# FASSET Privacy Policy
> How Fasset Labuan Limited collects, uses, stores and discloses your personal data, and the rights you have over it.
Canonical: https://fasset.com/business/legal/privacy/

Last updated: 21 October 2026

This Privacy Policy (the “Privacy Policy”) outlines how the Fasset Labuan Limited (referred to as “Fasset”, “we”, “us”, or “our”) uses, stores, and discloses your personal data and information (“Data”) when using our Platform. This Privacy Policy should be read together with, and forms part of, our User Agreement (the “Agreement”), which are available on the Platform. Unless otherwise defined herein, capitalised terms in this Policy have the meaning given to them in the Terms.

We recognise our responsibility to protect your Data by maintaining its confidentiality and are, therefore, committed to complying with the data protection laws applicable to us. Please read this Privacy Policy carefully so that you know and understand the purposes for which we collect, use, store and disclose your Data.

At Fasset, we respect your right to privacy. We have put in place security measures for your Data and manage them in accordance with data protection regulations applicable to us including the Personal Data Protection Act 2010 of Malaysia (“PDPA”). For Fasset Business, Fasset Labuan Limited is responsible for the personal Data it processes as controller to provide and administer its services. A provider that determines its own purposes for processing Data is responsible for that processing under its own privacy notice.

This Privacy Policy applies to your access and/or use of our platform, which includes (a) site made, owned, and operated by Fasset accessible through URL https://fasset.com, as well as its change from time to time; and/or (b) mobile apps made, owned, and operated by Fasset accessible in iOS and Android through application called ‘Fasset’ (the “Platform”). This includes the Fasset Business platform and the individuals whose Data is processed in connection with a business account, including beneficial owners, directors, representatives, authorised users, employees, cardholders and payment recipients. This Privacy Policy does not apply to job applicants, employees or contractors of Fasset, whose Data is subject to separate privacy notices.

By accessing, browsing, or using the Platform, interacting with us or providing your Data to us, and subject to your rights at law, you accept and agree to these terms which include sharing parts or all of your Data with third-party service providers. If you do not agree with any aspect of this Privacy Policy, you should immediately discontinue access or use of the Platform.

This Privacy Policy supplements but does not supersede or replace any other consents you may have previously provided to us in respect of your Data, and your consents herein are additional to any rights which the we may have at law to collect, use, or disclose your Data. This Privacy Policy only applies to Fasset and its affiliate entities. As a part of the use of the Platform, you may be required to contract with or interact with certain third-party service providers as specified in the Agreement. Each of these third-party service providers may have their own privacy policies applicable to you. We recommend reading those policies as well.

We may from time to time update this Privacy Policy to ensure that it is consistent with future developments, industry trends and/or any changes in legal or regulatory requirements. Subject to your rights at law, you agree to be bound by the prevailing terms of this Privacy Policy as updated from time to time. Please check back regularly for updated information on the handling of your Data.

In dealing with Fasset through the Platform, you may submit Data via forms, social media, email, chat, phone, electronic media, or any other means of communication deliberate or automatic; as part of the registration process; or for verification purposes. Notwithstanding all reasonable security measures taken, there are risks in sending information through the online forms, emails or other electronic means. It is your sole responsibility to assume all risk, should you decide to transmit Data over the internet. You must read the following information carefully before proceeding to access and/or use the Platform or the products and service available thereon, as this Privacy Policy governs the manner in which we collect, use and disseminate your information, including your Data.

Other privacy principles or policies could apply depending on how you interact with us, the products or services you may ultimately obtain from us, or the jurisdiction in which we are doing business with you.

Capitalized terms used in this Privacy Policy which are not otherwise defined herein shall have the meaning given to those terms in the Agreement.

1.Fasset views and handles your Data and privacy seriously. We will adjust this privacy policy as necessary in accordance with the relevant laws as may be amended from time to time.

2.You may have supplied and may continue from time to time, to supply Fasset with your Data in connection with the opening or continuation of your account in Platform (“Account”) and digital wallet in Platform (“Wallet”), the connection with or continuation of bank accounts or e-wallet to your Account, or provision of services or compliance with any laws, guidelines or requests issued by regulatory or other authorities. Fasset may also verify or source Data and personal information about you from third party sources (both public and private) such as your employers, regulatory or other authorities, banks and financial institutions, credit reporting agencies and insolvency/bankruptcy agency as well as from the public domain. Your visit to the Platform may be recorded for analysis on the number of visitors to the Platform and general usage patterns. Some of this information will be collected through the use of “cookies”. “Cookies” are small text files that are placed on your computer by websites that you visit, or certain emails you open and other similar technologies. Such technologies are widely used in order to make websites work, or work more efficiently, as well as to provide business and marketing information to the owners of the site, to gather such personal data as browser type and operating system, referring page, path through site, domain of ISP, etc. for the purpose of understanding how visitors use a website. Cookies and similar technologies help us tailor the Platform to your personal needs and helps to prevent fraudulent activity and improve security. If you do not wish to receive “cookies”, you can adjust your browser setting so that your device does not accept them. However, we recommend you enable “cookie” acceptance to benefit from all the services and features of the Platform. In any event, we will ask for your consent before placing cookies or similar technologies that are not strictly necessary for the operation or security of the Platform, and you may change your preferences at any time through your browser settings or our consent tool.

3.Such Data (including sensitive and/or personal data) provided through the Platform may include information concerning your personal details (such as name, age, gender, identity card number, passport number, date of birth, education, race, ethnic origin, nationality, citizenship, biometric information), contact details (such as address, email, phone numbers), family information (such as marital status, name of spouse or child or immediate family), occupation details (such as occupation details, source(s) of income, employer name, income details, job title, job responsibilities, employer’s contact information and address), bank details (such as bank account number(s), card details) and other information (such as financial and/or credit references, net worth including assets and liabilities). In addition, Fasset may from time to time request for certain other personal information that may be relevant for Fasset to consider your request for any other products, services or features available on the Platform. For Fasset Business, Data may also include ownership and authority information, user permissions, approval records, invoices, payment-recipient details and card or payment activity, obtained from you, the business, its authorised users or relevant service providers. Where we process sensitive Data, including biometric data used to verify your identity, we will do so only with your explicit consent or as otherwise permitted under the PDPA.

4.Failure to supply such Data may result in Fasset being unable to open, establish, continue and/or provide Account, Wallet, products, services or features or comply with any laws or guidelines issued by regulatory or other authorities.

5.It is also the case that Data is collected from (i) you and other sources in the ordinary course of the continuation of your relationship with us, for example, when you connect your bank accounts or e-wallet accounts to your Account, or deposit money or apply for certain services or products or request for increasing transaction limits of your Account, (ii) a person acting on behalf of the individual whose Data is provided, and (iii) other sources (for example, information obtained from any bureaus or agencies established or to be established by Bank Negara Malaysia or any of its subsidiaries, the Labuan Financial Services Authority or by any other authorities, any credit reporting agencies, any insolvency department or any debt collection agencies that may be appointed by Fasset, and with any authority or agency in relation to the business we operate). Data may also be generated or combined with other information available to Fasset or Fasset Group.

6.The purposes for which Data may be collected, used, processed, transferred and/or disclosed by Fasset include without limitation (the “Purposes”):

a.Assessing suitability for products and services and the processing of applications for Account, transaction limits on Account, products and/or services provided to users;

b.The provision of any Account, products and/or services and to approve, manage, administer or effect any transactions requested or authorised by you. For Fasset Business, this includes business and identity verification, managing access and approvals, executing payments and conversions, administering cards and resolving transaction disputes;

c.For such purposes as may be specifically provided for in any particular service or product offered by us;

