APPENDIX II

PRIVACY NOTICE

This Privacy Notice outlines how Etiqa collects, uses, maintains and processes your personal data and how Etiqa safeguards the personal data in line with the Personal Data Protection Act 2010 (“PDPA 2010”).

Etiqa or “We” in this Privacy Notice refers to Etiqa International Holdings Sdn Bhd including its branches in Malaysia and in other countries as well as its local and overseas subsidiaries or, as the context may require, any of them. This general notice has been expanded to incorporate Escapade programme (“the Programme”) and Escape (“the Space”). Escapade programme is a program launched by Etiqa to search for start-ups for collaboration. The objective of the program is to search for new technologies, services, products, channels or market that is able to disrupt the insurance experience or enhance the insurance eco-system. In these rules, “we”, “our” and “us” refer to Etiqa International Holdings Sdn Bhd (Company Number: 799412-T), a company incorporated in Malaysia under the Companies Act 1965 and deemed incorporated under the Companies Act 2016, and having its registered office at Level 19, Tower C, Dataran Maybank, No.1, Jalan Maarof, Bangsar, 59000 Kuala Lumpur (hereinafter referred to as “Etiqa”), the sponsor of the Programme. “You”, “Yourself” and “Programme Participants” refer to an eligible team or entrant.

YOUR CONSENT IS IMPORTANT

When you request information or you participate in any Etiqa sponsored events or sign up for our products and services or when you enter into any commercial transactions with Etiqa, you may be required to provide Etiqa with your personal data. In doing so, you consent to its use by Etiqa in accordance with this Privacy Notice.

Your personal data may have otherwise been provided to Etiqa by a third party (for example your spouse, a company in which you are a director, an officer or a shareholder, or a partnership in which you are a partner) for products or services that these third parties have sought from the Etiqa on pursuant to commercial transaction entered into with Etiqa. In this context, the term “you” or “your” in this Privacy Notice extends to any individual whose personal data has been provided to the Etiqa and/or has been collected in other circumstances as described in Section III of this Privacy Notice.

We may collect your sensitive personal data (including, data relating to your physical or mental health, the commission or alleged commission of offences etc.) in an event you proceed to advanced stages of the Programme which require you to disclose such sensitive personal data to us. We will only use your sensitive personal data for the purposes of the Programme. If we collect, use, maintain or disclose your sensitive personal data, we will ask for your explicit consent.

You have the choice, at any time, not to provide your personal data/sensitive personal data or to revoke your consent to Etiqa processing of your personal data/sensitive personal data. However, failure to provide such personal data/sensitive personal data or revocation of your consent to process personal data/sensitive personal data provided may impact your participation in the Programme or result in Etiqa being unable to provide you with effective and continuous support.

WHAT TYPES OF PERSONAL DATA DO WE COLLECT?

Personal data refers to any information that relates directly or indirectly to an individual, who is identified or identifiable from that information or from that and other information in the possession of Etiqa, including any sensitive personal data and expression of opinion, video recordings made through close circuit security surveillance cameras placed for security reasons and audio recordings about the individual.

The types of personal data we collect may include, but is not limited to your name, address, other contact details, age, occupation, marital status, financial information such as your income, or income tax particulars your identity card or passport and place of birth.

The personal data we collect can be either obligatory or voluntary. Obligatory personal data are those that we require for the purposes of the Programme and the Space. If you do not provide us with obligatory personal data, we would not be able to provide you with commitments outlined in the Programme and the Space. Voluntary personal data refers to type of data that are not mandatory in order to participate in the Programme. If you do not provide us with voluntary personal data, you may still sign up and participate in the Programme. Obligatory and voluntary personal data may differ at different stages of the Programme or the Space and will be indicated in the Terms & Conditions or addendums to the Terms & Conditions.

  1. For the purpose of the Programme, we would be obtaining your personal data by virtue of you participating and via all mandatory and voluntary information required from you at various stages of the Programme.
  2. For the purpose of the Space, we may obtain this information from yourself and from a variety of sources, including but not limited to:
    • information provided by you in application forms when signing the Membership Agreement;
    • taking part in Escape’s customer surveys and promotions;
    • verbal and written communications including notice board, social media, and shared internet access;
    • from the transactions you make and from the payments which are made to/from your account(s)/facility(ies);
    • from such other sources in respect of which you have given your consent to disclose information relating to you and/or where not otherwise restricted.
  3. Personal data we collect from our websites
    • IP Address
        An IP address is a number that is automatically assigned to your computer when you signed up with an internet service provider. When you visit our website, your IP address is automatically logged in our server. We use your IP address to help diagnose problems with our server, and to administer our website. From your IP address, we may identify the general geographic area from which you are accessing our website. Generally we do not link your IP address to anything that can enable us to identify you unless it is required by law and regulation.
    • Information on Cookies
        A cookie is an element of data that a website can send to your browser, which may then store it on your system. We use cookies in some of our pages to store visitors’ preferences and record session information. The information that we collect is then used to ensure a more personalised service level for our users. You can adjust settings on your browser so that you will be notified when you receive a cookie. Please refer to your browser documentation to check if cookies have been enabled on your computer or to request not to receive cookies.

