Privacy Notice

1. About this Notice

1.1 This Privacy Notice ("Notice") is issued by Platehaus Sdn. Bhd. (Registration No. 1646457-T) ("Platehaus", "we", "us" or "our") pursuant to section 7 of the Personal Data Protection Act 2010 of Malaysia (Act 709), as amended ("PDPA"). It explains how we collect, use, disclose, transfer, store and otherwise process personal data through the native.cards websites, business pages, member pages, dashboards, counter tools, Wallet Cards and related services (together, the "Platform").

"native.cards" is the name of the Platform and a brand of Platehaus. It is not a separate company. Where the Platform, a Wallet Card or a message refers to "native.cards", it refers to Platehaus, which is the legal person responsible under this Notice.

1.2 This Notice applies to you if you:

(a) visit native.cards or any page served under the native.cards domain, including a page of a business at its own native.cards web address;

(b) hold a native.cards account, or join, apply to join or are invited to a membership, loyalty, rewards, referral, identification, ticketing, travel, insurance or other card program (a "Program") that a business or organisation (a "Merchant") operates through the Platform;

(c) hold or are issued a digital card, pass, ticket or identification through the Platform, whether or not you save it to Apple Wallet or Google Wallet (a "Wallet Card");

(d) act for a Merchant, as its owner, applicant, administrator, team member or counter staff;

(e) interact with a Merchant's social media account, advertisement, review listing or other channel that the Merchant has connected to the Platform; or

(f) contact us for any reason.

1.3 Words in this Notice have the meanings given in the PDPA unless we say otherwise. "Personal data" means information that relates, directly or indirectly, to an individual who is identified or identifiable from that information, alone or together with other information in our possession. "Processing" covers collecting, recording, holding, storing, using, disclosing and erasing.

1.4 By using the Platform, by joining a Program, or by giving us personal data, you acknowledge that you have read this Notice. Where the PDPA requires your consent to the processing described here, you give that consent when you tick the relevant box, submit the relevant form, or continue to use the relevant feature after this Notice has been made available to you. You may withdraw consent at any time as set out in section 14.

2. Who is responsible for your personal data

2.1 There are two kinds of responsibility on native.cards, and it matters which one applies.

2.2 Where the Merchant is the data controller. When you join a Merchant's Program, hold one of its Wallet Cards, or are issued an identification, ticket, pass or policy card by it, that Merchant decides why and how your personal data is used for its Program. The Merchant is the data controller of that data. Platehaus processes it on the Merchant's behalf and on its instructions, as a data processor, under a written data processing agreement. The Merchant's own privacy notice, shown to you when you join or when the card is issued, governs that processing. Sections 4 to 13 of this Notice describe what the Platform does with such data so that you have a complete picture, but the Merchant remains answerable to you for it.

2.3 Where Platehaus is the data controller. We are the data controller of personal data that we process for our own purposes, namely:

(a) your native.cards account: your sign-in identity, your name where you give it, your email choices, any telephone number you verify for signing in with WhatsApp, and the features that belong to you rather than to any one Merchant (including your view of all your memberships and your Family Account);

(b) the accounts and details of Merchants' owners, applicants and team members;

(c) data that we process to keep the Platform secure, to prevent fraud and abuse, to review content, to enforce our terms and to meet our legal obligations;

(d) data about visitors to our own websites; and

(e) correspondence with us.

2.4 Other independent controllers. Apple and Google (when you save a Wallet Card to their wallets, or sign in using their accounts), and Meta, Google and other services that a Merchant connects (when data is shared with them as described in section 8), process personal data as controllers in their own right under their own privacy policies.

Meta also operates WhatsApp. Where you choose to sign in, or to verify a telephone number, with WhatsApp, Meta carries your messages to and from our WhatsApp number as our service provider. Your own use of WhatsApp remains subject to WhatsApp's terms and privacy policy.

Stripe takes payment of the fees that Merchants pay us. It receives a Merchant's billing details as our service provider, and the card details that the Merchant's representative enters on Stripe's own payment page, which do not pass through the Platform. Stripe also uses that data for its own purposes as a payment provider, such as preventing fraud and meeting its legal obligations, as a controller under its own privacy policy. Stripe receives no personal data about members.

2.5 Our contact details.

3. Personal data we process

The personal data processed depends on how you use the Platform. A Merchant chooses which details its Program asks for, so not every item below will apply to you.

3.1 Everyone who visits

(a) Technical data: internet protocol (IP) address, browser type and version, device type, operating system, language setting, the pages requested and the date and time of each request, as received by our hosting provider and recorded in server logs.

(b) Security data: the outcome of automated checks that distinguish people from automated software; counters used to limit repeated requests, which are derived from your IP address by a one-way function; and reports of errors that occur in your browser.

(c) Journey data: where you arrive by scanning a QR code or following a link, the code or link used, the Program and outlet you choose, the general type of device, and any campaign label attached to the link.

(d) Browser storage: cookies and similar storage described in our Cookie and Browser Storage Notice.

3.2 native.cards account holders

(a) Sign-in identity: your email address, if your account has one; the one-time codes we email you (we keep only a protected form of each code, with a general description of the browser and device and the approximate town or city from which it was requested, and the number of wrong tries, and delete these one (1) day after the code expires); where you choose to sign in with Google or Apple, the identity confirmed to us by that provider; where you start your account with WhatsApp, the telephone number you verified (section 3.2(e)), which is your account's sign-in identity and its only means of signing in until you add an email address; and, for Merchant accounts, a password (held only in protected, hashed form by our authentication provider) and any authenticator-app factor you enrol.

(b) Profile: your name, if you provide it, and your preferred language.

(c) Choices: which categories of email you have switched on or off.

(d) Session data: records of sign-in, including the devices on which your account is signed in, which you can see and sign out in your account, and the cookies that keep you signed in. So that WhatsApp sign-in can sign in a browser you have used before without an extra step, each browser on which you sign in keeps a cookie holding a random identifier, and we keep with your account a protected one-way value derived from it and when it was first and last used; we forget it after four hundred (400) days without use, when you sign out your other devices or use the “Not you? Sign out everywhere” link in a WhatsApp reply, and when you close your account. Where your account has no email address, each sign-in with WhatsApp uses a one-time code that our authentication provider passes to our database instead of sending it to you; it is used within seconds and is not kept. No text message is sent.

(e) Verified telephone number: where you choose to verify a telephone number by sending a message to our WhatsApp number: the number; a protected, one-way value derived from the identifier that WhatsApp gives your WhatsApp account for our business; when you verified the number and when you last used it to sign in; and, for each sign-in or verification that you start, a short-lived record of a protected form of the code shown to you, the web address and business page where you started, a general description of your browser and device and the approximate town or city it was in (as our hosting provider derives it from its internet address), whether that browser had signed in to your account before, the number you sent from and the outcome. We do not keep the text of your messages. A number verified in this way shows only that you could send and receive messages on that WhatsApp account at the time; it is not proof of your identity. Where WhatsApp tells us that your WhatsApp account has moved to a new number, the new number replaces the old one on your account, and in the records of Merchants with which you shared it, the next time you sign in with WhatsApp. Where your number is confirmed from a different WhatsApp account from the one that verified it (or, where your account has no email address, after a long period without a WhatsApp sign-in when the two cannot be compared), we treat the number as having passed to someone else: if that person takes it to an account, it is removed from yours and from the Merchants with which you shared it.

3.3 Members of a Merchant's Program

(a) Membership record: the name you give, your email address (if your account has one), a member number generated for you at that Merchant, your language, how and where you joined, your membership status, and the dates you joined and (where applicable) left. Where your account has no email address, the Merchant receives no contact details from your account; it holds your telephone number only if you give it under paragraph (b).

(b) Telephone number: where you give it on a form, where you give it to the Merchant's staff so that they can find your membership at the counter, or where you choose to share with the Merchant the telephone number verified on your native.cards account, in which case the Merchant's record shows that the number was verified and when you shared it. If you choose to share it while asking to join a Program whose Merchant reviews each request, your choice is held until the Merchant decides, and the number is shared only if the Merchant accepts you. A request to join from an account with no email address records when its telephone number was checked, not the number itself.

(c) Answers to the Merchant's questions: such further details as the Merchant asks for when you join, which may include a membership or booking reference, a vehicle registration number, a postcode, a date, or the Merchant's own questions.

(d) Program activity: points, stamps, rewards and benefits earned, held, used, expired and corrected; visits; purchases credited to you (amount, date, outlet and receipt or order reference); and the staff member and outlet that recorded each entry.

(e) Counter records: each time your Wallet Card is scanned or your membership is looked up, including the time, the outlet and the staff member, and security information used to detect misuse.

