Privacy Policy

1. Data User

The data user responsible for your personal data is NOS Card Sdn Bhd. For privacy requests, email support@noscard.com.

2. Personal Data We Collect

Depending on how you use the Platform, we may collect:

• Identity data — display name, date of birth or age indicators, and account identifiers;
• Contact data — email address, phone number, and delivery addresses;
• KYC / verification data — documents or details reasonably required for withdrawals, fraud prevention, or legal compliance;
• Transaction data — wallet top-ups, purchases, sellbacks, withdrawals, vouchers, and delivery orders;
• Device and usage data — IP address, browser/device type, approximate location derived from IP, cookies, and interaction logs;
• Communications — messages you send to support (including via WhatsApp or email) and related metadata.

3. Purposes of Processing

We process personal data to:

• Create and manage accounts, authenticate users, and provide Platform features;
• Process payments, wallet balances, pack openings, vault actions, and deliveries;
• Prevent fraud, abuse, money laundering, and other unlawful activity;
• Comply with legal, regulatory, tax, and audit obligations;
• Send service notices, security alerts, and (where permitted) marketing communications;
• Analyse and improve Platform performance, odds transparency tooling, and user experience;
• Measure advertising effectiveness and show relevant ads on third-party platforms;
• Respond to support requests and resolve disputes.

4. Consent and Legal Basis

By registering for or using the Platform, you consent to the processing of your personal data for the purposes described in this Policy. Where PDPA or other law requires a different basis (for example, to perform a contract or to comply with a legal obligation), we rely on that basis.

You may withdraw consent for optional processing (such as marketing) by contacting support@noscard.com. Withdrawal does not affect processing that is necessary to operate your account or that we are required by law to continue.

5. Disclosure to Third Parties

We may disclose personal data to:

• Payment gateways and banking partners that process top-ups and withdrawals;
• Logistics and courier providers that fulfil physical deliveries;
• KYC / identity verification providers;
• Cloud hosting, email, analytics, advertising, and customer-support vendors acting on our instructions, including Meta Platforms, Inc. (Meta Pixel / advertising measurement);
• Professional advisers (legal, accounting, audit) under confidentiality;
• Authorities, courts, or regulators when required by law or to protect our rights.

We require service providers that process personal data on our behalf to implement appropriate security measures and to use the data only for agreed purposes.

6. Cross-Border Transfers

Some of our service providers may store or process data outside Malaysia. Where we transfer personal data outside Malaysia, we take steps consistent with the PDPA to ensure that the receiving party provides a standard of protection that is substantially similar to the PDPA, or that another lawful transfer mechanism applies.

7. Retention

We retain personal data only for as long as necessary to fulfil the purposes above, including to meet legal, accounting, dispute-resolution, and anti-fraud retention requirements. When data is no longer needed, we will delete or anonymise it where reasonably practicable.

8. Security

We implement reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or alteration. No method of transmission or storage is completely secure; you use the Platform at your own residual risk and should keep your credentials confidential.

9. Your Rights under the PDPA

Subject to exceptions under the PDPA, you may request to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete personal data;
• Withdraw consent to processing that relies on consent;
• Limit the processing of your personal data in certain circumstances.

To exercise these rights, email support@noscard.com with sufficient detail for us to verify your identity and locate the relevant records. We may charge a reasonable fee where the PDPA permits, and we will respond within the timeframes required by law.

10. Age Restriction (18+)

The Platform is intended solely for users aged eighteen (18) and above. We do not knowingly collect personal data from anyone under eighteen. If you believe we have collected such data, contact support@noscard.com and we will take appropriate steps to delete it.

11. Cookies and Similar Technologies

We use cookies and similar technologies for authentication, security, preferences, analytics, and advertising measurement. Third parties such as the Meta Pixel may set cookies to measure campaigns and show relevant ads. You can control cookies through your browser settings; disabling certain cookies may limit Platform functionality.

12. Third-Party Links

The Platform may link to our official social media accounts (WhatsApp, Instagram, Facebook) and to other third-party websites or apps (such as payment providers). Those services are hosted by third parties whose privacy practices are governed by their own policies. We are not responsible for the privacy practices of those platforms.

13. Changes to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date will change when we do. Continued use of the Platform after an update constitutes acceptance of the revised Policy, to the extent permitted by law.

14. Contact

For privacy questions or PDPA requests, contact NOS Card Sdn Bhd at support@noscard.com.