PDPA / Privacy Policy

1. Scope

Incard Marketing Sdn Bhd (941968-X) ("Incard", "we", "us", or "our") provides loyalty, membership, promotional, customer engagement, analytics, and integration services. This policy applies to users of our websites, online services, enquiry forms, and related business communications.

By providing personal data to us, using our websites, registering for our services, or continuing to communicate with us, you acknowledge that your personal data may be handled in accordance with this policy.

2. Personal Data We May Collect

Depending on your relationship with Incard, the personal data we may collect includes:

• Identity data such as name, identity document details, date of birth, gender, occupation, and membership information where relevant to the service.
• Contact data such as phone number, email address, postal address, business name, and company details.
• Profile data such as username, password, interests, preferences, feedback, survey responses, membership tier, and reward status.
• Account, transaction, and order data related to purchases, rewards, vouchers, redemptions, campaigns, and online services.
• Website and usage data such as pages visited, device/browser information, IP address, interaction logs, form submissions, and security or anti-spam verification data.
• Information submitted through the enquiry form on this website, including business name, work email, industry, and message.

You are responsible for ensuring that personal data provided to us is accurate, complete, and up to date.

3. Purpose Of Collection And Use

We may collect, store, use, and process personal data for purposes including:

• identifying and contacting you;
• responding to enquiries, requests, demonstrations, support matters, and business communications;
• processing membership registration, activation, validation, verification, rewards, redemptions, and account activities;
• operating websites, loyalty platforms, customer engagement tools, campaign systems, analytics dashboards, integrations, and related online services;
• improving customer service, product experience, campaign performance, reporting, security, and service reliability;
• preventing spam, abuse, fraud, security breaches, and unauthorized access;
• communicating updates, service notices, offers, promotions, or information that may be relevant to you where permitted by law; and
• complying with legal, regulatory, audit, dispute resolution, and business record requirements.

4. Disclosure And Sharing

We protect personal data in accordance with applicable law. Where necessary, we may disclose personal data on a need-to-know basis to:

• our directors, employees, officers, affiliates, professional advisors, and authorized representatives;
• strategic partners, agents, contractors, hosting providers, software providers, payment processors, analytics providers, communication providers, and other service providers engaged by us;
• Cloudflare or other security providers used for website protection, anti-spam checks, and bot prevention;
• governmental, public, regulatory, enforcement, or judicial authorities where required or permitted by law;
• business successors or related parties in the event of restructuring, merger, acquisition, or transfer of business; and
• any other party where you have given consent or where disclosure is permitted by law.

We do not sell personal data for commercial gain.

5. Security

Incard is committed to keeping personal data confidential, safe, and secure. We use reasonable administrative, technical, and operational safeguards to prevent unauthorized access, loss, misuse, alteration, or disclosure of personal data.

However, transmission of information through the internet is not completely secure. You should take reasonable steps to protect your account information, passwords, and devices, and notify us promptly if you believe any personal data provided to us has been lost, stolen, or used without authorization.

6. Storage And Retention

We retain personal data for as long as necessary to provide services, maintain business records, respond to enquiries, comply with legal obligations, resolve disputes, and protect our legitimate business interests.

Enquiry form submissions may be stored in our website database for follow-up and business record purposes. We may remove or anonymize data when it is no longer required, subject to legal, regulatory, contractual, and operational requirements.

7. Access, Correction, And Limitation

Subject to the PDPA and other applicable laws, you may request access to, correction of, or limitation of the processing of your personal data. Any limitation or refusal to provide required personal data may affect our ability to provide services to you.

We may request verification of your identity before processing such requests.

8. Cookies And Website Technologies

Our websites may use cookies and similar technologies to support website operation, security, preferences, analytics, and service improvement. Please refer to our Cookie Policy for further details.

9. Changes To This Policy

We reserve the right to amend this Privacy Policy whenever necessary. The latest version published on our website shall apply when you access our websites or use our online services.

10. Contact Us

If you have questions about this Privacy Policy or your personal data, please contact: