing any information. Please remember that internet communications are not secure. We cannot accept any responsibility for unauthorised access by a third party and/or the corruption of information/data being sent by any individuals to us via internet communications or electronic mail.

Kenanga Group will collect, process and use your Personal Data in accordance with this Personal Data Protection Notice (“PDP Notice”). This PDP Notice describes the type of Personal Data we collect and how we collect it, how such Personal Data is used, the parties that we disclose the Personal Data to, the choices we provide and your rights over your Personal Data including how to access and update your Personal Data.

Types of data and information we collect

We collect and process your personal data and information including but not limited to, information to establish your identity and background (including your images), contact details, financial data, creditworthiness information, location data, audio recordings and other information that you provide when you apply for any of our products and/or services (“Personal Data”). We may obtain these Personal Data from yourself or from variety of sources, including when you apply for any of our products and services; through your relationship with us; through your mobile device; from recordings of Closed Circuit Television (CCTV) installed at our premises; from any analysis of the way you use and manage your account/facility with us; publicly available sources or registries; government authorities, regulatory authorities and/or law enforcement agencies; from third parties or other sources in respect of which you have given your consent to disclose the Personal Data and/or where not otherwise restricted; and/or from any information that is supplied and/or collected when you visit our websites which include your mobile device or computer's IP address or from any information that is collected via cookies in some of our websites. We may use cookies for a number of purposes, including to store your preference for certain types of information or products, further analysis for the purpose of providing products and services to you, to improve our products and/or to personalize our services to you. You may adjust settings on your browser and/or mobile device so that you will be notified when you receive a cookie or other similar tracking tools. Please refer to your browser documentation to check if the tracking tools have been enabled on your computer and/or mobile device or to request not to receive cookies or to disable cookies if you do not wish to have information collected via the use of cookies.

Use and Disclosure of Personal Data

We may use, process and/or disclose your Personal Data for the following purposes in and/or outside Malaysia (“Purpose”):-

• to assess and process your applications for our products and/or services;
• to manage and maintain your accounts/facilities with us;
• to conduct credit checks and assisting other financial institutions to conduct credit checks;
• to evaluate your financial needs;
• for crime or fraud detection, investigation, prevention, prosecution and compliance with sanctions, including know your customer (KYC) and regular politically exposed persons (PEP) screening;
• to respond to the requirements of a civil or criminal legal process, government and/or any regulatory body, and/or for regulatory compliance purpose and/or as required by law or regulation (including the European Union member states);
• for debt collection and enforcement of your obligations to us;
• for market research and statistical analysis and surveys with the aim of improving our products and services;
• to provide you with information on our and third party products and services which may be of interest to you;
• to compare information/data for accuracy of our record, and verify with third parties;
• to research, design and improve our products and services, operational and business processes;
• to support our business, financial and risk monitoring, planning and decision making;
• to handle complaints and queries;
• for audit, compliance and risk management;
• to transfer or assign our rights and duties under any governing terms and conditions between us and yourself;
• to perform shared services within Kenanga Group;
• for the outsourcing of business and back room operations of Kenanga Group;
• for the transfer, storing and processing of your Personal Data to a cloud service provider whether within Malaysia or outside Malaysia in order to carry out any of the Purposes stated in this PDP Notice;
• to transfer your Personal Data to foreign jurisdictions to enable any cross border transactions, for the performance of a contract, for the purposes of legal proceedings, upon written request from a foreign regulatory or government authority or body, to protect your vital interest or where it is in the public interest to do so; and/or
• for any other purposes that is required or permitted by any law, regulation, order and/or guidelines.

The disclosure of your Personal Data may involve the transfer of your Personal Data to places outside of Malaysia, and by providing us your Personal Data, you agree to such a transfer where it is required to provide you the services you have requested, and for the performance of any contractual obligations you have with Kenanga Group including for storage purposes.

It is possible that in the future we could merge with, or be acquired by, another company. If such an acquisition occurs, you consent to the successor company having access to your Personal Data maintained by us, including account information, and such successor company would continue to be bound by this PDP Notice unless and until it is amended.

You may have provided personal and financial information relating to others (including but not limited to joint applicant, spouse, related parties and/or emergency contact persons) for the Purpose. In such cases, you represent and warrant that you have their consent or are otherwise entitled to provide their information to us to be used, processed and/or disclosed in accordance with this PDP Notice. Where your Personal Data has been provided to Bursa entity (which shall include Bursa Malaysia Berhad, Bursa Malaysia Securities Berhad, Bursa Malaysia Securities Clearing Sdn Bhd, Bursa Malaysia Depository Sdn Bhd, Bursa Malaysia Derivatives Clearing Berhad, and Bursa Malaysia Derivatives Berhad) (collectively, "Bursa") for any of the Purpose, including any legal and regulatory purposes, you hereby agree for the processing of your Personal Data by Bursa in accordance with the terms of the Bursa’s personal data notice as provided under www.bursamalaysia.com.

