What You Need to Know About Your Personal Data Protection and Privacy

1. Introduction
This notice is issued in accordance with the Personal Data Protection Act 2010 (Act 709), as amended by the Personal Data Protection (Amendment) Act 2024 (together, the “PDPA”). It applies to clients, prospective clients, investors and other individuals whose personal data is processed by Redvest, whether that data was collected before or after the date of this notice.

Redvest Wealth & Asset Management Sdn Bhd (“Redvest”, “we”, “us” or “our”), together with its subsidiaries and related corporations, acts as a data controller under the PDPA. Redvest holds Capital Markets Services Licence eCMSL/A0375/2021 issued by the Securities Commission Malaysia and is licensed to carry on the regulated activities of fund management and financial planning. We are committed to protecting the personal data entrusted to us, and this notice sets out how we collect, use, disclose, retain and safeguard that data.

All personal data, including sensitive personal data, is treated as confidential and is processed only with your consent or where the PDPA otherwise permits or requires. We will not disclose your personal data except in the following circumstances:

(a) where you have given your consent to the disclosure;
(b) where the disclosure is necessary for the purpose of preventing or detecting an offence, or for the purpose of an investigation;
(c) where the disclosure is required or authorised by or under any law, or by the order of a court;
(d) where we act in the reasonable belief that we have the legal right to disclose the personal data to the other party;
(e) where we act in the reasonable belief that we would have obtained your consent had you known of the disclosure and the circumstances surrounding it;
(f) where the disclosure is justified as being in the public interest in circumstances determined by the Minister; or
(g) where the disclosure is required by any regulatory or self-regulatory body recognised by the Securities Commission Malaysia.

In this notice, “you” refers to a data subject, including a data subject below the age of eighteen, who has given or will give Redvest consent to process his or her personal data. The expressions “data subject”, “personal data”, “sensitive personal data” and “processing” carry the meanings given to them under the PDPA.

Redvest may revise this notice from time to time. You are therefore encouraged to review the current version each time you provide personal data to us. Any question concerning this notice may be directed to the contact details set out in section 12.

2. Personal Data We Collect
Depending on the products and services you take up with us, we may collect personal data including but not limited to the following:

(a) your full name, date of birth, identification or passport number, residential and correspondence address, nationality, marital status, contact number, email address, occupation and employer details;
(b) financial information, including income, source of wealth and source of funds, assets and liabilities, net worth, bank account details, tax residency status and existing insurance or investment holdings;
(c) information relating to your investment objectives, risk tolerance, investment experience and financial goals, which we require in order to assess suitability;
(d) personal data relating to your family members, dependants, nominees or beneficiaries, where you provide it to us for the purposes of a financial plan, a nomination or an account application; and
(f) any other information reasonably required to enable us to provide our products and services to you effectively.

Where you supply us with personal data relating to another individual, including a family member, nominee or beneficiary, you confirm that you have obtained that individual’s consent to the disclosure and to our processing of that data in accordance with this notice.

Unless we indicate otherwise, the personal data we request is mandatory. If you decline to provide it, or withdraw your permission for us to process it, we may be unable to open or maintain your account, provide the products or services you have requested, or keep you informed of matters relevant to your holdings. Redvest will not be liable for any consequence arising from that inability.

3. Sources of Personal Data
We collect personal data lawfully and fairly, from you directly and from other sources, including:

(a) information you provide, share or supply directly to us or to our staff and representatives, whether in person, in writing or electronically;
(b) account opening, registration, fact-finding and application forms, whether printed or electronic, made available on our website or by our staff;
(c) enquiries, telephone calls, emails, messages and other correspondence we receive from you;
(d) forms submitted through our website, including any enquiry or contact form;
(e) our appointed distributors, agents, introducers and referral partners, where you have been introduced to us through them; and
(f) publicly available sources, credit reference and screening databases, and regulatory or governmental registers, where we are required to verify your identity or conduct due diligence.

4. Purposes of Processing
We process your personal data for the following purposes, among others:

(a) to assess and process your application for our products and services, and to administer transactions including subscriptions, redemptions, switches, transfers and withdrawals;
(b) to prepare, deliver and review financial plans, portfolio recommendations and other advice, and to assess the suitability of a product or strategy for you;(c) to manage portfolios and mandates on your behalf and to carry out related dealing, settlement and reporting functions;
(d) to carry out client profiling and to market our products and services, whether existing or future, where you have not objected to receiving such communications;
(e) to comply with any legal or regulatory obligation applicable to us, including any law, regulation, direction, court order, by-law, guideline, circular or code, and to make any disclosure required under them;
(f) to conduct know-your-client, customer due diligence, sanctions and anti-money laundering and counter financing of terrorism screening, and to detect, prevent and investigate fraud, financial crime and other commercial risks;
(g) to organise and administer seminars, talks, workshops and events hosted by Redvest or our partners, including programmes delivered under our financial wellness initiatives;
(h) to provide administrative and management support in connection with your account, including responding to your enquiries and handling and resolving any complaint;
(i) to process payments and to maintain our internal accounting and record-keeping;
(j) to communicate with you as part of our ongoing client relationship, including sending statements, reports, notices and service updates; and
(k) any other purpose consistent with our business dealings and commercial practices with you as a client of Redvest.