d.Obtaining or providing credit references and conducting credit checks (including but not limited to checks done upon request for increase in transaction limits on Account and during periodic or special credit review which may take place one or more times each year);

e.Creating and maintaining Fasset's credit and risk related models and/or any purpose relating to risk management functions;

f.Assisting other financial institutions to conduct credit checks, disputes or fraud investigation and collect debts;

g.Updating and maintaining your records;

h.Ensuring your on-going creditworthiness;

i.Designing services or products for our users (including market research and statistical analysis and surveys with the aim of improving our products and services);

j.Marketing services or products of Fasset and/or selected companies (in respect of which Fasset may or may not be remunerated) including but not limited to:

-financial, insurance, credit card, banking, staking, crypto, digital assets, wealth management and related services and products;

-reward, loyalty or privileges programmes and related services and products;

-services and products offered by Fasset’s co-branding partners (the names of such co-branding partners will be provided during the application of the relevant services and products, as the case may be);

-improving and furthering the provision of Accounts, products and/or services by Fasset to users generally;

-determining the amount of indebtedness owed to or by you;

k.Collection of amounts outstanding from you and those providing security for your obligations or those for whose obligations you provide security;

l.For fraud or crime prevention and investigation, transaction disputes, data analytics, audit and debt collection and in order that services may be processed by Fasset;

m.Conducting any action to meet obligations of Fasset to comply with Anti-Money Laundering and Counter-Terrorism Financing (“AML-CTF”) regulations and/or international guidance or regulatory requests relating to or in connection with the detection, investigation and prevention of money laundering, terrorist financing, bribery, corruption, tax evasion, fraud, criminal and/or unlawful activities, evasion of economic or trade sanctions and/or any acts or attempts to circumvent or violate any laws relating to these matters;

n.Meeting obligations, requirements or arrangements, whether compulsory or voluntary, of Fasset to comply with, or in connection with:

-Any law, regulation, judgment, court order, voluntary code, sanctions regime, within or outside Malaysia existing currently and in the future (“Laws”);

-Any guidelines, guidance or requests given or issued by any legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers within or outside Malaysia existing currently and in the future and any international guidance, internal policies or procedures;

-Any present or future contractual or other commitment with local or foreign legal, regulatory, judicial, administrative, public or law enforcement body, or governmental, tax, revenue, monetary, exchange, court, central bank or other authorities, or self-regulatory or industry bodies or associations of financial service providers or any of their agents with jurisdiction over all or any part of the Fasset (together the “Authorities” and each an “Authority”) that is assumed by, imposed on or applicable to Fasset; or

-Any agreement or treaty between Authorities;

o.Complying with any obligations, requirements, policies, procedures, measures or arrangements for sharing data and information within Fasset and/or any other use of data and information in accordance with any programmes for compliance with sanctions or prevention or detection of fraud, money laundering, terrorist financing or other criminal and/or unlawful activities;

p.Meeting any obligations of Fasset to comply with any demand or request from the Authorities;

q.Enabling an actual or proposed assignee of Fasset in respect of your relationship with us to evaluate the transaction intended to be the subject of the assignment;

r.For any purpose required by law or regulation;

s.For the purpose of enforcing its legal rights and/or obtaining legal advice and/or any legal process (whether by way of judicial proceedings or any other form of proceedings recognised in law) initiated by or served on, Fasset (whether or not Fasset is a party);

t.For making enquiries or investigations as to whether or not you or person whose Data is collected, used and/or processed by Fasset is actually a sanctioned person, or is otherwise howsoever related to, or associated with, a sanctioned person or entity; and also for the reporting or the taking of any remedial or preventive action in relation thereto;

u.For all ancillary purposes relating to the provision of products and services and facilities relevant thereto including the provision of computer, telecommunications and technology services;

v.For business planning and decision making or internal operational requirements of Fasset (including, without limitation, financial, credit and risk analysis and management, system or product development and planning, reporting, audit and administrative purposes);

w.Maintaining Fasset’s overall relationship with you (including, if you have not specifically requested otherwise, marketing or promoting financial services or related products, market research, insurance, audit and administrative purposes);

x.Attending to your enquiries and generally to enable resolution of any concern or complaint;

y.For the organization of seminars, talks or events hosted by Fasset or our respective partners;

z.For our internal record keeping; and/or

aa.Any activity related or incidental to any abovementioned Purposes.