(f) Consents and acceptances: the version of the Merchant's Program terms and privacy notice that you accepted, when and through which form; and each choice you make about marketing, notifications and advertising, with its date.

(g) Communications: emails and Wallet Card notifications sent to you, with their delivery status, and, where your account has no email address, a record of each notice that was to be placed on your Wallet Card instead of being emailed (section 10.1) and what became of it.

(h) How you came to join: the QR code, link, campaign, referral or social media reply that led to your joining.

3.4 Holders of identification, tickets, passes and policy cards

(a) Card details: your name and such details as the issuing Merchant places on the card or its page, which, depending on the kind of card, may include your role, department, class or grade; a reference, staff, student, member, licence, permit or policy number; validity dates; an event, seat, journey or booking; an insured item, cover type and vehicle registration; and an emergency contact.

(b) Photograph: a portrait, where the Merchant issues a card that carries one.

(c) Details you complete yourself: where the Merchant asks you to complete set-up, the answers you give and the statements you confirm.

(d) Viewing records: each time the page for your identification is opened, we record the time, how it was reached, a general description of the device and browser, whether that device has opened the page before (using a random identifier stored in a cookie on that device), and what was displayed. We do not record the viewer's name, IP address or location in that record.

(e) Reports and requests: any report that a person submits about a card, and any request you make to correct it, with any contact details supplied.

(f) Card history: the issue, change, pause, reinstatement, replacement, use, admission and cancellation of your card.

3.5 Family Accounts and referrals

(a) Family Account: the name of the group, who created it, who its members are, each member's role and permissions, when each joined or left, the acceptance of the Family Account terms, and the benefits collected and used together. Members of a Family Account can see one another's names and the group's shared benefits.

(b) Invitations: where you invite someone by email, their email address (held in protected form and used only to send the invitation); where you invite someone by telephone number, a one-way protected form of the number, used only to show the invitation to the person whose account has that number verified when they sign in (nothing is sent to the number); where you share an invitation link, a record of the link and when it expires.

(c) Referrals: your invitation code and how many times it has been opened; who invited whom; the rewards earned from a referral; and indicators generated to detect misuse (see section 11).

3.6 Wallet Cards saved to Apple Wallet or Google Wallet

(a) Card identifiers: the serial number and identifiers of your card and its status.

(b) Device registration (Apple Wallet): an identifier of the Wallet library on your device and a push token, which we hold in encrypted form and use solely to tell your device that your card has been updated.

(c) Save and removal signals (Google Wallet): confirmation from Google that the card has been saved or removed.

(d) Diagnostics: technical messages that your device's Wallet sends when an update fails.

We do not receive your location from your device. Where a Wallet Card is set to appear when you are near an outlet, the outlet's location is placed on the card and your device does the matching; we are not told where you are.

3.7 Merchants' owners, applicants, team members and counter staff

(a) Business application: the applicant's name and sign-in email; the business's name, registration number, line of business, description, telephone number, website and social media name, support email, logo and brand colour; the address and contact details of its outlets; and the contact details to be shown on its Wallet Cards.

(b) Team: each person's role, status, outlet assignments, invitation and acceptance dates.

(c) Counter PIN: held only as a protected, one-way value, with a count of failed attempts.

(d) Activity records: an audit trail of actions taken in the Merchant's account and at the counter, including the person, time, outlet and reason given.

(e) Connected services: identifiers and access tokens (encrypted) for the third-party accounts a Merchant connects. Where a Merchant connects its Google Business Profile, these include the email address of the Google account used to connect it and, for each listing that account manages, the listing's name, address, Google Maps link and review link.

(f) Commercial records: where fees apply, the billing details given for invoices (company name, registration and SST numbers, billing email address and postal address), the plan chosen, invoices and payment status, and, as reported to us by Stripe, the brand, last four digits and expiry date of the payment card. We do not receive or hold the full card number.

3.8 People who are not members

(a) Invitees: where a Merchant invites you to a card, event or program, the name and the email address or telephone number that the Merchant enters for you and, for an identification card offered to you, the details, validity dates and photograph that the Merchant enters for the card, which become your card if you accept. Nothing is sent to a telephone number: the invitation is shown in the native.cards account on which that number is verified, when its holder signs in. These details are cleared when you accept (save for what becomes your card), when the invitation is withdrawn, or when it lapses.

