Privacy Policy

This Privacy Policy explains how Avenor Sdn Bhd 202601020679 (1682776-H) (“we”, “us” or “Wallett”) collects, uses, discloses and protects your personal data when you use the Wallett mobile application and this website (together, the “Services”). It is issued under Malaysia’s Personal Data Protection Act 2010 (“PDPA”).

Wallett is a digital platform and is not a pawnbroker. Your pawn transactions are made with our licensed partner pawnbrokers, who are also responsible for the personal data they handle as part of your pawn contract.

By registering for or using the Services, you consent to us processing your personal data as described in this policy.

1. Personal data we collect

Identity and contact details

• Your full name, mobile phone number and, if you give it to us, your email address.
• Your MyKad (NRIC) number and the identity details read from your MyKad when you verify your account at a partner branch, which may include your name, NRIC number, address and photograph.

Pawn and transaction records

• Pawn tickets linked to your account: ticket number, branch, item description, weight and purity of pledged items, loan amount, interest, due dates and status.
• Renewal, interest payment and (when available) redemption records, including the amount, date, receipt and payment reference.
• For FPX payments, the payment reference, amount, bank name and payment status that we receive from our payment gateway. We do not collect or store your online banking username, password or PIN — you enter these only on your bank’s own pages.
• Branch appointments and valuation estimates you request.

Device and usage information

• Device model, operating system and version, app version, language setting and IP address.
• Your push-notification token, which we use to send due-date reminders and service messages.
• How you use the app, such as screens viewed, features used, errors and crash reports.

Communications

• Messages you send us, and records of your calls and emails with our support team.

Some features may ask for device permissions (for example, the camera to scan a QR code). We only use a permission for the feature that asked for it, and you can turn it off at any time in your device settings.

2. How we collect it

• From you, when you register, use the app or contact us.
• From our partner pawnbrokers, when you verify your account at a branch and when your pawn tickets are issued, renewed or redeemed.
• From our payment gateway and banks, when you make an FPX payment.
• Automatically from your device, when you use the app or website.

3. Why we use it

We use your personal data to:

• open and verify your account, and confirm your identity at partner branches;
• show your pawn tickets, loan details and due dates;
• process renewals, interest payments and redemptions, and issue receipts;
• send due-date reminders, payment confirmations and other service messages;
• give estimates and manage branch appointments;
• answer your questions and complaints;
• detect, prevent and investigate fraud, unauthorised access and other misuse;
• maintain, secure and improve the Services, including fixing errors; and
• comply with legal and regulatory requirements, including the Pawnbrokers Act 1972 and anti-money laundering laws, and respond to lawful requests from authorities.

We do not sell your personal data. We will only send you marketing messages if you have agreed to receive them, and you can opt out at any time.

4. Who we share it with

• Partner pawnbrokers that hold your pawn tickets, so they can verify you and process renewals, payments and redemptions.
• Payment service providers, including [PAYMENT GATEWAY NAME], Payments Network Malaysia (PayNet), which operates FPX, and your bank, to process your payments.
• Service providers that host our systems, send SMS one-time passwords (OTPs) and push notifications, provide analytics and crash reporting ([ANALYTICS / CRASH SDKs, e.g. Firebase Analytics, Firebase Crashlytics]), and help us with customer support. They may only use your data to provide services to us.
• Professional advisers, such as auditors and lawyers.
• Authorities, such as the police, Bank Negara Malaysia, the Ministry of Local Government Development (KPKT), which regulates pawnbrokers, and the courts, when required by law.
• A buyer or successor, if our business is merged, sold or restructured, subject to this policy.

5. Transfers outside Malaysia

Some of our service providers may store or process data outside Malaysia, for example for cloud hosting or analytics. When this happens, we take steps to make sure your data is protected to a standard comparable to the PDPA, as required by law.

6. How long we keep it

We keep your personal data for as long as your account is active and as needed to provide the Services. After your account is closed, we keep the records we must retain by law — such as transaction and identity verification records — for [RETENTION PERIOD, e.g. 7 years], and then delete or anonymise them. See Delete your account for details.

7. How we protect it

We protect your data with encryption in transit (TLS), access limited to staff who need it, system monitoring, and service providers bound by confidentiality. No system is completely secure. If a personal data breach is likely to cause you significant harm, we will notify you and the Personal Data Protection Commissioner as required by law.

8. Your rights

Under the PDPA, you can:

• ask for access to, and a copy of, your personal data;
• ask us to correct data that is inaccurate, incomplete or out of date;
• withdraw your consent, or ask us to limit how we process your data;
• ask us to send your data to another data controller, where technically feasible; and
• delete your account and ask us to delete your data, subject to the records we must keep by law.

To make a request, contact us using the details below. We will respond within 21 days, and we may need to verify your identity first.

Your name, mobile number and MyKad verification are required to use Wallett. Without them, we cannot open or verify your account. If you withdraw consent for data we need to run your account, we will no longer be able to provide the Services to you.

9. Children

The Services are for users aged 18 and above. We do not knowingly collect personal data from anyone under 18.

10. Changes to this policy

We may update this policy from time to time. We will post the new version on this page with a new “Last updated” date and, for significant changes, let you know in the app.

11. Language

This policy is available in English and Bahasa Malaysia. If the two versions differ, the English version prevails.

12. Contact us