7.Data collected and held by Fasset relating to an individual will be kept confidential but Fasset may, as necessary, provide or disclose such information to the following parties (whether within or outside Malaysia) for the purposes set out in paragraph 6 (who may also subsequently process, transfer and disclose such Data for the purposes set out in paragraph 6) subject at all times to any laws (including regulations, standards, industry code of practice, guidelines, obligations and/or directives from any regulatory authorities) applicable to the concerned entity:

a.Fasset (including any officer, employee, consultant, advisor, agent or director);

b.Any agent, contractor, sub-contractors, service providers, lawyers, professional advisers, or associates of the Fasset (including their employees, directors, officers, interns, agents, contractors, service providers and professional advisers);

c.Our business alliances or partners who may provide their products or services to us and/or to you and any third party service provider who provides administrative, telecommunications, computer, storage, payment, custodial, liquidity or other services to Fasset in connection with the operation of its business (including their employees, directors, officers, interns, agents, contractors, service providers and professional advisers);

d.Any Authorities;

e.Any other person under a duty of confidentiality to Fasset which has undertaken to keep such information confidential or any parties which are necessary in disputes or fraud investigation for the purposes of paragraph 6(l), including card payment network providers;

f.Any person to whom Fasset is under an obligation or required or expected to make disclosure for the purposes of any guidelines set out, or in connection with paragraph 6(m), (n), (o), (p) & (q);

g.Any actual or proposed assignee of Fasset or transferee of Fasset’s rights in respect of your Account and/or relationship with us;

h.Any party acquiring interest in, or assuming risk in, or in connection with, the Accounts, products and/or services provided by Fasset;

i.Any third party who provides services to you;

j.Third party financial institutions, insurers, credit card companies, exchanges, liquidity providers, or banks;

k.Third party reward, loyalty, co-branding and privileges programme providers;

l.Co-branding partners of Fasset (the name of such co-branding partners will be provided during the application of the relevant services and products, as the case may be);

m.External service providers (including but not limited to mailing houses, telecommunication companies, telemarketing and direct sales agents, call centres, data processing companies and information technology companies) that Fasset engages for the purposes set out in paragraph 6(j);

n.Other financial institutions, credit reference agencies, credit scoring agencies, any authority in relation to the crypto currency and/or digital assets industry; the police; any other governmental or regulatory authority or body, any insolvency department and in the event of default, to debt collection agencies;

o.Any present or prospective security or liquidity providers for the products and services; and/or

p.Any persons authorized by you

wherever located, including in jurisdictions which do not have data protection laws that provide the same level of protection as Malaysia. Whether it is processed in Malaysia or overseas, in accordance with PDPA, your Data will be protected by a strict code of secrecy and security which Fasset, its staff and third parties are subject to. You understand that Fasset or any of the recipients will be obliged to disclose Data if legally compelled to do so by any Laws. For Fasset Business, relevant recipients include account, payment and card providers, card networks, identity-verification suppliers and technology providers. Keel, Due and Reap may process Data for their own service and compliance purposes under their privacy notices. Suppliers processing Data solely on our instructions are subject to applicable contractual restrictions. Where rewards are activated, relevant Data may also be shared with the rewards providers for administration and fulfilment. Overseas transfers are subject to applicable data protection requirements and the safeguards appropriate to the transfer.

8.In connection with 7(o) above, in the event of any default in payment where the amount in default is not fully paid on or before the due date, the individual is liable to have his/her/its Data shared with, disclosed to and/or retained by the credit scoring agency.

