PRIVACY POLICY

INTRODUCTION

BLUE DUCK TECH SDN. BHD. (1298941-K) (“BLUEDUCK”, “we”, “us”, “our”) respects your privacy and is committed to protecting your personal information. We want to be transparent with you about how we collect and use your personal information.

This Privacy Notice (“Notice”) sets out our personal information processing practices, and your rights and options regarding the ways in which your personal information is collected (including through our website, www.blueduck.my (“Site”) and web portal (through which you sign up to our services)) and used in accordance with applicable data privacy law.

THIS NOTICE CONTAINS IMPORTANT INFORMATION ABOUT YOUR PERSONAL RIGHTS TO PRIVACY. PLEASE READ IT CAREFULLY TO UNDERSTAND HOW WE USE YOUR PERSONAL INFORMATION.

THE PROVISION OF YOUR PERSONAL INFORMATION TO US IS VOLUNTARY. HOWEVER, WITHOUT PROVIDING US WITH YOUR PERSONAL INFORMATION, YOUR USE OF OUR SERVICES OR YOUR INTERACTION WITH US MAY BE ADVERSELY IMPACTED. FOR EXAMPLE, YOU WOULD NOT BE ABLE TO RECEIVE OTHER CONTENT THAT MAY BE OF INTEREST AND RELEVANCE TO YOU.

1. When do we collect personal information about you

Before you read any further, it might be useful to explain what we mean by “personal information”. The relevant legal definition can be found here. In brief, it is information which relates to you and from which you can be identified, whether from that information alone; or from that information combined with other information. Note however that it does not include ‘anonymous data’ (i.e., information from which you cannot be identified, for example website usage statistics).

We collect personal information in the following ways:

A. When you give is to us directly and voluntarily

For example, personal information that you submit to us when you fill in forms on our website or web portal to use our BD Zero Deposit, registration service or referencing service, make a payment using BD Pay, subscribe to our services or marketing communications, request further services, enter a promotion, report a problem with our website, complete a survey, or communicate with us (by phone, email, in person or otherwise).

B. When you visit our website or use our web portal

When you visit or use our website or web portal, we automatically collect the following types of personal information:

technical information, including the internet protocol (IP) address used to connect your device to the internet, browser type and version, time zone setting, browser plug-in types and versions and operating systems and platforms; and
information about your visit to our website, including the uniform resource locator (URL) clickstream to, through and from the website (including date and time), services you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling and clicks) and methods used to browse away from the page).
We also collect and use your personal information by using cookies on our website. Please see our Cookie Notice for more information about how our use of cookies may involve using your personal information.

C. When we obtain it indirectly

We also collect your personal information from third party sources. For example, your personal information may be shared with us by our select business partners: property management company, property agencies and other related services. We may also obtain your personal information from publicly available third-party sources, such as social media accounts (depending on your privacy settings). To the extent we have not done so already, we will notify you when we receive personal information about you from such sources and tell you how and why we intend to use that personal information.

In general, we may combine your personal information from these different sources for the purposes set out in this Notice.

D. When it is publicly available

For example, if you interact with us on social media and depending on your privacy settings, certain information about your user account or profile (such as username, profile picture or other details in your profile).

2. What personal information do we use?

We may collect, store and otherwise process the following kinds of personal information:

your name and contact details (including emergency contacts) such as postal address, telephone number and email address;
date of birth, gender and nationality;
marital status and details of dependents;
your user account details, such as username and password;
your date of birth and gender;
your financial information, including, credit report, income level (requested, or calculated from level of rent) and information such as bank details and/or credit/debit card details, account holder name and account number;
information relevant to payment of tax;
information relevant to payment of utility bills;
information turned out by background searches which we are obliged by law to carry out;
information related to social media accounts or profiles;
transaction history and details between landlords and tenants;
information relevant to potential disputes between landlords and tenants;
information about your computer/mobile device and your visits to and use of our website, including, for example, your IP address and geographical location;
information about our services and products, or our selected partners’ services and products, which we consider may be of interest to you;
if applicable, your details as a landlord including property address(es), business or residential address;
if applicable, your details as a tenant including rent payment history, any previous damage to a property and how this was dealt with and past deadlines with landlords; and/or
any other personal information which you choose to share with us as per section 1.

