1. Introduction

Newvest Recoveries Sdn Bhd (“Newvest”, “we”, “our” or “us”) is committed to protecting personal data and respecting individual privacy in accordance with the Personal Data Protection Act 2010 (PDPA) and applicable Malaysian laws governing debt recovery and consumer protection.

This Privacy Notice explains how we collect, use, disclose, store and safeguard personal data when:

• you interact with us directly;
• your personal data is provided to us by our clients; or
• we carry out debt recovery activities, whether as an appointed agent or as the legal owner of a debt.

2. Who We Are and Our Regulatory Role

Newvest is a debt recovery and receivables management company operating in Malaysia.

Depending on the circumstances of a particular account:

• In most cases, we act as an appointed recovery agent on behalf of licensed creditors; and
• In special cases, we may lawfully acquire and purchase debts, in which case Newvest becomes the legal owner of the debt and may exercise the rights of a creditor, including commencing civil legal proceedings through the courts.

In all cases, our activities are conducted strictly in accordance with applicable laws, regulatory expectations, and fair debt collection conduct standards.

3. Personal Data We Process

We may process the following categories of personal data, depending on the nature of the engagement:

(a) Identification Data

• Name, identification number, passport number, date of birth, nationality

(b) Contact Information

• Residential or postal address
• Telephone numbers
• Email addresses

(c) Financial and Account Information

• Outstanding balances, payment history, account references
• Information relating to repayment arrangements

(d) Employment and Income Information

• Occupation and employer details, where relevant to recovery arrangements

(e) Communication Records

• Call recordings
• Emails, letters, SMS, chat records and internal notes

(f) Publicly Available Information

• Information lawfully obtained from public sources to verify or supplement records
• Most personal data is provided by our clients. Additional data may be obtained directly from individuals or authorised third parties during the recovery process.

4. How We Use Personal Data

Personal data is processed strictly for lawful and legitimate purposes, including:

• Carrying out debt recovery activities
• Verifying identity and account information
• Communicating regarding outstanding debts
• Facilitating repayment, settlement or resolution
• Maintaining records for reporting, audit and compliance
• Quality assurance, staff training and risk management

We do not use personal data for marketing purposes.

5. Legal Basis for Processing

Depending on the context, personal data is processed based on one or more of the following grounds:

• Legitimate interests in recovering lawful debts
• Contractual necessity, arising from agreements between creditors and individuals
• Compliance with legal and regulatory obligations
• Client instructions, where Newvest acts as a service provider

Consent is generally managed by our clients and is not typically relied upon by Newvest as the primary legal basis for processing.

6. Disclosure of Personal Data

We disclose personal data only where necessary and lawful, including to:

• Our clients for reporting and account management purposes
• Authorised third parties, such as field agents or professional service providers engaged under strict confidentiality obligations

Personal data is never sold, misused, or disclosed for unrelated purposes.

7. Data Retention

Personal data is retained only for as long as necessary to fulfil recovery, contractual, legal and regulatory requirements.

When no longer required, data is securely deleted, destroyed or anonymised using appropriate methods.

8. Your Rights

Subject to applicable laws and operational constraints, individuals have rights under the PDPA, including the right to:

• Request access to personal data; and
• Request correction of inaccurate or incomplete data.

Requests may be subject to verification and legal limitations, particularly where data must be retained for recovery, dispute or compliance purposes.

9. Data Security

Newvest implements reasonable technical, organisational and physical safeguards to protect personal data against unauthorised access, loss, misuse or disclosure.

No system is completely risk-free; however, we regularly review and enhance our safeguards to align with regulatory expectations and industry standards.

10. Updates to This Privacy Notice

This Privacy Notice may be updated from time to time. The most current version will be published on our website.

11. Contact Us

For privacy-related enquiries, please contact:

Newvest Recoveries Sdn Bhd
Attention: IT & Compliance Team