Privacy Notice

Introduction

In compliance with the Personal Data Protection Act 2010 (“the Act”) and its regulations this Privacy Notice (“Notice”) is issued to all our valued customers/participants. This Notice will inform you of your rights with regards to your personal data that has been and/or will be collected, used, disclosed, and/or processed by us.

By communicating, engaging, accessing, or using this website and/or platform (“Sites”) that we own or operate, or by registering yourself as a member of WellFam Club on our Sites, you are conclusively presumed to have notice of and you acknowledge that you agree to comply with and be bound by these conditions as amended from time to time. If you disagree with any part of these conditions, you must immediately discontinue your access or use of our Sites and cease participating in the Campaign.

Collection of Personal Data

We may need to and/or may be required to collect, record, hold, use, disclose, and store (“process”) your personal data to be used, disclosed, or otherwise processed by us and/or on your behalf in the course of your present or future dealings with Wellous Sdn. Bhd., its subsidiaries, its associated companies (“we”, “our”, “us” or “Company” collectively referred to as the Group). Your personal data enables us to achieve the “Purposes” herein that is in connection with our business.

When using third-party login, we rely on standard Open Auth 2.0 to collect information such as email, name, and open-id for authentication. This information will strictly be used for login purposes only and will not be used for advertising or any other purposes.

Description of Personal Data

“Personal Data” refers to any data and/or information about you from which you can be identified or identifiable either (a) from that data or (b) from that data and other information to which we may have legitimate access to. Examples of such personal data including but not limited to:

• Name, national registration identification card number, passport number, photograph, email address, postal address, age, telephone number, mobile number, employment details, bank account details, credit card details, payment details, marital status, gender, nationality, children’s details, personal interests, medical records, physical or mental health or condition, political opinions, religious beliefs or other beliefs of similar nature, commission or alleged commission of an offence.
• Information that you provide to us when using the Sites (including but not limited to our website) or joining the Campaign or that is generated in the course of the use of those services including the timing, frequency, and pattern of service use.
• Information relating to any purchases of our products and/or services or any other transactions.
• Such other information we may collect with your consent or as permitted and/or required by law.
• Sensitive personal data and expression of opinion about you but does not include any information that is processed for the purpose of a credit reporting business carried on by a credit reporting agency under the Credit Reporting Agencies Act 2010.

“Sensitive personal data” means any personal data consisting of information as to your physical or mental health or condition, your political opinions, your religious beliefs or other beliefs of a similar nature, the commission or alleged commission by you of any offence, or any other personal data as the Minister may determine by order published in the Gazette. We will not process your sensitive personal data unless you have given your “explicit consent” or where, for example, the processing is necessary for:

• the purpose of any legal proceedings; or
• the purpose of obtaining legal advice; or
• establishing, exercising, or defending our legal rights; or
• the administration of justice; or
• any other purposes, e.g. promotional campaign or sales event.

We may collect online use information when you visit our Sites or use our services. This information may include information about your internet service provider, your operating system, browser type, domain name, internet protocol (IP) address, your access times, the website that referred you to us, the web pages you request, and the date and time of those requests. Our collection of online use information may involve the use of cookies. We use cookies to store information about how you use our website in order to improve the quality of services provided to you. Cookies are small data text files that are sent from a server computer during a browsing session. Cookies are typically stored on the computer’s hard drive and are used by websites to simulate a continuous connection to the site. We may use both session cookies (which expire once you close your web browser) and persistent cookies (which stay on your computer and/or mobile device until you delete them) to provide you with a more personal and interactive experience on our Sites. Site areas are accessible only to the user when your browser accepts cookies. Our Sites use cookies to verify that you are properly signed in, to display information for your primary location, and to highlight your preferences, for example. We may also use cookies from time to time to measure your response to new aspects of our Sites and/or emails in an effort to continually improve our Sites and services’ usability. Please be aware that a cookie cannot spread computer viruses, retrieve any other data from your hard drive, or capture your email address.

You may erase or block cookies from your computer and/or mobile device if you wish to do so (your internet browser help screen or manual will thoroughly explain this process), but certain parts of our Sites may not work correctly or will not work at all if your browser is set not to accept Cookies. You acknowledge and agree that the Group does not control the transfer of data over telecommunication facilities, including the Internet. Therefore, we will not be responsible for any breach of security or the unauthorized disclosure or use of any such data on the Internet.

You have no obligation to provide any of the personal data requested by us. However, we may not be able to provide you with our services and/or products or transact with you in the absence of such data.

We do not intend to transact through the website directly with anyone we know to be under the age of 18. If you are under the age of 18, you should use the website only with the involvement of a parent or guardian and should not submit any personal data to us. By providing any personal data to us, you declare that you are over the age of 18.