3. Do we collect “sensitive personal data” ?

Applicable data privacy law recognises certain categories of personal information as sensitive and therefore requiring more protection, for example information about your health, ethnicity and religious beliefs. This is known as “sensitive personal data”.

Subject to section 40 of PDPA, we may collect and use such personal data. For example, we may need to deal with medical information in relation to landlords or tenants who could be regarded as vulnerable customers. We may also collect personal information about criminal offences (including alleged offences), for example if revealed via a background search or if committed / alleged to have been committed during the course of a tenancy.

4. How and why do we use your personal information?

We mainly collect and use personal information because we can’t perform our Services otherwise. In general, we use your personal information to achieve the purposes set out in this Notice. In particular:

to personalise, administer and manage your account and the web portal
to assess and process your application(s)/request(s) for our Services;
for the purposes of the Services such as providing, improving and developing the Services;
to verify your financial standing through credit reference checks
to assess financial and insurance risks;
to promote security of the Services;
to communicate with you including but not limited to sharing materials such as newsletters and articles, distribute information of events, conferences, talks and seminars which may be of interest to you;
to prevent fraud and/or misuse of Services;
to make any appropriate adjustments for vulnerable customers;
to provide such necessary information to any regulatory or governmental authorities as required by statutory, regulatory or governmental requirements;
to defend and/or enforce legal claims;
to conduct financial planning analysis and assessment to provide accurate, independent, customised and comprehensive plan to you;
to send important notices, push notifications on mobile devices, emails, letters, short messaging service (SMS) and WhatsApp messages, like communications about purchases and changes to our terms, conditions, and policies;
to share your Personal Data with our trusted business partners and agents for the purposes of (but not limited to) fulfillment of customer orders, processing and delivery of financial products to you; and/or
for any of the purposes relating to the above.

If you do not agree or consent to us collecting and processing your personal data for the purposes set out in this Privacy Policy, please notify us by contacting us via the contact details set out below.

5. Lawful basis for data processing

Data privacy law requires us to rely on one or more from a set of “lawful bases” to collect and use your personal information. In short, these are six reasons recognised by regulators as giving us lawful grounds to collect and use your personal information.

We consider the grounds listed below to be relevant:

Where you have provided your consent for us to use your personal information in a certain way (for example, we will ask for your consent to collect your personal information by using cookies or other tracking technologies, or to send you marketing material by email);
In order for us to comply with a legal obligation which is binding on us (for example, where we are obliged to share your personal information with regulatory bodies which govern our work and services);
Where necessary for the performance of obligations under a contract to which you are a party or to take steps at your request prior to entering a contract (for example, to collect a deposit or to provide a reference); or
Where there is a legitimate interest in us doing so.

Applicable data privacy law allows us to collect and use your personal information if it is reasonably necessary to achieve our, your or others’ legitimate interests (as long as that use is fair, balanced and does not unduly impact your rights).

In brief, “legitimate interests” is a broad concept and can potentially include any reasonable, legitimate and valid objective (whether commercial or otherwise). Our legitimate interests could, for example, include provision, promotion or improvement of our products and services.

When we process your personal information to achieve such legitimate interests, we consider and balance any potential impact on you (both positive and negative), and your rights under applicable data privacy law. We will not use your personal information for activities where our interests are overridden by the impact on you, such as where that use would be excessively intrusive (unless, for instance, we are otherwise required to or permitted to by law).

6. Disclosure of your personal data

We will never sell or rent personal information for marketing or any other purposes. However, we will share your personal information with selected third parties where required by law, where it is necessary to administer our working relationship with you or where we have another valid and lawful reason for doing so, including if you have given your consent.

Those selected third parties include:

sub-contractors for the performance of any contract we enter into with them, for example IT service providers such as website hosts or cloud storage providers, payment service providers, benefits service providers, credit rating companies or debt recovery service providers;
professional advisers or service providers, such as lawyers, accountants, auditors and insurers such as banks and insurance provider;
regulatory authorities, such as tax authorities, if our use of your personal information requires reporting in certain circumstances;
parties assisting us with research to monitor the impact/effectiveness of our work and services, for example analytics providers who help us evaluate your use of our website and web portal, provide reports on how the website is used and let us know which content is most popular. Please see our cookie notice for further information; and
parties relevant to any corporate transaction relevant to BLUEDUCK.

