Privacy Notice :

4. STEP BY STEP INVEST

PRIVACY POLICY

1. Introduction

1.1 We, Savwee Investment Research Sdn Bhd (Registration No.: 202101031667(1431967-T)[**]) (collectively referred to as “Savwee”, “Company”, “we”, “us”, or “our”) and other members of the Savwee Group (as defined below) value privacy and we are committed to protecting all personal data provided to us and processed by us, in accordance with the Personal Data Protection Act 2010 (as may be amended from time to time, hereinafter referred to as the “PDPA”). This Privacy Policy (“Privacy Policy”) is issued by Savwee with respect to the provision of Services by the Company and applies to all entities within the Savwee Group.

1.2 The Services, Platform and Applications (all, as defined here in below) are owned and operated by Savwee, where such expression shall, unless repugnant to the context thereof, be deemed to include its respective representatives, administrators, employees, directors, officers, agents and their successors and assigns.

1.3 For the purpose of this personal data policy, unless the context requires otherwise, the terms “personal data” and “processing” shall have the meaning prescribed in the PDPA.

1.4 This Privacy Policy describes our gathering, storing, dissemination and processing practices in respect of personal data of individuals through your use of or access to our Platform and all content, products, services, trainings and functionality available at or through the Platform.

1.5 Please read this Privacy Policy to understand how we use and process the personal data we have collected or may collect from you.

1.6 By accessing and using the Application and/or Platform, providing your personal data, applying for, registering and/or subscribing for any of our Services, you are deemed to have read and consented to be bound by this Privacy Policy and the collection, use, access, transfer, storage and processing of your personal data described in this Privacy Policy as may be modified or updated from time to time by us.

1.7 Any changes to this Privacy Policy will be updated to the Platform. Any such revised Privacy Policy will continue to apply to all personal data that has previously been collected as well as information that has been stored or processed on an ongoing basis by us. Therefore, you are encouraged to check our Platform on a regular basis for any updates or changes to the Privacy Policy.

1.8 If you are a firm, corporation or entity supplying personal data of your partners, directors, shareholders, employees, officers and/or other persons to us, please do ensure that you have obtained their consent and bring this Privacy Policy to their attention.

1.9 This Privacy Policy is issued in the English and Malay languages. In the event of any inconsistency between these two versions, the English version shall prevail.

2. Definitions

2.1 Application”

refers to any of our html-based / internet-based computer programs, smart phone, tablet or personal computer applications and all other software programs made available to

users by us.

2.2 CDS Account”

means a securities account established by the Central Depository for a depositor pursuant to the Securities Industry (Central Depositories) Act 1991.

2.3 Savwee Group”

includes Savwee (using whatever trading names as it considers appropriate for its business and marketing purposes) and any company which may from time to time be established and which may fall under the majority ownership and control of the officers of Savwee including the parent or holding company and any subsidiary, affiliate, associate company and any company which has a strategic or operational partnership agreement with the Company.

2.4 Platform”

means http://www.stepbystepinvest.com/ or such website or any other mobile application to provide Services, but does not include any website or mobile application owned or operated by a third party that may be accessed from any page on http://www.stepbystepinvest.com/ or mobile application[D1] .

2.5 Services”

means the account aggregation, portfolio visualization, advisory, analytics and reporting services and other services made available by the Savwee Group.

2.6 Subscriber”, “user” or “customer”

means the person who accesses, uses or subscribes to the Services, and, if authorized and applicable, the entity on whose behalf any person accesses, uses or subscribes to the Services.

2.7 You”

means the subscriber, user or customer. “Your”, capitalized or otherwise, has a corresponding meaning.

3. Privacy Policy Explanation

3.1 This Privacy Policy sets out what kind of personal data is being processed, including but not limited to:

the purposes for which the personal data is being or is to be collected and further processed;

the source of that personal data;

your right to request access and correction of your personal data and how to contact us with any inquiries or complaints in respect of the personal data;

the persons to whom we disclose or may disclose your personal data;

the choices and means that you may limit the processing of your personal data, including personal data relating to other persons who may be identified from that personal data;

whether it is obligatory or voluntary for you to supply the personal data; and

where it is obligatory for you to supply the personal data, the consequences to you if you fail to supply the personal data.

