How Find SA collects, uses, discloses, stores, transfers, and protects personal data in line with Malaysia PDPA principles.
Effective date: September 17, 2026
Find SA is operated by FIND SA DIGITAL ENTERPRISE (202603060942 (LA0087196-M)), acting as the data controller/data user for this platform.
This notice explains how personal data is handled for account services, SA verification, profile operations, SA Rewards and Gifts, support, moderation, safety, and compliance.
We may collect account and profile data (for example name, display name, email, phone, profile image, account metadata, and profile settings).
We may collect identity and verification data (for example legal name, NRIC details, business card files, dealership details where applicable, service location or city, supported brands, delivery photo evidence, Dealer applicant details, company name, business registration number, brand, state, and supporting verification documents).
We may collect activity and interaction data (for example Delivery or non-payment activity records where available, reviews, ratings, report content, and support communications).
We may collect Dealer management and paid feature data (for example Dealer controller records, Dealer change requests, SA Code lists selected for Verified coverage, Billplz bill identifiers, payment status, and payment metadata).
For SA Rewards, we may collect Campaign activity and progress, Point grants, deductions and expiry, Reward views and redemptions, allocated codes, Gift recipient phone numbers, claim status, and related support or fraud-review records. An SA may provide a recipient phone number before that recipient has a Find SA account.
We may collect technical and usage data (for example IP address, device or browser signals, log records, cookies, analytics events, and security telemetry).
We collect data directly from users, SAs, Dealer applicants, and Dealer controllers through forms, profile updates, uploads, communications, review submissions, request submissions, and report submissions.
For a Gift, the sending SA provides the recipient's phone number. We also record the recipient's claim and account-verification steps if they register or sign in.
We collect data from platform usage events, cookies, analytics tools, anti-abuse systems, and security monitoring tools.
Where applicable, we may receive relevant data from service providers, payment providers, communications providers, integrations, counterparties, or lawful authorities for support, safety, verification, dispute handling, or compliance purposes.
We process personal data for account creation, authentication, SA application review, SA Type review, SA verification, Dealer application review, Dealer controller access, profile display, user-SA matching, and communication workflows.
We process data for support handling, report handling, moderation, fraud detection, abuse prevention, service security, analytics, and service improvement.
We process SA Rewards data to calculate Campaign progress, award and expire Points, check redemption eligibility and inventory, allocate Rewards, bind and deliver Gifts to the correct verified phone number, and investigate errors or misuse.
We process payment-related records for paid feature checkout, Billplz bill creation, callback verification, payment status reconciliation, coverage activation, audit, and support.
We process data for legal and compliance purposes, including record keeping, dispute handling, legal claims, lawful disclosures, and regulatory cooperation.
Where lawful, we may use contact details for service updates, security notices, and direct marketing controls or opt-out handling.
Certain data fields are mandatory for account operation, security, or SA verification; other fields may be optional depending on feature use.
If mandatory data is not provided or cannot be verified, we may be unable to create accounts, process SA applications, activate listings, continue certain features, or resolve support requests.
A matching verified phone number is required to claim a Gift. An SA must provide a recipient phone number to send one; the recipient does not need an account until they choose to claim it.
Public profile fields, SA Type, supported brand display labels, service area labels, and eligible review or rating content may be visible to other users depending on the applicable feature and profile type.
Dealer public page fields, Dealer badges, business hours, address, and related public-facing details may be visible to other users once published.
NRIC data, business card files, delivery photo evidence, Dealer applicant identity details, business registration details, private verification files, and payment metadata are not public profile content and are handled for verification, safety, moderation, support, fraud prevention, dispute handling, payment administration, and compliance.
Point balances and history, Gift recipient phone numbers, allocated Reward codes, and redemption records are not public profile content. They are shown only to the relevant account holder or authorized staff as required for the feature; an unclaimed Gift code is not shown to a prospective recipient.
We may disclose data to cloud hosting, database, storage, communications, OTP, analytics, security, payment, and fraud-prevention service providers acting on our instructions.
When paid features are available, payment-related details may be disclosed to Billplz or other payment providers for bill creation, payment processing, callback verification, fraud prevention, reconciliation, and support.
We may disclose data to professional advisers, auditors, insurers, regulators, law enforcement, courts, or authorities where required by law or reasonably necessary to protect rights, safety, and platform integrity.
Where necessary for service functionality or dispute handling, we may disclose relevant records to counterparties connected to the reported transaction context.
Authorized Find SA staff may manually provide a participating merchant with the minimum relevant Reward redemption or fulfilment information needed to honour a Reward or investigate a problem. Merchants do not receive a self-service Rewards analytics dashboard under the current service. We do not provide Gift recipient phone numbers for unrelated marketing.
Some providers may process or store data outside Malaysia.
Where cross-border transfers occur, we apply contractual and operational safeguards that are reasonable for PDPA-aligned processing.
We retain personal data for as long as reasonably necessary for service operation, verification, moderation, fraud prevention, support, disputes, audits, tax, and legal obligations.
Retention periods vary by data type, risk profile, and legal requirement.
We apply administrative, technical, and organizational safeguards, but no system can be guaranteed fully secure.
Subject to applicable law and identity verification, you may request access to and correction of your personal data.
Where applicable, you may request withdrawal of consent, object to direct marketing, and request limitation of processing.
Certain requests may be refused or limited where permitted by law, including where data is needed for security, fraud prevention, legal obligations, or dispute management.
Find SA may link to or rely on third-party services. Those services operate under their own privacy notices and terms.
When an SA opens a prefilled WhatsApp Gift message, WhatsApp processes any message the SA chooses to send under its own terms and privacy notice. Opening the message alone is not proof that it was sent or received.
You should review third-party notices before providing data or making payments outside Find SA.
For privacy or PDPA requests, contact contactus@find-sa.com (subject: Privacy Request) or 019-6789188.
We provide a practical support route for access, correction, consent withdrawal, and related privacy enquiries.