(b) People who interact with a Merchant's connected social media account: where a Merchant has connected its Instagram or Facebook account and set up automatic replies, and you comment on its post, mention it, reply to its story or message it in a way that triggers a reply, we receive from Meta and record your platform user identifier, your username, the first part of your comment or message, and the post, story or advertisement concerned. We use this only to send the reply and to report results to the Merchant.

(c) Reviewers: where a Merchant has connected its Google Business Profile, we temporarily cache reviews of that business as published by Google, including the reviewer's displayed name and profile picture link, rating and comment, so that the Merchant can read and reply to them.

(d) Customers of a connected point-of-sale or online store: where a Merchant connects such a system, we receive order and receipt records from it, which may include a customer reference and email address, in order to credit purchases to the correct member. Where no member is matched, the order record is retained only as the Merchant's transaction record.

(e) Persons who contact us: your name, contact details and the content of your enquiry.

4. Sensitive personal data

4.1 We do not ask for sensitive personal data in order to operate a native.cards account or an ordinary membership or loyalty Program, and we ask you not to volunteer it in free-text fields.

4.2 Certain Programs, in particular identification cards, may by their nature carry sensitive personal data, where the issuing Merchant chooses to include it. Depending on the Merchant's design, this may include: information about physical or mental health or condition (for example blood type, allergies, medical conditions or medication on a staff, student, care or event identification); a belief or opinion that may be inferred from membership of, or office in, the body that issues a card; membership of a trade union; and a passport or similar official document number.

4.3 Where a Merchant includes sensitive personal data in a Program, the Merchant is the data controller of it and is responsible for obtaining your explicit consent, or for establishing another ground permitted by section 40 of the PDPA, before it is processed. We process it only as the Merchant's data processor, to display it on the page for your card to the audience the Merchant has selected.

4.4 A portrait on an identification card is used for visual recognition by a person. We do not use photographs for automated facial recognition and do not extract biometric templates from them.

5. Where personal data comes from

We obtain personal data:

(a) from you, when you create an account, join a Program, complete a form, respond to an invitation, use a Wallet Card, set your choices, or contact us;

(b) from the Merchant and its staff, when they enrol or invite you, issue a card to you, record a visit, purchase or redemption, or enter or correct your details;

(c) from your device and browser, automatically, when you use the Platform;

(d) from Apple and Google, when you save, update or remove a Wallet Card, or sign in using their accounts;

(e) from services that a Merchant connects, such as its point-of-sale or online store, Meta (Instagram and Facebook) and Google Business Profile;

(f) from other members, when they invite you to a Family Account (by your email address or telephone number) or refer you to a Program;

(g) from public sources, such as the records of the Companies Commission of Malaysia, when we verify a business;

(h) from Meta, when you message our WhatsApp number to sign in or to verify a telephone number (your number, the identifier that WhatsApp uses for your account with us, and the content of your message), and when WhatsApp tells us that your WhatsApp account has moved to a new number; and

(i) from Stripe, when a Merchant pays its fees (whether the payment succeeded, and the brand, last four digits and expiry date of the payment card).

6. Why personal data is processed

6.1 Purposes for which Platehaus processes personal data as data controller:

(a) to create, authenticate, secure and administer native.cards accounts, including sign-in with WhatsApp where you choose it;

(b) to show you your memberships and cards in one place, to operate Family Accounts and other features that belong to your account, and to give a Merchant the telephone number you verified when you choose to share it with that Merchant;

(c) to assess and decide business applications, verify Merchants, and provide the Platform to them;

(d) to send service communications, such as sign-in codes, confirmations, security alerts and notices required by law;

(e) to send you the categories of email you have chosen to receive;

(f) to protect the Platform and its users: detecting, preventing and investigating fraud, abuse, security incidents, unlawful content and breaches of our terms;

(g) to review Merchants' content before it reaches members, and to enforce our terms and policies;

(h) to measure, maintain, troubleshoot and improve the Platform, including by producing statistics that do not identify you;

(i) to respond to enquiries, requests and complaints;

(j) to bill and collect fees from Merchants and to keep business and accounting records;

(k) to establish, exercise or defend legal claims, and to comply with the law and with lawful requests of courts, regulators and law enforcement agencies; and

(l) to carry out a reorganisation, merger, sale or transfer of our business, subject to appropriate safeguards.

