This Personal Data Privacy Notice ("Notice") is issued pursuant to Personal Data Protection Act 2010 ("Act"). It explains the type of data ALRENTO SDN. BHD. and its subsidiaries ("the Group", "we", "us", or "our") may collect, use, disclose or otherwise process personal data of person in accordance with the applicable personal data law and regulations. This Privacy Notice applies to personal data in our possession or under our control, including personal data in the possession of organizations in which we have engaged to collect, use, disclose or otherwise process personal data for our purposes.

Definition

• "Customer" means an individual who (a) has contacted us through any means to find out more about any goods or services we provide, or (b) may, or has entered into a contract with us for the supply of any goods and services by us;

• "Business Associates" refers to the party who has or will have business dealings with the Group, including without limitation vendors, suppliers, agents, representatives, consultants, intermediaries, advisers, contractors, sub-contractors, joint venture partners, outsourcing providers, and all parties who act on behalf of the Group;

• "Personal Data" means any information in respect of commercial transactions, which— (a) is being processed wholly or partly by means of equipment operating automatically in response to instructions given for that purpose; (b) is recorded with the intention that it should wholly or partly be processed by means of such equipment; or (c) is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system, that relates directly or indirectly to a data subject, who is identified or identifiable from that information or from that and other information in the possession of a data user, including any sensitive personal data and expression of opinion about the data subject; but does not include any information that is processed for the purpose of a credit reporting business carried on by a credit reporting agency under the Credit Reporting Agencies Act 2010.

Collection of Personal Data

We generally do not collect your personal data unless (a) it is provided to us voluntarily by you directly or via a third party who has been duly authorised by you to disclose your personal data to us (your "authorised representative") after (i) you (or your authorised representative) have provided consent to the collection and usage of your personal data for those purposes, or (b) collection and use of your personal data without consent is permitted or required by the PDPA or other laws. We shall seek your consent before collecting any additional personal data and before using your personal data for a purpose which has not been notified to you (except where permitted or authorised by law).

Depending on the nature of your interaction with us, the Group may collect your personal data which range from:

• Contact information (e.g., name, postal, email address, social media handle, facsimile number, phone number)
• Demographic information such as gender, age, nationality, profession, date of birth
• National identifiers, such as Identity Card Number / Passport Number, tax number, and social security number to the extent permitted or required by applicable law or if necessary for the performance of contractual obligations.
• Payment information (e.g., bank account, debit or credit card numbers, payment service providers, payment service history)
• Financial information such as your income range and risk profile
• Details of dependents and/or family members
• Images and biometrics
• Information about your usage and interaction with our website.
• Consumer-generated content
• Photographs or Videos

The list above is not exhaustive and may include other Personal Data depending on the nature of our dealings with us. In addition to the above, the Group in accordance with applicable laws may also collect sensitive personal data that includes but not limited to: (i) physical and/or medical health; (ii) political opinions; (iii) information about his religious beliefs or other beliefs of similar nature; (iv) the commission or alleged commission of any offence or any other personal data as the Minister may determine by order published in the Gazette.

Personal Data of Children

We do not knowingly solicit or collect personal data from children below the age of 18. However, the Group may collect personal data about children below the age of 18 years of age from the parent or guardian directly, and with that person's explicit consent. In these situations, you confirm that they have appointed you to act for them and to consent on their behalf to processing their personal data in accordance with this privacy notice.

Sources of Personal Data

The Group generally collects personal data from individuals, including but not limited to our customers, business partners, contractors, vendors, suppliers, tenants, service providers, employees, and other individuals such as job applicants. We would only collect personal data that has been provided to us voluntarily by you or via your authorized representatives.

These personal data may be furnished to us from the following sources:

• Calls
• Websites: Consumer-directed websites operated by or for the Group, including sites that we operate under our own domains/URLs and mini-sites that the Group runs on third-party social networks such as Facebook or Instagram ("Websites")
• Mobile Sites/Apps: Consumer-directed mobile sites or applications operated by or for the Group, such as smartphone apps.
• Email, text, and other electronic messages: Interactions with electronic communications between you and the Group.
• The Group's Customer Service
• Offline Registration Forms. Printed or digital registration and similar forms that we collect via, for example, postal mail, in-store demos, point of sale, campaigns, contests, and events.
• Advertising Interactions. Interactions with our advertisements (e.g., if you interact with one of our third-party websites, we may receive information about that interaction).
• Data from other sources: Third-party social networks (e.g., such as Facebook, and Google), market research, the Group's promotional partners, and public sources.
• On-Ground Events: Any on-ground events, campaigns, or promotions organized by us.
• Consumer-generated content: Any content that you create and then share with the Group on third-party social networks or by uploading it to one of our websites and apps, including the use of third-party social networks apps such as Facebook, Instagram, TikTok or YouTube. Examples include photos, videos, personal stories, or other similar media or content. When permitted, we collect and publish consumer-generated content in connection with a variety of activities, including contests and other promotions, website community features, consumer engagement, and third-party social networking.