Purposes for Collection and Use of Personal Data and Processing Thereof

Wellous Sdn. Bhd. is committed to protecting your Personal Data. Wellous Sdn. Bhd. takes reasonable steps to maintain appropriate physical, technical, and administrative security to help prevent loss, misuse, unauthorized access, disclosure, or modification of Personal Data. We will use your Personal Data for the following purposes including but not limited to:

• the registration as a member of WellFam Club;
• to create, manage, and maintain your account on our Sites;
• to assess and/or verify your creditworthiness;
• to provide care and enhance customer satisfaction including but not limited to resolving complaints, dealing with, and/or responding to requests and enquiries, warranty;
• to manage and maintain our relationship with you;
• to keep you informed of our products and/or services, promotions, discounts, and/or events;
• to analyse and enhance our marketing communications and strategies;
• to operate, evaluate, and improve our business and the products and services we offer;
• for internal record keeping or other administrative purposes;
• for statistical analysis purposes;
• for information management and security purposes, including but not limited to managing and administrating emails, handling and investigating any security-related issue, vulnerability, and/or incidents and queries submitted to us relating to our goods and/or services;
• (if no longer a member) where there are outstanding obligations either on your part or on our part;
• to exercise any functions conferred by law and/or towards the administration of justice and/or institution of legal proceedings;
• for and/or in connection with all other purposes incidental and/or ancillary to our business or in furtherance of any of the abovementioned purposes;
• to store, host, or back up (whether for disaster recovery or otherwise) your Personal Data or carry out data processing in accordance with the applicable laws or regulations whether within or outside Malaysia;
• facilitating, dealing with, and/or administering audit of the business of Wellous Sdn. Bhd. or that of its affiliates;
• contacting you or communicating with you via phone call, text message and/or fax message, email, and/or postal mail for the purposes of the delivery of products purchased, administering, and/or managing your use of our websites and/or account with us (where applicable);
• complying with or as required by any applicable law, court order, order of a regulatory body, governmental or regulatory obligations and requirements applicable to us and including meeting the requirements to make disclosure under the requirements of any law binding on us;
• facilitate your request that we contact you or to include you in our mailing list or when you use or sign up for our services;
• when you interact with our personnel;
• providing services to you as our account holder, as our customer;
• provide you with updates, news, promotional and marketing messages, and information in relation to our products and services; and
• for other purposes reasonably related to the above or required to operate, maintain, and manage our business and your relationship with us.

(Collectively referred to as "Purposes").

As the purposes for which we may/will collect, use, disclose, or process your personal data depend on the circumstances at hand, some purposes may not be stated above in certain unforeseen and/or unpredictable situations. However, we will notify you of such other purposes at the time of obtaining your consent unless processing of your Personal Data without your consent is permitted by the applicable Act or by law.

Sources of Personal Data

We may collect Personal Data:

• when you ask us about our services or otherwise communicate with us;
• when you register as a member of WellFam Club;
• when you enter into a contract with us;
• when you register an account with us;
• when you participate in our promotional events;
• from publicly available sources;
• when you access our Sites;
• when we provide any goods or services to you;
• when you provide us with any feedback, participate in surveys, and/or lodge a complaint with us; and/or
• where relevant, from third parties.

Disclosure of Personal Data

If and when necessary in connection with the above Purposes, your Personal Data may be disclosed and/or transferred to third parties which may or may not be located outside Malaysia to the extent as may be necessary for the purpose of or in connection with legal proceedings (including prospective legal proceedings) and/or otherwise necessary for the purposes of establishing, exercising, or defending legal rights including but not limited to:

• our affiliates;
• our employees, contractors, and other third-party service providers who provide services to Wellous Sdn. Bhd. or the Group for any of the Purposes contemplated in Paragraph 4;
• our external advisors, professional or otherwise, including solicitors, accountants, and auditors; and/or
• government or quasi-government and regulatory authorities.

In the event that we transfer your Personal Data outside of Malaysia, it will be done in accordance with the relevant provisions under laws and regulations. This includes taking appropriate steps to ascertain that the overseas recipient organization of the personal data is bound by legally enforceable obligations to provide to the transferred personal data a standard of protection that is at least comparable to the protection under the Act.

We will provide our preferred service providers with the information they need to perform their services and work with them to respect and protect your Personal Data. We require our service providers to adhere to strict privacy guidelines and not to use your Personal Data for any unauthorized purposes.

We will not disclose your Personal Data to third parties without first obtaining your consent permitting us to do so except as permitted or required by the law. However, please note that we may disclose your Personal Data to third parties without first obtaining your consent in certain situations including without limitation (i) in cases in which the disclosure is necessary for any investigations or proceedings or authorized based on the applicable laws and/or regulations including enquiries from governmental and regulatory agencies under proper authority; (ii) where such disclosure is permitted by the Act or by law.

Provision of Third-Party Personal Data By You

Should you provide the Group with personal data of individual(s) other than yourself, you represent and warrant to the Group and you hereby confirm that:

• prior to disclosing such Personal Data to us, you would have and had obtained consent from the individuals whose Personal Data are being disclosed to us to:
  • permit you to disclose the individuals’ Personal Data to the Group for the purposes; and
  • permit the Group to collect, use, disclose, and/or process the individuals’ Personal Data for the purposes as set out in paragraph 4 above;
• any Personal Data of individuals that you disclose to us is accurate; and
• you are validly acting on behalf of such individuals and that you have the authority of such individuals to provide their Personal Data to the Group and for the Group to collect, use, disclose, and process such Personal Data for the purposes.