6.2 Purposes for which personal data is processed for a Merchant, as its data processor:

(a) to enrol you in the Merchant's Program and to record your acceptance of its terms and privacy notice;

(b) to create, deliver, update, expire and revoke your Wallet Card;

(c) to keep the record of your membership, balance, rewards, tickets, admissions and entitlements, and to let the Merchant's staff identify you and serve you at the counter;

(d) to send you service messages about your membership or card, such as a change in your balance or a reward that is ready;

(e) to send you offers and news from that Merchant, by email or through your Wallet Card, where you have agreed to receive them;

(f) to operate referrals and Family Accounts within the Merchant's Program;

(g) to credit purchases recorded by the Merchant's point-of-sale or online store;

(h) to give the Merchant reports and insights about its Program and its members;

(i) to display an identification, ticket, pass or policy card to you and to those permitted to view it, and to keep its viewing and history records;

(j) where you have separately agreed, to share information with advertising platforms chosen by the Merchant, as described in section 10; and

(k) to carry out the Merchant's other lawful instructions.

6.3 We do not sell personal data. We do not use the personal data of one Merchant's members to market another Merchant's goods or services to them, and we do not use it to market our own services to them.

7. Whether you must supply personal data

7.1 Obligatory. It is obligatory to supply: an email address, or a telephone number verified with WhatsApp, in order to hold a native.cards account or to join a Program (a Merchant's joining form asks for an email address only of members whose account has one); the details that a Merchant marks as required on its joining form, which may include a telephone number verified with WhatsApp and shared with that Merchant; and, for a Merchant, the information marked as required in the business application. If you do not supply obligatory data, we or the Merchant will be unable to create your account, enrol you, issue your card or approve the business, as the case may be.

7.2 Voluntary. All other personal data is voluntary, including optional answers, a telephone number where not marked as required (including a telephone number verified with WhatsApp), and your agreement to receive marketing or to share data with advertising platforms. Declining to supply voluntary data will not prevent you from joining a Program, though some features that depend on it may be unavailable.

7.3 Accuracy. You are responsible for ensuring that the personal data you supply is accurate, complete and not misleading, and for keeping it up to date.

7.4 Other people's personal data. If you give us personal data about another person (for example by inviting someone to a Family Account or, as a Merchant, by entering a person's details), you confirm that you have informed that person and are entitled to provide it.

8. Who personal data is disclosed to

Personal data is disclosed to the following classes of third parties, to the extent necessary for the purposes in section 6:

(a) The Merchant concerned and its authorised staff. A Merchant sees the personal data of its own members and card holders only. One Merchant cannot see your membership with another. Only some Merchants can receive the telephone number you verified on your native.cards account, and a Merchant receives it only if you share it with that Merchant. It no longer holds it once you stop sharing it or remove it from your account.

(b) Other members of your Family Account, who can see your name and the group's shared benefits; and a member who referred you, who can see your first name, the business you joined, that the referral was successful and the reward earned from it.

(c) Anyone to whom you show your card, or who opens the page for your identification, to the extent that the issuing Merchant has made its details public.

(d) Our service providers (sub-processors), who process personal data on our behalf under contract, for: cloud hosting and content delivery; database, authentication and file storage; email delivery; protection against automated abuse; domain name services; business email; payment of Merchants' fees (Stripe), which receives Merchants' billing details and no data about members; messaging for sign-in and telephone verification with WhatsApp (Meta, through the WhatsApp Business Platform); and, where enabled, automated review of Merchants' content. The current list is published in our Sub-processors page.

(e) Apple and Google, as providers of Apple Wallet and Google Wallet. When you choose to save a Wallet Card, the content of the card (which may include your name, photograph, member number, balance, a barcode or QR code, and other details shown on the card) is delivered to your device and to the wallet provider, and we exchange with the provider the signals needed to keep it updated. Their use of that data is governed by their own terms and privacy policies.

(f) Google and Apple, as sign-in providers, where you choose to sign in with an account you hold with them.

(g) Services connected by a Merchant, on the Merchant's instruction: point-of-sale and online store providers; Meta Platforms (for automatic replies on Instagram and Facebook, and, with your separate consent, for advertising as described in section 10); Google (for Google Business Profile); and automation or other systems nominated by the Merchant, which receive notice of events such as a join, a purchase or a reward used, identified by an internal reference and without your name or contact details.

(h) Professional advisers, auditors and insurers, under duties of confidence.