We may also need to disclose your personal information to third parties:

in the event that we sell or buy any business or assets, in which case we may disclose your personal information (solely as relevant to the transaction) to the (prospective) seller or buyer of such business or assets;
if substantially all of our assets are acquired by a third party, personal information held by us may be one of the transferred assets;
If we are under any legal or regulatory duty to do so; and/or
to protect the rights, property or safety of BLUEDUCK, its personnel, users, visitors or others.

Where appropriate, we require third parties to enter into contracts with us which place obligations on them to protect your personal information in line with our policies and procedures and our obligations under applicable data privacy law.

7. Data storing

We will only keep your data for as long as it is needed.

Data	Length of Time
Upon signing up for our Services	We will keep all information for 90 days after the date where the tenancy is supposed to begin. Data will be anonymised at this point.
Upon termination or expiration of our Services	We will keep all information, personal or otherwise, for seven years following the end of our Services including but not limited to non-continuation of the BD Zero Deposit Insurance Solution or BD Pay, end of your claims and recoveries process etc..

8. Transfer of data

We do not share with or transfer to third parties your Personal Data, except for circumstances where we have a good-faith belief that access, use, transfer or disclosure of such information is reasonably necessary or appropriate for the purposes of data storage or processing or providing any service or product on our behalf to you (including for the purposes set out in Clauses 4 and 6 above). We ensure that such information is provided to members of our Group companies and their affiliates and our trusted business partners and agents within or outside the country in which we or they are established, under conditions of confidentiality and similar levels of security safeguards.

9. Information collected by third parties

We, and third parties, may from time to time make software applications downloads available for your use on or through the Services. These applications may separately access, and allow a third party to view, your identifiable information, such as your name, your user ID, your computer's IP Address or other information such as any cookies that you may previously have installed or that were installed for you by a third party software application or website. Additionally, these applications may ask you to provide additional information directly to third parties. Third party products or services provided through these applications are not owned or controlled by BLUEDUCK. You are encouraged to read the terms and other policies published by such third parties on their websites or otherwise.

10. Disclaimer regarding security and third party sites / data center

We do not guarantee the security of personal data and/or other information that you provide on third party sites/ data center.

In an attempt to provide you with increased value, we may choose various third party websites to link to, and frame within our website. These linked sites have separate and independent privacy policies as well as security arrangements. Even if the third party is affiliated with us, we have no control over these linked sites, each of which has separate privacy and data collection practices independent of us. Data collected by our partners or third party web sites (even if offered on or through our Site) may not be received by us. We therefore have no responsibility or liability for the content, security arrangements (or lack thereof) and activities of these linked sites. These linked sites are only for your convenience and you therefore access them at your own risk. Nonetheless, we seek to protect the integrity of our Site and the links placed upon each of them and therefore welcome any feedback about these linked sites (including, without limitation, if a specific link does not work).

11. What If Personal Data Provided By You Is Incomplete?

Where indicated, it is obligatory to provide your personal data in a complete manner to enable us to process your application for our Services. Otherwise, we may not be able to process your application/request or provide you with our Services.

12. Your Rights To Access And Correct Your Personal Data

Subject always to the exceptions and restrictions as may be contained under the applicable laws, you may at anytime hereafter request for access to your personal data or request for correction of your personal data or limit the processing of your personal data by us. If you wish to do so or if you have any inquiries or complaints in respect of your personal data, please contact us via the following contact details:-

Email address: support@blueduck.my

Correspondence address: Menara IGB, Mid Valley City Suite 8.01, 8th Floor, 59200 Kuala Lumpur, Malaysia

Notwithstanding to the above, we reserve the right to refuse your request to access to or to make any correction to your personal data to the extent permitted under the applicable laws.

13. Revisions To Privacy Notice

We reserve the right to amend or modify this Privacy Policy from time to time by posting or displaying our notice of modifications through the Services, by updating the content herein or by any other means or methods as we shall deem appropriate without any prior notice to you. Modifications shall become effective immediately upon notice.

Updated Date: 25 April 2022