WHAT IS THE PURPOSE OF PROCESSING YOUR PERSONAL DATA?

We may process your personal data for the following reasons:

  1. To assess your application for the Programme;
  2. To verify your credentials;
  3. To manage and maintain the processes related to the Programme;
  4. To evaluate your ideas/ propositions;
  5. For sharing within Etiqa for the purpose of analysis, review and recommendations;
  6. To respond to your enquiries and complaints and to resolve disputes;
  7. For internal functions such as evaluating the effectiveness of marketing, market research, statistical analysis and modelling, reporting, audit and risk management; and/or
  8. Other reasons not mentioned here.

In addition, we may also use your personal data for the fulfilment of any regulatory requirements and for any other reasons connected with your participation in the Programme.

From time to time, we may share your personal data with other entities within Etiqa, our agents or subject to your consent, strategic partners with whom we have a relationship with (“Other Entities”) as Etiqa deems fit and you may receive marketing communication from us or from these other entities about products and services that may be of interest to you. If you no longer wish to receive these marketing communications, please notify us to withdraw your consent and we will stop processing and sharing your personal data with these other entities for the purpose of sending you marketing communications.

You have a choice to withdraw your consent for receiving marketing or promotional materials/communication, you may contact us using the contact details found below. Please be aware that once we receive confirmation that you wish to withdraw your consent for marketing or promotional materials/communication, it may take up to fourteen (14) working days for your withdrawal to be reflected in our systems. Therefore, you may still receive marketing or promotional materials/communication during this period of time. Please note that even if you opt out from receiving marketing or promotional materials, Etiqa may still contact you for other purposes in relation to the accounts, facilities or services that you hold or have subscribed to with Etiqa.

TO WHOM DO WE DISCLOSE YOUR PERSONAL DATA?

Your personal data held by us shall be kept confidential. However, in order to provide you with effective and continuous products and services and subject at all times to any laws (including regulations, standards, guidelines and/or obligations) applicable to financial institutions, we may need to disclose your personal data to:

  1. Other Entities within Etiqa;
  2. Partners and key internal and external stakeholders with regards to the Programme;
  3. Strategic partners with whom we have a relationship with;
  4. Parties authorised and consented to, by you; and/or
  5. Enforcement regulatory and governmental agencies as permitted or required by law, authorised by any order of court or to meet obligations to regulatory authorities.

The disclosure of your data may involve the transfer of your personal data to places outside of Malaysia, and by providing us your personal data you agree to such a transfer where it is required to provide you the services you have requested, and for the performance of any contractual obligations you have with Etiqa including for storage purposes.

HOW DO WE PROTECT YOUR DATA?

The security of your personal data is our priority. Etiqa takes all physical, technical and organisational measures needed to ensure the security and confidentiality of personal data. If we disclose any of your personal data to our authorised agents or service providers, we will require them to appropriately safeguard the personal data provided to them.

HOW LONG MAY WE RETAIN YOUR PERSONAL DATA?

We will only retain your personal data for as long as necessary to fulfil the purpose(s) for which it was collected or to comply with legal, regulatory and internal requirements. Afterwards we will destruct or permanently delete your data.

CHANGES TO THIS PRIVACY NOTICE

Please note that we may update, revise, modify or amend this Privacy Notice from time to time. If there are material changes to this Privacy Notice, we will notify you by posting a notice of such changes on our website or by sending you a notification directly. We advise you to periodically review this Privacy Notice to stay informed on how we are protecting your information.

Your continued participation in the Programme is deemed to be an acceptance of such revisions, modifications or amendments.

This Privacy Notice was last updated in October 2019.

HOW CAN YOU ACCESS / CORRECT / UPDATE YOUR PERSONAL DATA?

We are committed to ensure that the personal data we hold about you is accurate, complete, not misleading and up-to-date. If there are any changes to your personal data or if you believe that the personal data we have about you is inaccurate, incomplete, misleading or not up-to-date, please contact us so that we may take steps to update your personal data.

You have the right to access your personal data. If you would like to request access to your personal data, please contact the organisers of the Programme by email at [email protected] or by registered mail to be addressed to us at Dataran Maybank, No 1, Jalan Maarof, Bangsar, 59000 Kuala Lumpur, Wilayah Persekutuan Kuala Lumpur.

If you have provided the Etiqa with personal data of a third party, please ensure that you have obtained the third party’s consent in relation to the processing and disclosure of their personal data and that this Privacy Notice is brought to the attention of any such third party.