5. Processing and Storage of Personal Data
We keep and process your personal data securely. We implement administrative, technical and physical safeguards designed to prevent unauthorised or unlawful processing of your personal data and to protect against its accidental loss, destruction or damage. We also maintain internal procedures for detecting, managing and reporting personal data breaches in accordance with the PDPA.

6. Disclosure of Personal Data
In the course of providing our products and services, we may disclose your personal data to the following parties where it is necessary to do so:

(a) our directors, officers, employees and licensed representatives, for purposes connected with your application and your use of our products and services;
(b) the trustees, custodians and their delegates appointed in respect of the funds and portfolios under our management;
(c) our related, associated and affiliated corporations;
(d) our appointed distributors, institutional unit trust advisers, corporate unit trust advisers and other authorised distribution partners;
(e) any person you have authorised to act on your behalf, including a person acting under a power of attorney;
(f) regulatory and supervisory bodies, including the Securities Commission Malaysia, Bank Negara Malaysia, Bursa Malaysia Securities Berhad, the Federation of Investment Managers Malaysia, the Securities Industry Dispute Resolution Center and the Inland Revenue Board of Malaysia;
(g) third party service providers, agents and vendors appointed by us, including fund administrators, registrars, information technology and cloud service providers, payment processors and screening service providers, subject to appropriate contractual and security controls;
(h) our auditors, consultants, accountants, legal advisers and other professional advisers; and
(i) any other person to whom disclosure is required by law, by regulatory requirement or pursuant to a court order.

Please note that any of the parties named above may be located outside Malaysia, and your personal data may accordingly be transferred to, stored in or processed in a jurisdiction outside Malaysia. Where this occurs, we take reasonable steps to ensure that the recipient affords your personal data a standard of protection comparable to that required under the PDPA.

7. Security Measures
The measures we take to protect your personal data include:

(a) physical and logical access control policies designed to preserve the confidentiality of your personal data;
(b) restricting access to personal records to authorised personnel only, and strictly on a need-to-know basis;
(c) retaining personal data in the manner required under the PDPA;
(d) training our staff on their obligations and prohibiting the misuse of personal data; and
(e) permitting only authorised third party service providers and vendors to access and operate the relevant systems.

You remain responsible for keeping any password or access credential to your account confidential and for not disclosing it to any other person, in order to reduce the risk of unauthorised access.

8. Data Breach Notification
Where a personal data breach occurs that is likely to cause significant harm, Redvest will notify the Personal Data Protection Commissioner and, where applicable, the affected individuals, in accordance with the PDPA and the Guideline on Data Breach Notification 2025.

9. Retention of Personal Data
We retain your personal data for as long as you remain our client and, following the end of that relationship, for a further period of seven years, or for such longer period as may be required under any applicable law, regulation or guideline, or as necessary for the establishment, exercise or defence of a legal claim. Once the applicable retention period has passed and no longer serves a lawful purpose, we will securely destroy or permanently delete the data.

10. Your Rights
Under the PDPA you have the following rights in relation to your personal data:
(a) Access. You may request details of, or a copy of, the personal data we hold about you. A prescribed fee may apply.
(b) Correction. You may request that we amend or correct your personal data where it is inaccurate, incomplete, misleading or out of date, by written notice or email to us.
(c) Withdrawal of marketing consent. You may ask us to stop sending you marketing, promotional or advertising material at any time.
(d) Withdrawal of consent to processing. You may withdraw your consent for us to process your personal data. Please note that doing so may prevent us from serving you effectively, including our inability to keep you informed of matters relevant to your holdings, and Redvest will not be liable for any consequence arising from that inability.
(e) Data portability. You may request that we transmit your personal data directly to another data controller of your choice, by written notice given electronically, provided that the transfer is technically feasible and the data formats are compatible.
(f) Limiting processing. You may request that we limit the processing of your personal data in the circumstances permitted under the PDPA.
We will respond to any request made under this section within the period prescribed by the PDPA.

11. Third Party Websites
Our website may contain links to sites operated by third parties. This notice does not apply to those sites, and Redvest does not control or accept responsibility for their content or their handling of personal data. You should review the privacy notice of any third party site before providing personal data to it.

12. Enquiries and Contact Details
Any query, concern or complaint relating to this notice or to the handling of your personal data may be addressed to:

Attention: Compliance Department
Redvest Wealth & Asset Management Sdn Bhd
Unit 2-2, Second Floor, Subplace Boulevard, Pusat Komersil Vestland, No.6, Jalan Juruanalisis U1/35, Seksyen U1, 40150 Shah Alam, Selangor
Telephone: +60355698519
Email: compliance@redvest.com.my