4. Types of Personal Data

4.1 Personal data refers to all information that relates directly or indirectly to you and/or your transactions with us, including any sensitive personal data and expression of opinion about you. Sensitive personal data refers to any personal data as to your physical or mental health or condition, your political opinions, your religious beliefs or other beliefs of a similar nature, the commission or alleged commission by you of any offence or any other personal data as may be determined by law from time to time.

4.2 The personal data collected by us may include but is not limited to the following:

A) Information you provide to us through using the Platform or through another remote channel or sent to us physically

Personal Information from you, such as your name, identification documents, profile picture, photos or avatar, gender, age, ethnicity, marital status, educational level, employment history, interests, hobbies, precise location-based information, e-mail and mailing addresses, credit and references check, income, CDS Account, phone numbers, device ID numbers and any other information you directly give us through the Platform and/or Application (including, but not limited to messages that you send through the Platform and/or Application) or when subscribing for any of our Services.

Your risk tolerance, risk appetite for investments, details of the stocks, securities, shares and instruments that you hold, whether publicly traded or otherwise.

Images, text messages, videos and voice recordings (if any) of our conversation with you through the Communication App (as defined below) or our Platform;

Information about the performance of your investment portfolio, including but without limitation to all trading activities in your CDS Account.

Information about your interactions on the Platform and/or Application including, your engagement with us for any Services.

Information necessary to carry out any activity or transaction with us, including your company name, company information, credit and references check, financial position where applicable.

Information such as files and messages that you store using the Platform and/or Application.

Billing and/or financial information such as your credit/debit card information and bank account details.

Information from written communications when you provide us feedback or contact us e.g. your name and e-mail address, as well as any other content included in the e-mail, in order to send you a reply.

B) Information collected by technology via the Platform and/or Application.

Information from you, including your web browser type, Internet Protocol (IP) address (a number that is automatically assigned to your computer when you use the Internet, which may vary from session to session), domain name, user profiles, and/or a date/time stamp for your visit, and, with respect to your mobile phone, the unique device identifier.

Information from third party service providers, with your consent, which may include your profile content or other types of personally identifiable information.

Cookies and URL information to gather information regarding the date and time of your visit and the information for which you searched and viewed. “Cookies” are small pieces of information that a website sends to your computer’s hard drive while you are viewing a website. We may use both session Cookies (which expire once you close your web browser) and persistent Cookies (which stay on your computer until you delete them) to provide you with a more personal and interactive experience on the Platform. Persistent Cookies can be removed by following web browser’s directions.

Information from corresponding technologies used in connection with mobile phones, including your device identifier, to record date, time, search and viewing information related to your mobile phone.

Information about how you use and interact with the Platform and the services via third party analytics services which may use Cookies to gather information such as the pages you visited, your IP address, a date/time stamp for your visit and the sites that redirected you to the Platform.

C) Information from third parties or other sources which you have given your consent to disclose information relating to you and/or where not otherwise restricted.

4.3 If need arises, we will obtain explicit consent from you to process sensitive personal data. We may however process personal data without your consent in limited circumstances as permitted by law.

5. Use of Personal Data

We may collect and process personal data from you or from the third parties, either to respond to requests that you make, or to aid us in serving you better, for one or more of the following purposes:

(a) to verify your identity;

(b) to process application for Services requested by you;

(c) to facilitate the creation of and secure your account opening with us;

(d) to provide you with the information and/or services you have requested from us;

(e) to send you a welcome e-mail and to verify ownership of the e-mail address provided when your account with us was created;

(f) to send you administrative e-mail notifications, such as security or support and maintenance advisories;

(g) carrying out our obligations arising from any contracts entered into between you and us

(h) to administer and manage our Services;

(i) to notify users about updates to our Services;

(j) to respond to your enquiries and complaints;

(k) to better understand your current and future investment needs and your financial situation;

(l) to produce data, reports and statistics;

(m) for purposes of including and removing you from all our social media and communication channels, including but not limited to WhatsApp, Telegram, Facebook and such other platforms and channels as we may our absolute discretion prescribe from time to time (collectively, “Communication Channels”);

(n) regulating and administering your conduct and communication in, to and through the Communication Channels;

(o) to conduct research for analytical purposes including but not limited to data mining and analysis of your transactions with us;

(p) to improve and customize the quality of experience when you interact on the Platform and/or Application;

(q) to provide you with information on and/or to market our products, services and offers which may be of interest to you;