Purpose of Collection

The collection and processing of personal data include but are not limited to the following purposes:

• in connection with any particular service or product offered by us or our business associates.
• verifying your identity;
• to administer and carry out our customer and prospective customer relationship management procedures;
• to facilitate your participation in, and our administration of, any events including contests, promotions or campaigns;
• to process and/or follow-up payments made by you or on your behalf for the purchases and/or rental of our products and/or services;
• maintaining our records of our customers and prospective customers and our internal record keeping;
• conducting marketing, client profiling and business development activities as well as market research and statistical analysis and customer surveys regarding our projects, products and/or services;
• processing your application under any of our programmes;
• to share any of your Personal Data with our joint venture/business partners to jointly develop products and/or services or launch marketing campaigns;
• for internship/employment application and recruitment;
• for follow-up action regarding any complaint, feedback, query or request received;
• complying with any legal or regulatory requirements and to make the necessary disclosures under the requirements of any applicable law, regulation, direction, court order, by-law, guideline, circular and/or code which are applicable to us and for the prevention of crime;
• for detecting, investigating, preventing and reporting fraudulent, prohibited or illegal activities;
• for any other purposes for which you have provided the personal data;
• for any other incidental business purposes; and
• for other purposes required to operate, maintain and better manage our business and your relationship with us, which we notify you of at the time of obtaining your consent; and you agree and consent to us using and processing your Personal Data for the Purposes in the manner as identified in this Policy. If you do not consent to us processing your Personal Data for one or more of the Purposes, please notify us at the contact details as specified in the Contact Us section below.

The purposes listed in the above clauses may continue to apply even in situations where your relationship with us (for example, pursuant to a contract) has been terminated or altered in any way, for a reasonable period thereafter (including, where applicable, a period to enable us to enforce our rights under any contract with you).

Processing of Personal Data

Unless for business-related needs including but not limited to data backup, we generally do not transfer your personal data to other jurisdictions. However, if we do so, we will obtain your consent for the transfer to be made and we will take steps to ensure that your personal data continues to receive a standard of protection that is at least comparable to that provided under the applicable personal data protection laws and regulations.

In relation to sensitive personal data, the Group will only process such data where:

• Explicit consent to the processing of your sensitive personal data for specific purposes is given; or
• Such processing is legally required by, or necessary for the Group or for you to exercise rights under, employment and under other applicable law.

Disclosure of Personal Data

Generally, we will keep the personal data provided to us as confidential. Nevertheless, you consent to the following disclosures of the personal data by us to these classes of third parties.

• Our associated, subsidiary, and related companies of the Group;
• Our business partners include affiliates, retailers, distributors, agents, contractors and merchants that provide, supply, distribute or deal in general with our services or products in connection with our business;
• Our auditors, business consultants, accountants, lawyers, or other professional advisers and/or consultants as we deem necessary and appropriate.
• Our business associates or third-party service or product providers as we deem necessary or appropriate, including outsourced property management or marketing companies or entities.
• Any person to whom we are compelled to or required under law or in response to a local or state or federal authority, industry regulator, enforcement agency, statutory authority, the court of laws, tribunal, arbitration centre, commission or council or association legally authorized by law, as well as to any other third party pursuant to any court order.
• Credit reporting agencies. To the extent permitted by applicable law, credit reporting agencies and debt collectors are external companies that the Group use to help us to verify your creditworthiness (in particular for orders with invoice) or to collect outstanding invoices.
• Third-party companies using Personal Data for their own marketing purposes. Except in situations where you have given your consent, we do not license or sell your personal data to third-party companies for their own marketing purposes. Their identity will be disclosed at the time your consent is sought.

Extent of disclosure of personal data

Your personal data may be disclosed by the Group for any purpose other than the purpose listed above, only under the following circumstances:

• the data subject has given his consent to the disclosure;
• the disclosure —
  • is necessary for the purpose of preventing or detecting a crime, or for the purpose of investigations; or
  • was required or authorized by or under any law or by the order of a court;
• the data user acted in the reasonable belief that he had in law the right to disclose the personal data to the other person.
• the data user acted in the reasonable belief that he would have had the consent of the data subject if the data subject had known of the disclosing of the personal data and the circumstances of such disclosure; or
• the disclosure was justified as being in the public interest in circumstances as determined by the Minister.

Marketing

The information you provide to the Group, as well as information we collected about you indirectly, may be used by the Group for marketing purposes. The Group may extract, disclose and release the information in the possession of the Group relating to you as mentioned in this Privacy Notice.

Additionally, the individual entities within the Group may contact you about products, services and offers, which we believe may be of interest to you. Further, please also be informed that we will only disclose your personal data (which will not include information relating to your affairs or accounts) to third parties such as our business partners for marketing and promotional purposes where your express prior consent has been obtained and subject at all times to any laws (including regulations, guidelines and/or obligations) applicable to the Group.

You may inform us at any time if you do not wish to receive direct marketing communications from us by notifying us in the manner prescribed in the Contact Us section below or by the opt-out function on the email sent to you. Your latest written instruction to us will prevail.

