Privacy Policy

Introduction

Million Virtue Partners Sdn. Bhd. (“MVP”, “we”, “our”, or “us”) operates and owns the Credix Platform (“Platform”), a cloud‑based solution used by participating fund agencies to manage Corporate Social Responsibility (CSR) funds and programmes. This Privacy Policy explains how MVP collects, uses, discloses, and safeguards personal data when you interact with the Platform, whether you are an applicant, reviewer, fund‑agency staff member, donor, beneficiary, auditor, or public visitor.

We comply with the Personal Data Protection Act 2010 (PDPA), Malaysia and, where relevant, Islamic accounting standards such as the Piawaian Perakaunan Islam bagi Baitulmal, Zakat dan Wakaf (PPIBZW). By using the Platform, you acknowledge that your personal data will be processed in accordance with this Policy.

Relationship of the Parties

• MVP is the primary Data Controller for data collected through the Platform interface, analytics, and authentication services.
• Participating fund agencies act as Independent Data Controllers for the applicant and project data they access or upload.
• MVP acts as Data Processor for certain agencies‑provided data, pursuant to data‑sharing agreements.

Scope of This Policy

Who is covered?

• Individuals whose data is processed via the Platform, including applicants, beneficiaries, donors, agency employees, reviewers, approvers, auditors, and visitors.

What systems are covered?

• The production, staging, and backup environments of the Credix Platform hosted on MVP‑approved Malaysian cloud infrastructure and any future on‑prem deployments.

Personal Data We Collect

Depending on your role and interactions, we may process:

1. Identity & Contact Data – name, NRIC/passport, organisation registration number, postal address, email, phone.
2. Application & Project Data – CSR proposals, budgets, supporting files, beneficiary lists, milestone reports.
3. Financial Data – bank details, payment references, zakat calculations, disbursement schedules.
4. Technical & Usage Data – login credentials, role identifiers, IP address, device information, cookies, error logs.
5. Special Category Data – data revealing religious beliefs (e.g., zakat eligibility) or sensitive beneficiary information; processed only with explicit consent or another lawful basis.
6. Audio/Visual Data – photographs, video or voice recordings that you upload, webinar session recordings, or images captured during MVP‑hosted events.

How We Collect Data

• Directly from you via forms, file uploads, webinars, feedback features, or donor checkout.
• From fund agencies when they import, verify, or supplement information you supply.
• Automatically through cookies, analytics scripts, security logs, and similar technologies.
• From you about others – If you provide personal data relating to third parties, you represent that you have obtained their consent.

Consequences of Not Providing Personal Data

Where personal data requested by the Platform is marked as mandatory, failure to provide such information may result in:

• Inability to create or maintain your user account.
• Rejection or delay of CSR applications.
• Restriction of access to certain Platform features or agency services.

Optional data fields are clearly indicated; withholding optional data will not affect core functionality.

Purposes & Legal Bases for Processing

Automated assessments (e.g., AI‑generated risk scores) do not constitute final decisions; participating agencies retain discretion. You may request human review.

Cookies & Tracking Technologies

• Essential cookies for session management and CSRF protection.
• Analytics cookies (opt‑in) to measure feature adoption and usage trends.
• Security cookies to detect unusual login patterns.

You can manage cookies via your browser; disabling cookies may impair functionality.

Data Sharing & Disclosure

We never sell or rent personal data. We may share data:

1. With Participating Agencies – on a need‑to‑know basis.
2. Across Agencies (future capability) – only with explicit consent or legal authorisation.
3. Service Providers – cloud hosting, AI engines, payment gateways, ID‑verification vendors, bound by strict data‑processing agreements.
4. Regulators & Law Enforcement – when required under PDPA or other applicable laws.
5. Corporate Transactions – in connection with mergers or acquisitions, subject to PDPA safeguards.

International Data Transfers

All primary servers are located in Malaysia. If data must be transferred overseas, we ensure equivalent protection via contractual clauses compliant with PDPA Sections 129–133.

Data Security

• Encryption – TLS 1.3 in transit; AES‑256 at rest.
• Multi‑Factor Authentication (MFA) for privileged users.
• Role‑Based Access Control (RBAC) & least‑privilege principles.
• Continuous monitoring (SIEM), quarterly penetration tests, and vulnerability scans.
• Daily encrypted backups and disaster‑recovery drills targeting 99.9% availability.
• Immutable audit trails retained for at least seven (7) years.

Data Breach Notification

1. Contain & investigate the incident immediately upon discovery.
2. Notify the Personal Data Protection Commissioner (PDPC) and other relevant regulators within 72 hours where required by law.
3. Alert affected users without undue delay, describing the nature of the breach, potential impacts, and remedial steps.
4. Maintain detailed incident records for audit and continuous improvement.

Data Retention & Disposal

Data Accuracy & Integrity

MVP takes reasonable steps to ensure that personal data is accurate, complete, not misleading, and kept up‑to‑date in line with PDPA Principle 5. You are encouraged to review and update your information via your account dashboard at any time.

Your Rights under PDPA

You may, subject to exemptions:

1. Access your personal data.
2. Correct inaccurate or incomplete data.
3. Withdraw consent for non‑mandatory processing.
4. Object or restrict processing based on legitimate interests.
5. Request erasure when data is no longer needed or unlawfully processed.
6. Request human review of automated assessments.
7. Administrative fee – MVP reserves the right to charge a reasonable fee (currently RM 10) for each data‑access request, as permitted by PDPA Section 30(2).

Submit requests via the Platform or contact us. We will respond within 21 days.

Children & Vulnerable Individuals

If you submit data on behalf of minors or vulnerable groups, you confirm you have obtained the necessary guardian or legal authority. MVP applies additional safeguards, such as field‑level masking, for such data.

Third‑Party Links

The Platform may contain links or iFrames to external sites or agency portals. MVP is not responsible for their privacy practices. Please review their policies.

Accountability & Governance

• Annual privacy review & policy update overseen by the Data Protection Officer.
• Mandatory PDPA awareness training for all staff and contractors.
• Privacy Impact Assessments (“DPIAs”) for new or high‑risk features.
• Internal & external audits of privacy controls at least once every 12 months.
• Vendor due‑diligence programme ensuring processors meet our security and privacy standards.