(r) to help us develop our new products and/or services and improve our existing products and services;

(s) to track user-specific information on what pages users access or visit;

(t) for our day to day operations and administrative purposes including account management, billing and collection, audits, reporting and investigations;

(u) to transfer or assign our rights and duties under any agreement(s) with you;

(v) to collect any debt due or owing to us and enforce your obligations to us;

(w) to investigate, process and resolve any service issues, complaints, communications or other enquiries that you may submit to us;

(x) to maintain records required for security, claims or other legal purposes;

(y) to conduct anti-money laundering checks;

(z) to detect and prevent fraudulent activity;

(aa) to comply with legal and regulatory requirements for any other purposes that is required or permitted by any law, regulations, guidelines and/or relevant regulatory authorities;

(bb) to assess financial and insurance risks;

(cc) for security and internal audit purposes;

(dd) for such other purposes as may be directed or consented to by you; and

(ee) for all other purposes in relation to or incidental to the above.

6. Disclosure of Personal Data

6.1 We will process personal data for the purposes stated in Clause 4 above and may disclose to the following third parties:

(a) personnel, employees, agents, advisers, auditors, contractors and service providers to the extent reasonably necessary for the provision and maintenance of the Services or in connection with any of our operations;

(b) our subsidiaries and affiliates, including but not limited to the directors, officers, agents, dealers, brokers and representatives;

(c) any person, companies and/or organizations that assist us in processing and/or otherwise fulfilling transactions and providing you with Services that you have requested or subscribed for;

(d) companies, corporations and/or entities that act as our service providers, gateway providers, agents, contractors and/or professional advisers;

(e) any credit reporting agencies, credit information bureau, rating agencies, credit reference agencies, insurer provider or insurer broker, bank or financial institution and in the event of default, to debt collection agencies and/or other parties that assist with debt recovery functions;

(f) our auditors, legal advisors and compliance professionals;

(g) law enforcement agencies, government agencies and/or to detect, prevent, or otherwise address fraud, security or technical issues;

(h) our business partners and other parties for purposes that are related to the purpose of collecting and using your personal data set out in this Privacy Policy;

(i) any actual or proposed assignee or transferee of all or any part of our rights or obligations under any transaction between us and you; and/or

(j) we will also share your personal data with other parties, companies, organizations or individuals outside us when we obtain your consent to do so subject at all times to any laws (including regulations, guidelines and/or obligations) applicable to us.

6.2 We shall be entitled to retain all data and information supplied by you in compliance with this Privacy Policy and/or the terms and conditions of your agreements for the use and access of the Platform, Application and/or Services, for the duration of your relationship with us and for such period as may be necessary to protect our interests as may be deemed necessary, where otherwise required by the law or relevant regulation.

7. Security of personal data

7.1 We undertake to store, protect and process your personal data in a secure manner by maintaining physical, electronic and procedural safeguard in compliance with the PDPA. However, you agree and acknowledge that there is no data transmission over the internet can be guaranteed to be completely secure. Despite the foregoing commitment to you, we cannot guarantee or warrant the security of any information you transmit to us, or to or from our Platform and/or Application. All such transmission of information is carried out at your own risk. However, once we receive your transmission, we will make reasonable efforts to ensure its security in our systems.

8. Cookies

8.1 We use “cookies”, where a small data file is sent to your browser to store and track information about you when you enter the Platform. The cookie is used to track information such as the number of users and their frequency of use, profiles of users and their preferred sites. While this cookie can tell us when you enter the Platform and which pages you visit, it cannot read data off your hard disk.

8.2 We may process and/or otherwise use information collected from cookies and other technologies, to improve the user experience and the overall quality of the Platform. You may set your browser to block all cookies, including cookies associated with the services on the Platform, or to indicate when a cookie is being set by us. However, it is important to remember that many of the services on the Platform may not function properly if your cookies are disabled.

8.3 Like many web site operators, we also use the independent companies to measure and analyze the internet usage across the Platform and Application. This aggregate, non-personal data is collected by such independent companies provided to us to assist in analyzing the usage of the Platform.

8.4 We also collect Internet Protocol (IP) addresses. IP addresses are assigned to computers on the internet to uniquely identify them within the global network. We collect and manage IP addresses as part of the service of providing internet session management and for security purposes.

9. Request for Access and correction of personal data

9.1 You shall provide and maintain accurate, complete and current data required to register with us. You represent and warrant that all information furnished to us from time to time is correct, validly issued and legally binding on you.

