Your Privacy.
Our Priority.
We are committed to protecting your personal data and using it responsibly, securely and transparently.
This Privacy Statement explains how Safe Pass Services collects, uses, stores, protects, discloses and otherwise processes information in connection with My Reward Cards, My Reward Merchant and related services.
Our Commitment to You
Safe Pass Services respects your privacy. We process personal data in accordance with the Personal Data Protection Act 2010, its applicable amendments, regulations and other applicable laws in Malaysia.
Scope of This Statement
This Privacy Statement applies to personal data processed through:
- the My Reward Cards member application;
- the My Reward Merchant application;
- agent, merchant and administrative portals;
- the website at myrewardcards.my;
- customer service, email and in-app communications; and
- related reward, points, token, promotion and merchant services.
Merchant-specific processing
Participating merchants may independently decide how they use information relating to their own customers, rewards, promotions and transactions. A merchant may therefore have its own privacy notice in addition to this statement.
Who Is Responsible for Your Data?
Safe Pass Services operates the My Reward Cards platform and acts as the data controller for personal data that it determines how and why to process.
In some circumstances, participating merchants, service providers or business partners may act as separate controllers or processors for information handled through their own services.
Information We Collect
The information collected depends on your account type, how you use the platform and the features you choose to access.
Account Information
Name, email address, mobile number, date of birth, gender, preferred language, account role, profile image and other details supplied during registration.
Verification Information
Email verification records, security credentials, PIN status and information used to confirm account ownership or prevent unauthorised access.
Device and Usage Data
Device type, operating system, app version, device or app identifiers, IP address, login times, feature usage and interaction records.
Location Information
Approximate or precise location, where permission is granted, for transaction verification, branch controls, nearby features and security functions.
Reward and Transaction Data
Merchant memberships, points earned, points redeemed, token purchases, token usage, rewards, transaction dates, branch information and activity history.
Merchant Information
Business name, registration details, addresses, branch locations, employee roles, authorised users, merchant settings, offers and promotions.
Agent Information
Agent account details, merchant referrals, onboarding records, network relationships and relevant business activity.
Communications
Messages sent to us, support enquiries, feedback, complaints, communication preferences and records of notices or in-app messages.
Campaign Information
Information provided when entering promotions, surveys, contests, lucky draws or optional future services.
How We Obtain Information
We may obtain personal data:
- directly from you when you register, update your account, contact us or use the platform;
- from participating merchants when they process eligible reward or token transactions;
- from agents assisting with merchant introduction or onboarding;
- automatically from your device or browser when you use the apps or website;
- from service providers supporting authentication, cloud hosting, analytics, messaging, mapping or payments; and
- from other sources where permitted by law or with appropriate authority.
How We Use Your Information
We may process personal data for the following purposes:
Accounts and Security
Create accounts, authenticate users, apply role controls and protect access.
Rewards and Tokens
Operate merchant cards, points, redemptions, rewards and store-credit token functions.
Merchant Operations
Support branches, employees, roles, reporting, promotions and merchant account administration.
Transaction Verification
Apply location-based controls and verify supported transactions.
Messages and Promotions
Deliver service notices, merchant offers and permitted promotional communications.
Improvement and Analytics
Analyse performance, diagnose issues and improve the platform and user experience.
Safety and Fraud Prevention
Detect suspicious activity, enforce rules and protect users, merchants and the platform.
Records and Compliance
Maintain business records and comply with applicable legal, tax and regulatory obligations.
Customer Support
Respond to enquiries, resolve account issues and investigate complaints.
Location Information
Certain functions may request access to your device location. Examples include confirming that a non-manager merchant employee is within an approved radius of a registered branch and supporting location-based transaction controls.
- Location access depends on device permission and feature use.
- Merchant employee controls may verify whether a device is within approximately 100 metres of an approved location.
- Disabling location permission may prevent certain features from working.
Service and Promotional Communications
We or participating merchants may send account notices, transaction information, security alerts, service updates and support messages where necessary.
Subject to applicable requirements and your communication preferences, merchants may also send offers, birthday messages, festive greetings, promotional graphics or campaign announcements through the app.
You may adjust available notification settings or request that optional marketing communications stop. Essential service and security notices may still be sent.
When We May Disclose Information
Personal data may be disclosed, where reasonably necessary and permitted, to:
- participating merchants involved in your reward, redemption, token or merchant transactions;
- authorised merchant employees and branch personnel according to their assigned roles;
- agents supporting merchant introduction or onboarding;
- cloud-hosting, authentication, analytics, communication, mapping, technical-support and payment service providers;
- professional advisers, auditors and insurers;
- government bodies, regulators, courts or law-enforcement authorities where required or permitted by law;
- parties involved in a proposed merger, acquisition, restructuring, financing or transfer of business; and
- other parties where you have consented or directed us to disclose the information.
We do not sell personal data
We do not sell personal data to unrelated third parties for their independent marketing purposes.
International Processing and Storage
Some service providers or technical infrastructure may process or store information outside Malaysia. Where this occurs, we take reasonable steps intended to ensure that appropriate data protection and security arrangements apply.
How Long We Retain Information
We retain personal data only for as long as reasonably necessary for the purposes described in this statement, including to:
- provide and maintain your account and services;
- preserve transaction, reward, token and redemption records;
- resolve disputes and respond to enquiries;
- prevent fraud or misuse;
- enforce agreements; and
- comply with legal, accounting, tax or regulatory requirements.
Data may be deleted, anonymised or securely isolated when it is no longer required, subject to permitted retention obligations.
Data Security
We use reasonable technical, administrative and organisational measures intended to protect personal data against unauthorised access, accidental loss, misuse, alteration or disclosure.
Security controls may include
Account authentication, PIN protection, role-based access, location controls, encrypted transmission, monitoring, backups, restricted administrative access and service provider safeguards.
No system is completely risk-free
Although we take reasonable precautions, no internet, application or storage system can be guaranteed to be completely secure. Users should protect their passwords, devices and PINs and promptly report suspected unauthorised access.
Your Rights
Subject to applicable law, verification requirements and permitted exceptions, you may request to:
We may request information to verify your identity before acting on a privacy request. Certain information may need to be retained where required by law or for legitimate record-keeping, transaction, security or dispute purposes.
Account Deletion
You may request deletion of your My Reward Cards account using an available in-app account deletion function or by contacting us at the email address below.
Deleting an account may result in the loss of access to merchant memberships, points, tokens, reward history and other account features. Before submitting a request, you should use or resolve any remaining points, tokens, rewards or merchant balances where applicable.
Some records may continue to be retained where necessary for legal compliance, fraud prevention, accounting, disputes, transaction reconciliation or protection of users and merchants.
Children and Young Users
Users who are not legally able to provide valid consent should use the platform only with the involvement and permission of a parent or legal guardian.
A parent or guardian who believes that a child has provided personal data without appropriate permission may contact us to request review or deletion.
Changes to This Privacy Statement
We may update this Privacy Statement to reflect changes to our services, business practices, technologies or legal requirements.
The revised version will be published on this page with an updated effective date. Where appropriate, we may also provide notice through the app, website, email or another suitable channel.
Contact Us
Contact us if you have questions, concerns, requests or complaints concerning this Privacy Statement or the processing of your personal data.