9.If you hold and/or operate an Account on behalf of another person (individual or entity), Fasset may also disclose to such other person(s) on behalf of whom you hold and/or operate the Account, Data provided to Fasset in relation to the Account, irrespective of whether such person(s) are the authorised signatories and if they are, irrespective of their signing authority under the Account or any services provided under the Account. For Fasset Business, the disclosure described in this paragraph is limited to relevant account, payment and card activity within the permissions assigned to the business’s administrators and authorised users.

10.Fasset takes security measures in line with the data protection regulations applicable to us. Fasset has security measures in place designed to prevent data loss, to preserve data integrity, and to regulate access to data. We take reasonable steps to ensure your Data is protected from misuse or loss, and unauthorized access, modification or disclosure. In particular, to ensure the security of your Data, the cloud solution that we use to store your Data complies with industry standard access controls. We also have procedures to deal with any suspected personal data breach, and we will notify the relevant authority and, where required, you, in accordance with applicable law. However, no method of transmission or storage is completely secure, and we cannot guarantee that unauthorised access, data loss or other breaches will never occur.

11.Fasset may use, analyse and assess Data held about you and your Account, including the nature of your transactions and/or the counterparties you deal with, to give you and/or your counterparties, information about products and services from Fasset and those of selected third parties which Fasset thinks may interest you and/or your counterparties via telephone, mobile phone, emails, electronic media, posts, push notifications, SMS or other means. Fasset may pass this information to other members of the Fasset Group (as defined in the Agreement) so that it may do the same unless you have specifically requested otherwise regarding such disclosure for purposes of cross-selling to you or your counterparties.

12.We may also de-identify Data to create anonymised and aggregated data sets and reports to assess, improve and develop our business, products and Platform, and for research and analytics purposes. Such information does not identify you.

13.You may:

a.check whether Fasset holds Data about you and request for a copy of such Data held by us;

b.request Fasset to correct any Data relating to you which is inaccurate;

c.request clarification on Fasset's policies and practices in relation to Data and to be informed of the kind of Data held by Fasset;

d.withdraw your consent to the processing of your Data, subject to any legal or contractual restrictions (which may affect our ability to provide the Account, products or services to you);

e.request that we stop, or not begin, processing your Data for direct marketing purposes, or where the processing is likely to cause substantial damage or distress, as permitted under applicable law; and

f.request that your Data be transmitted to another data controller, where technically feasible and as permitted under applicable law.

14.You may request Fasset to delete your Data on the following conditions:

a.delete your Data completely: you may request deletion of Data relating to you. We will assess the request under applicable law and explain any retention requirement or effect on the services. Account closure may be necessary where the Data is required to provide the service, but an individual’s request does not automatically require closure of a business account. Making a request does not waive accrued rights or release either party from liability.

b.delete your Data partly: for this you need to mention specific data to be deleted. If you request to delete specific data, it may indeed have an impact on the services provided to you. This is because the data being processed or stored may be essential for the functioning or provision of those services. Deleting certain Data could result in a loss of functionality, customization, or personalized features that rely on the Data. We will explain any applicable retention requirement. Making a request does not waive accrued rights or release either party from liability.

15.You can request for information on your Data, access to your Data, correction, and deletion of your Data held by Fasset. This request should be made by writing to us at legal@fasset.com.

16.We may ask you to verify your identity before acting on a request and may charge a fee where permitted by applicable law. We will respond within the period required under the PDPA, and where we are unable to comply with a request, we will inform you of the reasons.

17.If you do not want us to further disclose your Data to Fasset or the said third parties for the purposes of cross-selling and/or if you do not want to be contacted by us or the said third parties for the sale or promotion of any products or services, you may write to us at legal@fasset.com with a specific request to that effect. Further, to unsubscribe from our marketing mailing list you may click on the “unsubscribe” link at the end of the e-mail communication received. Your request to be removed from our marketing mailing list may take up to 30 days to be effective. Please note that in order to keep you updated on important messages, Fasset will still send you selected communication even though you may have unsubscribed.