(i) Courts, regulators, law enforcement agencies and other public authorities, where we are required or authorised by law to disclose, or where disclosure is necessary to prevent or detect a crime, to establish, exercise or defend legal claims, or to protect the vital interests of any person.

(j) A successor or acquirer of all or part of our business, and its advisers, in connection with a reorganisation, merger, sale or transfer, subject to confidentiality and to this Notice.

9. Transfers outside Malaysia

9.1 The Platform is hosted in Singapore. Certain of our service providers, and the wallet, sign-in and connected services described in section 8, process personal data in other places, including the United States of America, member states of the European Economic Area and other countries in which they or their sub-contractors operate.

9.2 Purpose and recipients. Personal data is transferred outside Malaysia for the purposes in section 6, to the classes of recipient in section 8: our hosting, database, email, security and content-review providers; Stripe, for the payment of Merchants' fees; Meta, for messages to and from our WhatsApp number; Apple and Google; and the services a Merchant connects.

9.3 Basis. We transfer personal data outside Malaysia only as permitted by section 129 of the PDPA and the Commissioner's guidelines on cross-border transfer, namely where:

(a) we have assessed that the receiving place has in force a law substantially similar to the PDPA, or ensures an adequate level of protection at least equivalent to that afforded by the PDPA;

(b) we have taken all reasonable precautions and exercised all due diligence to ensure that the personal data will not be processed in a manner that would contravene the PDPA, by binding the recipient to contractual clauses that require protection equivalent to the PDPA; or

(c) you have consented to the transfer.

9.4 Your consent. By creating an account or joining a Program after this Notice has been made available to you, you consent to the transfer of your personal data outside Malaysia as described in this section. When you choose to save a Wallet Card to Apple Wallet or Google Wallet, or to sign in with a Google or Apple account, you direct us to send the personal data concerned to that provider. When you choose to sign in, or to verify a telephone number, with WhatsApp, you direct us to exchange messages with you through Meta, which processes them outside Malaysia.

10. Marketing, notifications and advertising

10.1 Service messages. We and the Merchant send messages that are necessary to operate your account, membership or card (for example a sign-in code, a join confirmation, a balance change or a reward that is ready). These are not marketing. Our replies to a WhatsApp message that you send us to sign in or to verify a telephone number are service messages. Verifying a telephone number or signing in with WhatsApp does not mean that you agree to receive marketing, and we do not send marketing by WhatsApp.

If your account has no email address, neither we nor the Merchant can email you. Where you have saved a Wallet Card for a membership, three service messages are shown on that card instead: that the Merchant is ending its Program, with the last day; that a reward is ready; and that a reward is about to end. No more than one such message is shown on a card in any twenty-four (24) hours, within the limits on Wallet Card notifications; a notice that a Program is ending waits until it can be shown rather than being dropped. Other messages that would be emailed are not sent to you.

10.2 Offers and news from a Merchant. A Merchant may send you offers and news, by email or through your Wallet Card, only if you have agreed to receive them from that Merchant. The choice is offered separately from the Merchant's terms, is not pre-selected, and is not a condition of joining. Notifications delivered through a Wallet Card relate to that Merchant's Program and are subject to limits on their frequency.

10.3 Changing your mind. You may withdraw your agreement at any time, without charge:

(a) on your membership page for that Merchant, under your notification choices;

(b) by using the unsubscribe link in any marketing email;

(c) by switching off notifications for the card in Apple Wallet or Google Wallet, or by removing the card; or

(d) by writing to the Merchant, or to us at admin@native.cards.

Withdrawal takes effect promptly; messages already in the course of delivery may still arrive.

10.4 Emails from native.cards. You can switch categories of email from native.cards on or off in your account settings.

10.5 Sharing with advertising platforms. Some Merchants use advertising platforms such as Meta (Facebook and Instagram) to measure their advertising and to reach people similar to their members. Where a Merchant has enabled this, you will be asked separately, by a box that is not pre-selected, whether you agree. Only if you agree, the following is sent to the platform on the Merchant's behalf: a one-way hashed form of your email address; a one-way hashed reference; the identifier of the advertisement you clicked, if any; your IP address and browser details at the time you joined; and the fact, time and (for purchases) value of events such as joining, making a purchase or using a reward. Hashed email addresses may also be added to that Merchant's advertising audience on the platform, which the platform may use to find similar people. You may withdraw this agreement at any time on your membership page; we will then stop sending events, delete the stored browser details and request your removal from the Merchant's audience.