Marketing Communications

We may also use your Personal Data to market Kenanga Group’s products and services and to deliver targeted marketing and advertising, service updates, promotional offers and for the purposes of cross-selling within Kenanga Group. As such you may receive marketing communications from us or Kenanga Group for direct marketing and cross-selling marketing activities. For the purposes of direct marketing, your Personal Data would or may be disclosed to third parties which would include merchants and strategic business partners of Kenanga Group. You may tell us at any time if you do not wish to receive marketing communications from us by writing to the designated Data Officer, providing your full name, NRIC/Passport number (as applicable) and account details and details of any products or services you may have with us.

We may, from time to time, have information on third parties’ promotions, products and services which may be of interest to you. Unless you have opted to receive marketing materials in regards to third parties’ promotions, products and/or services by writing to us, you will not receive any marketing communications on such marketing materials. By agreeing to receive the marketing materials, you have consented to the disclosure of your Personal Data to any such third parties for marketing purposes as stipulated in this PDP Notice.

Access/Correct/Update to Information

You are entitled to review the Personal Data that we may have collected about you and request correction of the Personal Data. If there are any changes to your Personal Data or if you believe that the Personal Data we have about you is inaccurate, incomplete, misleading or not up-to-date, please write to our Data Officer setting out the details of your request and your name and NRIC/Passport number, or you may make a request to us via our Data Access/Update/Correction Request Form. A fee may be charged for this service. We shall correct or update the information/data as soon as possible. The Data Officer may request information or documents from you to verify the authenticity of the person making the request and any information relating to the corrections requested.

Erasure and Restriction of processing

We allow you the opportunity to remove yourself and any information about you (save for information which is necessarily retained by us to comply with legal or regulatory requirements, storage purposes, or if there are valid grounds under the law to do so, such as legal claims etc.) from our database or require us to cease processing all or part of your Personal Data by submitting a written notification addressed to our Data Officer. We will require a reasonable amount of time to process such notices. Please note that after deleting your Personal Data, we may not be able to provide the same level of servicing to you as we will not be aware of your preferences.

We reserves the right to take the necessary actions if we feel that such removal or cessation would not allow us to provide our products and services or fulfill our obligations in a satisfactory manner. This includes our entitlement to refuse to provide or cease providing any facilities, products or our services to you.

Where you have requested that we erase your Personal Data that we have made public and there are valid grounds for erasure, we will use reasonable and cost effective steps to inform others that are displaying your Personal Data or providing links to the Personal Data to erase your Personal Data too.

Portability

You have the right to receive your Personal Data which you have provided to us in a structured, commonly used and machine-readable format and a right to request that we transfer such Personal Data to another party.

If you wish for us to transfer the Personal Data to another party, we can only do so where it is technically feasible. We are not responsible for the security of the Personal Data or its processing once received by the third party. We also may not provide you with certain Personal Data if providing it would interfere with another person’s rights (e.g. where providing the Personal Data we hold about you would reveal information about another person).

Profiling

We process some of your data automatically, with the goal of assessing certain personal aspects (profiling). For example we use profiling due to certain legal and regulatory requirements, to combat money laundering, terrorism financing, fraud, assessment of risk and offences that pose a danger to asset.

Enquiries and Complaints

You have the right to object at any time to the processing of your personal data for direct marketing purposes, and profiling to the extent related to direct marketing and to the extent permitted under the EU General Data Protection Regulations (GDPR), and to the processing of your personal data for the Purpose. Any queries, requests, concerns, complaints or exercise of your rights regarding the use of your Personal Data may be raised to the respective Data Officer below:-

In applying for, using or continuing to use our services, including any other contractual relationship which you may have with us, you shall be deemed to have accepted and consented to the terms of this PDP Notice. If you do not consent to the terms herein, kindly contact us at the abovementioned contact details.

E-Services

You hereby consent to the transmission by electronic means of your Personal Data through our E-Services, such consent shall be effective at all times that you access and/or use the E-Services.

Changes to the PDP Notice

Please note that we may update this PDP Notice from time to time via posting on our website. You are advised to periodically view our website for any updates or the most current version of our PDP Notice. Your continued usage of our services or continued relationship with us shall be deemed as acceptance of any updates, revisions or amendments made to our PDP Notice.

This PDP Notice was last updated in April 2021.

Language

This Notice is issued in both the English and Malay languages. In the event of any inconsistency between these two versions, the English version shall prevail.

Consent and Acknowledgement

By providing us with your Personal Data, you hereby consent to the use, processing, transfer and/or disclosure of your Personal Data in accordance with this PDP Notice.

If You Are a Corporation (Non-Individual)

In the event you have provided/disclosed Personal Data of individual third parties including but not limited to your directors, individual shareholders, employees, authorized signatories, agents, representative or otherwise, you hereby represent and warrant to us that you have the consent of such third parties and are entitled to provide their Personal Data to us to be used, processed and/or disclosed in accordance with this PDP Notice.