Miracle Universe Sdn. Bhd. (“Miracle Universe”, “we”, “us”, “our”) values your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal data in accordance with the Personal Data Protection Act 2010 (“PDPA”).

1. Scope and roles

This Privacy Policy applies when you:

1. visit our website;
2. create an account, onboard as a merchant/customer, or use our platform; or
3. contact us (sales, support, compliance, verification).

Important (merchant/customer data):
If you are a merchant using our platform and you upload your customer personal data, you remain responsible for providing required notices/consents to your customers, and we may process such data on your instructions to provide the services. Where we determine the purposes/means of processing, we act as a PDPA “data user”; where we process on behalf of a merchant, we may act as a “data processor”.

2. Personal data we collect

We may collect personal data directly from you, from your use of our services, and (where relevant) from third parties (see Section 5).

Categories of personal data may include:

1. Identity & business details: full name, NRIC/Passport, job title, company name/registration no., ownership/beneficial ownership details (if applicable).
2. Contact details: email, phone number, address.
3. Account & verification data: onboarding/KYC documents, verification results, risk or fraud signals.
4. Transaction & service data: billing/payment transaction records, payouts/settlement information, invoices/receipts, support communications.
5. Technical data: IP address, device identifiers, browser type, log data, cookies and similar technologies.

3. Purposes of processing

We process personal data for lawful purposes connected to our services, including to:

1. onboard you, administer accounts, and verify identity/authority;
2. provide platform features (billing collection, payments, payouts, reporting, integrations);
3. handle inquiries, troubleshooting, and customer support;
4. manage security, fraud prevention/detection, risk controls, audits, and investigations;
5. comply with applicable legal/regulatory obligations;
6. improve our website, products, and user experience;
7. marketing and communications (Section 4), only where permitted and based on your choices.

4. Sources of personal data

We may obtain personal data from:

1. you (forms, onboarding documents, communications);
2. your employer/organisation (if you are a user/representative);
3. service providers involved in verification, fraud detection, analytics, communications, cloud hosting, or payment processing; and/or
4. public/official sources where appropriate for compliance checks.

5. Disclosure of personal data (classes of third parties)

We may disclose personal data to the following classes of third parties where necessary for the purposes above:

1. our related companies (group entities) and professional advisers (auditors, lawyers, consultants);
2. banks, payment networks, and financial institutions involved in processing/settlement;
3. regulators/government authorities where required (e.g., Bank Negara Malaysia, LHDN);
4. vendors/service providers (e.g., cloud hosting, data storage, communications, identity verification, fraud monitoring, analytics, customer support tools);
5. business partners/integration partners (only where needed to deliver requested integrations/features).

6. Cross-border transfers

Where we transfer personal data outside Malaysia (e.g., where a vendor’s servers/support operations are overseas), we will take steps to ensure the transfer is made in accordance with the PDPA requirements on cross-border transfers and appropriate safeguards.

7. Access, correction, and withdrawal of consent

You may request:

1. access to your personal data and information about how we process it;
2. correction of inaccurate/incomplete data;
3. withdrawal of consent, subject to legal/contractual limitations.

8. Cookies and tracking technologies

We use cookies and similar technologies for essential website functions, security, and analytics. You can manage cookies via browser settings; disabling cookies may affect site functionality.

9. Third-party links

Our website may link to third-party sites. We are not responsible for their content or privacy practices.

10. Updates to this Privacy Policy

We may update this policy from time to time. Updates will be posted with a revised effective date.

11. Contact (Data Protection)

For questions, complaints, or to submit a data access/correction/marketing opt-out request, contact:
Email: customersupport@miracle.my