Privacy Notice

1. About this notice & scope

Nombor.XYZ is a marketplace that connects verified buyers and sellers of Malaysian vehicle registration plates, operated by [ENTITY] as part of the SAE Capital ecosystem and powered by SAE PASS for identity. We facilitate listings, payments and transfers, but are not a party to the sale itself. This notice applies to your use of Nombor.XYZ.

2. Definitions

In this notice:

• 'Personal data' means information that relates to you and can identify you, directly or indirectly.
• 'Sensitive personal data' includes biometric data and other categories given special protection under the PDPA.
• 'Processing' means any operation performed on personal data, such as collecting, recording, storing, using, disclosing or deleting it.

3. Personal data we collect

Depending on how you use our services, we may collect:

• Identity and profile data — full name, username, date of birth and government identification details;
• Contact data — email address, phone number and mailing address;
• Account and authentication data — SAE PASS credentials, login history and security settings;
• Marketplace activity — your listings, bids, offers, messages, ratings and reviews;
• Transaction data — purchases, sales and payment metadata (processed by Stripe);
• Technical data — IP address, device and browser information, and cookie data.

4. Sensitive personal data (eKYC)

To verify your identity, we process the following sensitive personal data, and only with your explicit consent:

• Government identification details (for example, NRIC/MyKad or passport);
• Biometric data, such as a facial image used for liveness detection and identity matching.

5. How we collect your data

We collect personal data:

• Directly from you — when you register, verify your identity, list or bid, transact or contact us;
• Automatically — through cookies and similar technologies when you use our site;
• From third parties — our identity-verification and payment partners, and authorised or public sources where permitted by law.

6. Why we use your personal data

We process your personal data to:

• Operate the marketplace and facilitate transactions between buyers and sellers;
• Verify your identity and prevent fraud, impersonation and abuse;
• Process payments and escrow, and support plate ownership transfers;
• Provide customer support and resolve disputes;
• Send service-related communications and, with your consent, marketing;
• Comply with legal, regulatory and anti-money-laundering (AML) obligations.

7. Legal basis & consent

We process your personal data on the basis of your consent and, where applicable, to perform a contract with you or to comply with our legal obligations. You may withdraw your consent at any time (see 'Your rights'), although this may limit our ability to provide certain services.

8. Identity verification & SAE PASS

Identity verification (eKYC) is carried out through SAE PASS together with our verification partner. You verify once, and your verified status may be relied upon across the SAE Capital brands you choose to use, so you do not need to re-verify for each brand. We disclose which brands rely on SAE PASS at the point of verification.

9. Payments & escrow

Payments are processed by our payment partner, Stripe. Funds for a sale are held in escrow until the JPJ ownership transfer is confirmed, then released to the seller less applicable fees. We never store full card numbers and never take direct custody of your funds.

10. Cookies & tracking technologies

We use cookies and similar technologies to operate our site and, with your consent, for analytics and marketing. You can manage your preferences at any time through our cookie banner or your browser settings. See our Cookie Notice for details.

11. Disclosure of your personal data

We may disclose your personal data to:

• Service providers and data processors — including our payment processor (Stripe), hosting and infrastructure providers (including our Singapore-based servers), and our identity-verification partner;
• Other users — information you choose to make public, such as your listings, ratings and public profile;
• Other SAE Capital brands — where you choose to use them and rely on SAE PASS;
• Professional advisers, auditors and insurers, where necessary;
• Government authorities, regulators and law-enforcement agencies, where required or permitted by law.
• We do not sell your personal data.

12. Cross-border transfer

Some of our service providers and infrastructure are located outside Malaysia (for example, our servers in Singapore and Stripe's global infrastructure). Where we transfer your personal data outside Malaysia, we take reasonable steps to ensure it receives a level of protection consistent with the PDPA.

13. How long we keep your data

We retain personal data only for as long as necessary for the purposes set out in this notice or as required by law. Indicative periods:

• Account and profile data — while your account is active, and a reasonable period afterwards;
• Identity-verification (eKYC) data — for the period required to verify you and to meet legal and AML record-keeping obligations;
• Listing and transaction records — as required by law and to handle disputes and accounting;
• After the applicable period, data is securely deleted or anonymised.

14. How we protect your data

We apply technical and organisational measures to protect your personal data, including:

• Encryption of data in transit and at rest;
• Access controls and multi-factor authentication for administrators;
• Logging, monitoring and regular review of our systems;
• Due diligence and contractual safeguards with our service providers.
• No method of transmission or storage is completely secure, but we work to protect your data and respond promptly to incidents.

15. Data breach notification

If a personal data breach occurs that is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and affected individuals as required by the PDPA and applicable guidelines.

16. Your rights

Subject to the PDPA, you have the right to:

• Access — request a copy of the personal data we hold about you;
• Correct — request correction of inaccurate or incomplete data;
• Withdraw consent — withdraw your consent to processing;
• Data portability — request transfer of data you provided to us;
• Limit processing — request that we limit processing for direct marketing;
• Complain — lodge a complaint with the Personal Data Protection Commissioner.
• To exercise any of these rights, contact our Data Protection Officer (see 'Contact us'). We may verify your identity before responding.

17. Marketing communications

With your consent, we may send you updates, offers and news about Nombor.XYZ and SAE Capital. You can opt out at any time using the unsubscribe link or by contacting us. We will still send you essential service and security communications.

18. Children

Our services are not directed at children under 18, and you must be legally able to own and transfer a Malaysian registration plate to transact. We do not knowingly collect personal data from minors without verifiable parental or guardian consent.

19. Third-party links

Our services may contain links to third-party websites, apps or tools that we do not control. This notice does not apply to them, and we are not responsible for their privacy practices. Please review their own privacy notices.

20. Changes to this notice

We may update this notice from time to time to reflect changes in our practices or the law. We will post the updated version with a new effective date and, where appropriate, notify you of material changes.

21. Contact us & Data Protection Officer

If you have questions about this notice, wish to exercise your rights, or want to make a complaint, contact our Data Protection Officer:

• Data Protection Officer, [ENTITY]
• Email: privacy@nombor.xyz
• Address: [registered address]
• You may also contact the Personal Data Protection Commissioner of Malaysia.

22. Governing language

This notice is provided in English, Bahasa Melayu and 中文. If there is any inconsistency between the versions, the English version prevails.