9.2 You may request access to and correction of your personal data such as name, e-mail address, birthday, address and contact number by submitting a request to us via one of the following methods:

Contact No.: [ ]

Email address: [ ]

Office address: [ ]

9.3 We may request additional information and/or supporting documents from you before making the correction. We may withhold the correction request in such case where we are unable to confirm your identity. Upon receipt of your request and supporting documents for correction of your personal data, we will take reasonable steps to rectify the personal data which is inaccurate, incomplete and not up-to-date unless we consider there are justifications for refusing to comply with your request.

9.4 You will be liable for any loss that results from any failure to notify us of such a change as a result of undue delay, your gross negligence or fraud. Where you fail to inform of any change in its address, we shall be discharged from all liabilities upon sending of any notice or document to the last known address.

9.5 In the event you may need to provide us with personal data relating to third parties (e.g. spouse or where you are the designated person in charge from an organization or company) for dealing with us, if you are acquiring and are responsible for a service and/or product that they will use), you confirm that you have obtained their consent or otherwise entitled to provide their personal data to us and for us to use accordingly, and have informed them to read this Privacy Policy. It is our assumption that such information is accurate, up to date and complete.

We reserve the right at any time to satisfy ourselves as to your identity and personal details provided including for the purposes of preventing fraud and/or money laundering and pending verification, we may withhold your access to your personal data. In addition, at the time of your application or at any time in the future, you authorize us to perform identity verification checks directly or using relevant third parties.

We aim to maintain and protect the information from accidental or malicious destruction. Because of this, after you correct, change or update information, we may not immediately delete residual copies from our active servers and may not remove information from our systems.

10. Limiting Processing

10.1 Whenever we send you any information, we will include instructions on how to unsubscribe and a link to do so. If you do not wish to receive further information of a similar nature and/or any information of any kind from us at all, you may directly unsubscribe from this feature in the user settings.

10.2 Where indicated (e.g. on the Platform and/or Application, registration/application forms or any other documents furnished by us to you), it is obligatory to provide your personal data to us to enable us to process your application for our Services. Should you decline to provide such obligatory personal data, we may not be able to process your application or provide you with our Services.

11. Use of communication applications

11.1 We also use various social media and communication platforms, including but not limited to Zoom, Facebook, WhatsApp and/or Telegram (“Communication App”) as a channel for providing our Services to you.

11.2 Your use of the Communication App as a channel to communicate with us is done at your own discretion and risk. We thus assume no responsibility for any errors or omissions in the Communication App including but not limited to any issue arising from the Communication App’s end-to-end encryption system. Further, we shall be in no event be liable to you or any third parties for any special, punitive, incidental, indirect or consequential damages of any kind, or any damages whatsoever, including, without limitation, those resulting from loss of use, lost data or profits, or any liability, arising out of or in connection with your use of the Communication App.

12. Links to other applications and websites

12.1 Our Platform may contain links to another website(s) or applications operated by third parties (“Third Party Sites”). We do not control over the Third Party Sites and assumes no responsibility for their content or privacy policies and/or statements. Therefore, you should carefully review the privacy policy and/or statements and the terms and conditions that apply to any Third Party Sites you access from the Platform. You agree to waive any claim against us with respect to the Third Party Sites.

13. Transfer of your personal data outside Malaysia

13.1 It may be necessary for us to transfer your personal data outside Malaysia if any of our service providers or strategic partners (“overseas entities”) who are involved in providing part of our services are located in countries outside Malaysia or if you use the services from a country other than Malaysia. You consent to us transferring your personal data outside Malaysia in these instances. We shall take reasonable steps to ensure that any such overseas entities are contractually bound not to use your personal data for any reason other than to provide the services they are contracted by us to provide and to adequately safeguard your personal data.

14. Rights to make changes

14.1 We reserve the right at any time and at its sole discretion to revise, change, alter or vary the contents of the Platform and/or terms and conditions of use and/or the Privacy Policy as herein contained. The continued use of the Platform and/or our Services following any such revision, change, alteration of variation shall constitute the acceptance of, and agreement to be bound by such revision, changes, alteration and/or variation.

14.2 Should you have any query in relation to this Privacy Policy or how we handle your personal information, kindly contact us via one of the methods provided in Clause 9.2 above.