10.6 No advertising trackers. The Platform does not place advertising or analytics cookies, pixels or similar trackers in your browser. See our Cookie and Browser Storage Notice.

11. Automated processing

11.1 The Platform applies rules automatically in the ordinary operation of a Program, for example to calculate points, to determine whether a reward is available, to select the members who meet a Merchant's criteria for a message, and to reject a scan that is expired or repeated.

11.2 To protect Programs against misuse, the Platform generates indicators automatically, for example where the person referring and the person referred appear to be the same (including where the same telephone number, verified or held by the Merchant, is found on both sides), where the Merchant already holds the referred person's number for another member, where that number recently moved from another native.cards account, or where an unusual number of people join through one invitation in a day. An indicator is presented to the Merchant or to us for review; it is not, of itself, a final decision about you.

11.3 We use automated tools, which may include artificial intelligence services supplied by third parties, to assist in reviewing content that Merchants submit (such as the wording of a notification or a reward) before it reaches members. Those tools read the Merchant's wording. They are not given members' records, and they do not make decisions about individual members.

11.4 We do not make decisions that produce legal or similarly significant effects on you solely by automated means. If you believe an automated outcome is wrong, contact the Merchant concerned or us and it will be reviewed by a person.

12. How long personal data is kept

12.1 Personal data is kept no longer than is necessary for the purposes for which it is processed, including to satisfy legal, accounting, tax and reporting requirements and to establish or defend legal claims. Thereafter it is deleted, destroyed or irreversibly anonymised.

12.2 The principal retention periods are as follows.

12.3 A longer period applies where we are required by law to retain personal data, or where it is needed for a dispute, investigation or legal proceeding that is in progress or reasonably anticipated.

12.4 Removing a Wallet Card from your device does not by itself close your membership or erase the Merchant's record. To close a membership, use the option on your membership page.

13. How personal data is protected

13.1 We take practical steps to protect personal data from loss, misuse, modification, unauthorised or accidental access or disclosure, alteration and destruction, in accordance with section 9 of the PDPA and the security standards issued under it. These include:

(a) encryption of data in transit;

(b) separation of each Merchant's data, enforced in the database, so that one Merchant cannot read another's;

(c) role-based access for Merchants' staff, limited by outlet, with a personal PIN for counter actions;

(d) two-step verification for our own administrators, for the owners and administrators of each Merchant, and for sensitive Merchant actions, and automatic sign-out of business pages left unused for thirty (30) days, or for twelve (12) hours where they were last used at the counter;

(e) additional encryption of especially sensitive items, such as card codes, device push tokens and the access tokens of connected services;

(f) protection against automated abuse, limits on repeated requests and on wrong sign-in codes, a WhatsApp message after each WhatsApp sign-in that names the device and its approximate location and lets you sign your account out on every device, an extra step before WhatsApp signs in a browser new to your account, a list of the devices on which your account is signed in, and controls on what content a page may load;

(g) private file storage, with files served only through access-controlled routes;

(h) audit records of administrative and counter actions; and

(i) contractual security and confidentiality obligations on our staff and service providers.

13.2 No method of transmission or storage is completely secure. You are responsible for keeping your devices, your email account, your WhatsApp account and any credentials secure, and for telling us promptly at admin@native.cards if you believe your account has been compromised.

13.3 If a personal data breach occurs that we are required to notify under the PDPA, we will notify the Personal Data Protection Commissioner and affected individuals in the manner and within the time required. Where we act as a Merchant's data processor, we will notify the Merchant so that it can meet its own obligations.

14. Your rights

14.1 Subject to the PDPA, you have the right to:

(a) request access to your personal data and be given a copy of it;

(b) request correction of personal data that is inaccurate, incomplete, misleading or not up to date;

(c) withdraw your consent, in whole or in part, to the processing of your personal data;

(d) limit the processing of your personal data, including personal data about other persons who may be identified from it;

(e) require us to cease or not to begin processing your personal data for direct marketing;

(f) require us to cease or not to begin processing that is causing or is likely to cause substantial damage or substantial distress to you or another person, where that damage or distress is unwarranted;

(g) request that your personal data be transmitted to another data controller of your choice, subject to technical feasibility and compatibility of data format, to the extent that the PDPA so provides; and

(h) complain to us and to the Personal Data Protection Commissioner.