Security of Personal Data

We take every measure to provide a comparable level of protection for Personal Data and we are committed to comply with the Act as well as corresponding guidelines and orders. Although we endeavour to maintain appropriate technical and organizational security measures to protect the security of your Personal Data against loss, misuse, unauthorized or accidental access, disclosure, or alteration or destruction, no electronic transmission of information can be entirely secure. We do not guarantee that the security measures we have in place are one hundred percent sufficient or effective to safeguard your Personal Data. You agree to assume all responsibilities and risks in your use of our Sites and acknowledge the existence of all such risks in using the internet generally. To further protect your Personal Data, you should safeguard your username and password (registered on our Sites) and not to share such information with anyone.

Retention of Personal Data

We will only retain your personal data for so long as we are either required or permitted to by law or as relevant for the purposes for which it was collected. We will also take reasonable measures such that your personal data in our possession or under our control is destroyed and/or anonymized as soon as it is reasonable to assume that the purposes for which that Personal Data was collected is no longer being served by the retention of such personal data and that retention is no longer necessary for any other legal, regulatory, or business purposes.

The Rights of Data Subject

A. Your Rights

You have the following rights regarding your personal data:

• The right to access – You have the right to request copies of your personal data.
• The right to rectification – You have the right to request that we correct any information you believe is inaccurate or incomplete.
• The right to erasure – You have the right to request that we delete your personal data under certain conditions.

You should ensure that all your Personal Data submitted to us is accurate, true, correct, and complete. Failure on your part to do so may result in our inability to provide you with product/services you have requested for.

B. How to Request Data Access and Correction

Submit your request formally through the contact details provided below. Ensure your request specifies whether you are seeking access to or correction of your Personal Data.

Our Response Time

We will respond to your request within a reasonable time frame.

Identity Verification

We may verify your identity before fulfilling your request to ensure the security of your data.

Fees and Estimates

A reasonable fee may be charged depending on the information requested.

You will receive a written estimate of the fee before we proceed with your request.

We are not required to respond to your access request unless you agree to pay the fee.

Processing Your Correction Request

Once we have sufficient information from you, we will address your correction request in compliance with the Act within 30 days.

If we are unable to make the correction within 30 days, we will notify you of the soonest practicable time when the correction can be made.

If you wish to request the deletion of your personal data, please follow the procedure below:

Contact Us

Send an email to [email protected] with the subject line “Data Deletion Request”.

Provide Information

Include the following information in your email:

• Your full name
• The email address associated with your account
• Your verified phone number
• Description of the data you wish to be deleted

Verification

We may need to verify your identity before processing your request to ensure that the request is legitimate.

Processing Time

We will acknowledge receipt of your request within a reasonable time. Once we have sufficient information from you, we will address your deletion request in compliance with the Act within 30 days.

If we are unable to make the correction within 30 days, we will notify you of the soonest practicable time when the deletion can be made.

D. To Limit Processing of Your Personal Data/Request to Withdraw Consent

You may limit the processing of your Personal Data and/or withdraw your consent for receiving marketing or promotional materials/communication from us. Please be aware that once we receive confirmation that you wish to withdraw your consent for marketing or promotional materials/communication, we will require some time to process your withdrawal request. During this period of time, you may still receive marketing or promotional materials/communication.

You may withdraw your consent for the collection, use, and/or disclosure of your personal data in our possession or under our control by submitting your request to us at [email protected]. We will process your request within a reasonable time from such a request for withdrawal of consent being made and will subsequently not collect, use, and/or disclose your Personal Data in the manner stated in your request unless the law or the Act allows us to. It is important to note that withdrawal of consent for us to collect, use, or disclose personal information including but not limited to your name, address, email, mailing address, and/or telephone contacts may render us being unable to continue providing the relevant services to you effectively.

Changes to Privacy Policy

We reserve the right to amend our Privacy Notice from time to time without prior notice. We advise that you check our website for our Privacy Notice on a regular basis. Any such update or revision will be effective immediately upon its release on our website.

Acknowledgement and Consent

If you would prefer that we do not collect Personal Data from you, please do not provide us with any such information or access our Sites. By visiting our Sites, providing Personal Data to us, or otherwise interacting with us, you shall be deemed to have read and consented to our processing of your Personal Data in the manner as described in this Privacy Notice. You are also aware that you may withdraw your consent to our processing for any of the above Purposes at any time by contacting us via the contact details provided in this Privacy Notice. If we do not receive any notification from you concerning our processing of your Personal Data, we shall proceed to continue to process the same for the Purposes as set out above on the basis that you have consented to our current as well as all our previous processing of your Personal Data in accordance with this Privacy Notice.

Enquiries or Complaints

Should you require further information, have any complaints regarding the processing of your Personal Data, or have any requests as prescribed above, kindly contact us at [email protected].

Effective Date

This policy is effective as of 16 May 2024.