18.We will retain your Data for as long as necessary in connection with the purposes set out in this Privacy Policy, unless applicable law requires a longer retention period. In particular, we will retain Data for as long as it is needed to establish, exercise or defend any legal rights. For the Reap card programme, relevant identity, business-verification and financial-crime compliance records are retained for at least ten years from the last card transaction or cardholder activity, or longer where applicable requirements require it, subject to applicable data protection law. This period does not apply automatically to all Data collected by Fasset.

19.If you have any queries relating to this Privacy Policy, misuse or suspected misuse of your Data, you may write to us at legal@fasset.com.

20.Fasset reserves the right to amend this Privacy Policy at any time and will place notice of such amendments on the Platform or via any other mode Fasset views suitable in its sole discretion.

21.If you are reading this as a partner or on behalf of a body corporate or business enterprise which is a user of Fasset, this Privacy Policy addressed to the body corporate or business enterprise must be provided to all the partners or office-bearers (as the case may be) of such entity and individuals representing such entity whose Data is collected and/or processed by Fasset for the purposes as stated herein. In this regard, you warrant that you have authority and, where required by applicable law, the consent of such individuals to the provision of their Data to Fasset for the foregoing purposes and for disclosure to such parties as stipulated above and you undertake to extend a copy of this Privacy Policy to all such individuals, which expression shall include all such existing and new partners or office-bearers (as the case may be) of the user from time to time. This does not replace any notice or consent that Fasset is required to provide or obtain.

22.Aside from users, this Privacy Policy shall also apply (as the context shall require) in relation to the usage, processing and disclosure of the Data of any other individual who is not a user but whose Data is collected and/or is required to be collected by Fasset by reason of, or incidental to, operation of the Platform by Fasset and the provision of any Accounts, services and/or products by Fasset to its users, whether such user is/are another individual(s) or is a company, business entity or organisation. In this regard, you confirm and warrant that you (a) have authority and have obtained any consent required by applicable law from such individuals to the provision of such Data to Fasset for the foregoing purposes and for disclosure to such parties as stipulated above; and (b) will provide this Privacy Policy to such individuals. This does not replace Fasset’s own notice and consent obligations.

23.Use of the Platform is restricted to individuals aged 18 and over, in accordance with the eligibility requirements in the Agreement. If we become aware that we have collected Data from a person under the age of 18 in breach of those requirements, we will take steps to delete it, subject to any retention required by applicable law.

24.If you visit any link on the Platform to any third party website or app, you agree to and shall comply with the separate and independent privacy policies of such third party websites and/or apps. You understand and acknowledge that Fasset is not responsible for the content or activities of such third party websites or apps.

25.This Privacy Policy shall be governed by the laws of the Federal Territory of Labuan, Malaysia.

26.Any requests, queries, concerns or complaints in relation to this Privacy Policy or relating to any matter concerning your Data can be made by writing to us at legal@fasset.com.

27.If you are not satisfied with our response to any request or complaint, or believe our processing of your Data does not comply with applicable data protection laws, you may lodge a complaint with the Personal Data Protection Department of Malaysia.

By providing us your Data, you hereby confirm and consent to its use by Fasset in accordance with this Privacy Policy. Your continued access and/or usage of the Platform, Accounts, services and/or products is deemed consent for Fasset to collect, process and store the Data in accordance with the foregoing. Failure to consent to the foregoing may result in Fasset being unable to provide you access to the Platform and/or to open, establish, provide or continue to provide Accounts, services and/or products to you. For Fasset Business, acceptance by a business does not constitute consent on behalf of every individual. Where consent is required, it must be obtained from the relevant individual or a person legally entitled to give it. Optional marketing consent is not a condition of access to the core services.

This Privacy Policy was last modified on 21 October 2026.