14.2 Things you can do yourself. On the Platform you can: view your memberships, balances, history and cards; correct your name and certain other details; change your marketing, notification, email and advertising choices; verify, change or remove a telephone number for signing in with WhatsApp, and choose which Merchants receive it; see the devices on which your account is signed in and sign them out; add an email address to an account that you started with WhatsApp (until you do, that number cannot be removed); leave a Family Account; close a membership; and close your native.cards account.

A change that you make to a choice on the Platform, or by using an unsubscribe link, is treated as your written notice to us and to the Merchant concerned.

14.3 Making a request. For anything else, write to admin@native.cards, stating your name, the email address of your account (or, if it has none, the telephone number you sign in with), the Merchant concerned (if any) and what you are requesting. To protect your personal data, we will take reasonable steps to verify your identity, and where you act for another person, your authority, before acting.

14.4 Requests about a Merchant's Program. Where the Merchant is the data controller (section 2.2), the Merchant is responsible for answering your request. You may send it to the Merchant using the contact details in its privacy notice or on your card, or to us, in which case we will pass it to the Merchant and assist the Merchant to respond.

14.5 Timing and fees. We will respond to a data access or data correction request within twenty-one (21) days of receipt. If we cannot comply within that time, we will tell you why and will comply within a further fourteen (14) days, to the extent we are able. We may charge the fee prescribed under the PDPA for a data access request, and will tell you beforehand if we intend to do so.

14.6 Where we may refuse. We may refuse a request in the circumstances permitted by the PDPA, for example where we are not supplied with the information reasonably needed to identify you or to locate the data, where complying would disclose personal data of another person without that person's consent, or where the burden of providing access is disproportionate to the risk to your privacy. We will give you our reasons in writing.

14.7 Consequences of withdrawal. If you withdraw a consent that is necessary to operate your account, membership or card, we or the Merchant may be unable to continue to provide it, and it may be closed.

14.8 The Commissioner. You may lodge a complaint with the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi) at www.pdp.gov.my. We would welcome the opportunity to address your concern first.

15. Children and persons under 18

15.1 The Platform is not directed at children. A native.cards account may be opened only by a person aged eighteen (18) years or above. A person under eighteen (18) may join a Program or hold a card only with the consent of a parent, guardian or person who has parental responsibility for him or her, who should read this Notice and the Merchant's privacy notice on his or her behalf.

15.2 A Merchant that issues cards to persons under eighteen (18), for example a school, club or association, is responsible for obtaining that consent.

15.3 If you believe that we hold personal data of a person under eighteen (18) without the required consent, please contact admin@native.cards and we will take appropriate steps, which may include deleting it.

16. Third-party services and links

The Platform contains links to, and works with, services operated by others, including Apple Wallet, Google Wallet, WhatsApp, maps, social media and Merchants' own websites. This Notice does not apply to them. Please read their privacy policies.

Data received from Google APIs. When a Merchant connects its Google Business Profile, we use the data that Google provides (the account and listing details described in section 3.7(e) and the reviews described in section 3.8(c)) only to show the Merchant its listings and reviews, to publish the replies that the Merchant writes and to give the Merchant links for collecting reviews. We do not use it for advertising and do not sell it. We transfer it to others only to provide those features, to comply with law, or as part of a merger, acquisition or sale of assets, and our staff do not read it except with the Merchant's agreement, for security, or to comply with law. Reviews are refreshed daily and none is kept for more than 30 days; when the Merchant disconnects, the listings and reviews we hold are deleted. native.cards' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

17. Changes to this Notice

We may amend this Notice from time to time. The current version, with its version number and date, is published at https://native.cards/legal. Where a change materially affects how we process your personal data, we will give you reasonable notice by email, through the Platform, or both, before it takes effect, and will seek your consent where the PDPA requires it.

18. Language

This Notice is issued in the English language and the national language (Bahasa Malaysia), as required by the PDPA. In the event of any inconsistency between the two versions, the English version shall prevail.

19. Contact

Platehaus Sdn. Bhd. (Registration No. 1646457-T)

Attention: Data Protection Officer

CT-06-21 Subang Square Corporate Tower, Jalan SS15/4G, SS15, 47500 Subang Jaya, Selangor Darul Ehsan, Malaysia

Email: admin@native.cards

Telephone: +60 3 5614 0042