Buyer Privacy Notice

Last updated: 25 October 2026 (draft)

[TBD: counsel review pending. Bracketed items are open.]

You are reading this because a Sales Advisor ("your SA") or their agency used CLOSA.my to handle your enquiry, booking or vehicle loan. This notice explains, in plain terms, what happens to your personal data.

1. Who is responsible for your data

Your SA and their dealership or agency decide why your data is collected and how it is used. They are responsible for it.
CLOSA.my provides the tools your SA uses and stores your data securely on their behalf. We do not use it for our own marketing and we do not sell it.

2. What may be collected

Enquiry: your name and phone/WhatsApp number, plus the model you asked about, from the Showroom enquiry form or QR code.
Your progress: booking, loan and delivery status, visible to you through a private tracker link.
Documents for your loan application, only if you or your SA upload them: IC (MyKad), driving licence, payslips, bank or EPF statements. Your IC number may be recorded and is stored encrypted.
An optional review after delivery: rating, comment, first name and, only if you tick a separate box, a photo.

3. How it is used and who sees it

Your SA uses it to reply to you, arrange test drives and prepare your booking and loan.
With your consent, your documents are compiled into a package and shared with the bank loan officer your SA submits to. Access to that package is by a private, time-limited link, and each view is logged.
If your SA is under an agency, authorised agency managers can see the lead.
Your data is not shared with advertisers or anyone else. A review is public only if you submit one and agree.

4. Consent when you upload documents

Before you upload anything through your tracker link you will be asked to agree that the documents are processed for your loan application and kept for the period below. [TBD: final consent wording pending legal sign-off, OQ-21.] You can stop uploading at any time, and you can ask your SA to revoke your tracker link.

5. How long it is kept

Documents (IC, licence, payslips, statements) are automatically deleted 180 days after your purchase is completed or cancelled. The bank keeps its own loan records under its own policies.
Contact and lead details are kept while your SA's subscription is active and deleted within 30 days after it ends. Your SA may delete them earlier.
A log of who accessed documents (no document contents) is kept for 7 years so access can be shown to be proper.

6. Security

Documents are encrypted, only reachable through short-lived private links, and every access is logged. This is intentionally stricter than sending IC copies and payslips over chat, where they can remain on a personal phone indefinitely.

7. Reviews and photos

If you publish a review, your rating, comment and first name appear on your SA's public Showroom and in share images. A photo appears only if you separately consented. You can ask for removal at any time. We will unpublish and delete it, but copies others have already saved or forwarded cannot be recalled.

8. Your rights and how to use them

You can ask to see, correct or delete your data, or to withdraw your consent. Because you do not have a CLOSA.my account, you can do any of these by:

asking your SA, who can act on it in the app; or
emailing [TBD: privacy@closa.my] with your name, phone number and the SA's name. We will verify it is you, pass the request to the responsible SA or agency, and make sure it is carried out. [TBD: confirm the request process, OQ-54.]

Records we must keep by law (such as the access log) cannot be erased. If you are unhappy with the outcome, you may complain to the Personal Data Protection Commissioner of Malaysia.

9. Contact

[TBD: privacy@closa.my]. See also our Privacy Policy.