Your Obligations

It is obligatory for you to supply your personal data to us in the most accurate manner. Failing which, we are unable to process your personal data on your behalf and for the Purpose stated herein and all relationships created or to be created between us shall then be terminated and ceased to be in effect immediately.

Security measures

The Group is committed to taking steps to protect the Personal Data you provide to us, including administrative, technical, and physical measures to safeguard your Personal Data against loss, theft, and misuse, as well as against unauthorized access, disclosure, usage, alteration, and destruction.

You should be aware, however, that no method of transmission over the internet or method of electronic storage is completely secure. While security cannot be guaranteed, we strive to protect the security of your personal data and are constantly reviewing and enhancing our information security measures.

Personal Data Retention Period

We may retain your personal data for as long as it is necessary to fulfil the purpose for which it was collected, or as required or permitted by applicable laws. We will cease to retain your personal data, or remove the means by which the data can be associated with you, as soon as it is reasonable to assume that such retention no longer serves the purpose for which the personal data was collected, is no longer necessary for legal or business purposes or consent is withdrawn by you.

Use of cookies

The Group uses cookies on our website to store information for your convenience, so you do not have to re-enter your data upon each visit. Cookies and other technology are also used to monitor the usage of the various features and services of our website, which over time give us information to improve our website and to advertise and market our products more effectively. When you visit our website, as with most all websites, we automatically log the domain name of where you came from, the Internet Protocol (IP) address your computer is currently using, the type of web browsers that you use, Internet service provider (ISP), referring and exit pages, operating system, date/time stamp, and clickstream data.

This information allows us to operate the website by serving the pages you visit, and we may use the information for statistical purposes and to track usage patterns. In addition, we use the data we collect to make various determinations in our systems. We may also use this information to personally identify you, the user, and/or the user's organization, for reporting purposes and/or to serve relevant information to you during future browsing sessions.

We treat information collected by cookies and other technologies as Non-Personal Data. However, to the extent that IP addresses or similar identifiers are considered Personal Data by local law, we also treat these identifiers as Personal Data. Similarly, to the extent that Non-Personal Data is combined with Personal Data, we treat the combined information as Personal Data for the purposes of this Privacy Policy.

Links to Other Sites

Links to other sites are provided for your convenience and information. These sites may have their own privacy statement in place, which we recommend you review if you visit any linked websites. We are not responsible for the content of the linked sites or any use of the site. The Group's Privacy Policy applies solely to the information collected by us.

Your Rights

Right to request access to personal data

You are entitled to request access to your personal data that is processed by us with reasonable notice. This can be done by you making a written application to us requesting such information. Upon request and within a reasonable timeframe of receiving your request in writing, the Group will provide you with the requested information. The Group reserves the right to charge a fee (representing our costs in administering your request) for supplying such information. We will inform you of the fee before processing your request.

Right to request correction of personal data

You are entitled to request the correction of your personal data, which is inaccurate, incomplete or out-of-date, collected and held by us with reasonable notice. The Group will also, where you have requested that we correct an error or omission in the personal data about you that is under our possession or control, correct such data as soon as practicable and send the correct personal data to every organisation to which the personal data was sent within a year before your request was made.

Right to limit/withdraw consent of the processing of your personal data

Whilst we respect your decision to withdraw your consent, please note that depending on the nature and scope of your request, we may not be in a position to continue providing our goods or services to you, and we shall, in such circumstances, notify you before completing the processing of your request. Should you decide to cancel your withdrawal of consent, please inform us in writing in the manner prescribed in the Contact Us section below.

Please note that withdrawing consent does not affect our right to continue to collect, use and disclose personal data where such collection, use and disclosure without consent is permitted or required under applicable laws.

Right to prevent processing for direct marketing purposes

You are entitled to limit our processing of your personal data by expressly withdrawing in full, your consent given previously, in each case, including for direct marketing purposes subject to any applicable legal restrictions, contractual conditions, and within a reasonable time period.

Contact Us

If you intend to exercise your rights or to make inquiries or complaints regarding your personal data, our policies, or procedures in relation to processing your personal data, you may contact the relevant department as follows:

Third-Party Consent

In some circumstances, you may have provided personal data relating to other individuals (such as your spouse, family members, emergency contact person, contractors, lawyers, financiers, or other third-party including minors). You represent and warrant that you are authorized to provide their personal data to us, and you have obtained their consent to the processing (including disclosure and transfer) of their Personal Data in accordance with this Personal Data Privacy Notice.

Conflict

In accordance with Section 7(3) of the PDPA, this Personal Data Privacy Notice is issued in both English and Bahasa Malaysia. In the event of any inconsistencies or discrepancies between the English version and the Bahasa Malaysia version, the English version shall prevail.

Changes in this Policy

This notice applies in conjunction with any other notices, contractual clauses and consent clauses that apply in relation to the collection, use or disclosure of your personal data by us.

From time to time, we may elect to modify or update our privacy policy. You may determine if any such revision has taken place by reflecting to the date on which this Notice was last updated. Your continued use of our services constitutes your acknowledgement and acceptance of such changes.

Last updated: 24 March 2023