Privacy Policy / Personal Data Protection Notice

‍

Website, Online Trading Portal and Electronic Services

This Privacy Policy / Personal Data Protection Notice (“PrivacyPolicy”) explains how SJ Securities Sdn Bhd [Company No.: 198501009222 (141671-T)] (“SJ Securities”, “SJS”, “Company”, “we”, “our” or “us”) collects, uses, processes, stores, discloses, transfers and protects personal data in connection with our website, online trading portal, mobile applications, electronic platforms, digital services, client accounts and any related services provided by us from time to time.

This Privacy Policy is issued in accordance with the Personal Data Protection Act 2010 of Malaysia (“PDPA”), as amended from time to time, and other applicable laws, rules, regulations, guidelines and requirements.

By accessing our website, using our online trading portal, opening or maintaining an account with us, submitting information to us, communicating with us, using our services or continuing to deal with us, you acknowledge that you have read and understood this Privacy Policy and, where applicable, consent to the collection, use, processing, disclosure, transfer and retention of your personal data in accordance with this Privacy Policy.

If you do not agree with this Privacy Policy, you should not provide your personal data to us or use our website, portal, platform or services.

‍1. Scope of this Privacy Policy

1.1     This Privacy Policy applies to personal data collected, used, processed, stored, disclosed or transferred by SJ Securities in connection with:

1. our website at www.sjsec.com.my;
2. SJenie, online trading portal, client portal, mobile applications and other electronic services;
3. account opening, client onboarding, trading accounts, CDS accounts, nominee accounts, margin accounts and other accounts or facilities;
4. securities trading, settlement, custody, nominee, corporate finance, research, client servicing and other capital market services;
5. communications with clients, prospective clients, authorised representatives, dealers, remisiers, employees, agents, vendors, service providers and other persons;
6. regulatory, legal, compliance, audit, risk management, operational and administrative matters; and
7. any other services, facilities, transactions or dealings with SJ Securities.

1.2     This Privacy Policy should be read together with our Terms of Use, Disclaimer, account opening forms, client agreements, trading terms, risk disclosure statements, product terms, service terms and any other notices or documents issued by SJ Securities from time to time.

1.3     Where there is any inconsistency between this Privacy Policy and any specific consent, agreement or notice relating to a particular product, service or transaction, the specific consent, agreement or notice shall prevail to the extent of such inconsistency.

‍

2. Personal Data We May Collect

2.1     “Personal data” means any information in respect of commercial transactions which relates directly or indirectly to an individual who is identified or identifiable from that information or from that and other information in our possession.

2.2     The personal data we may collect includes, without limitation:

1. name, identification number, passport number, nationality, date of birth, gender, marital status and other identification details;
2. residential address, correspondence address, email address, telephone number, mobile number and other contact details;
3. occupation, employer details, business details, source of income, source of wealth, financial position, investment experience, risk profile and investment objectives;
4. bank account details, payment details, settlement instructions, CDS account details, trading account details and other account-related information;
5. tax residency, FATCA / CRS information, declarations and regulatory classification information;
6. signatures, photographs, video images, voice recordings, CCTV images, call recordings and electronic communications;
7. login credentials, user ID, device information, IP address, browser type, operating system, cookies, usage data, access logs, system logs, audit trails and online activity information;
8. information relating to transactions, orders, trades, holdings, portfolios, balances, limits, settlements, payments, margin positions and account activities;
9. information relating to complaints, enquiries, instructions, communications, investigations, disputes, legal proceedings or regulatory matters;
10. personal data of authorised persons, directors, shareholders, beneficial owners, controllers, partners, trustees, representatives, guarantors, nominees, attorneys, contact persons, beneficiaries or other related persons; and
11. any other information provided to us or obtained by us in connection with our business, services, legal obligations or regulatory requirements

2.3     Where you provide personal data relating to another person, including your authorised representative, director, shareholder, beneficial owner, contact person, family member or other third party, you represent and warrant that you have obtained the necessary consent or authority to provide such personal data to SJ Securities and for us to process such personal data in accordance with this Privacy Policy.

3. Sources of Personal Data

3.1     We may collect personal data from various sources, including:

1. directly from you through account opening forms, online forms, physical forms, applications, declarations, documents, instructions, communications and transactions;
2. through our website, portal, platform, mobile applications, electronic services, cookies, system logs and digital channels;
3. from any other source where permitted or required by law, regulation, rule, directive, guideline, court order, contractual obligation or legitimate business requirement.
4. from your authorised representatives, dealers, remisiers, agents, nominees, employers, company representatives, professional advisers or other persons acting on your behalf;
5. from publicly available sources, including company searches, bankruptcy searches, sanctions lists, politically exposed person lists, adverse media searches, websites, public registers and other lawful sources; and
6. from Bursa Malaysia, Bursa Malaysia Depository Sdn Bhd, Bursa Malaysia Securities Clearing Sdn Bhd, Securities Commission, Bank Negara Malaysia, Companies Commission of Malaysia, Inland Revenue Board of Malaysia, law enforcement agencies, courts, regulators, exchanges, depositories, clearing houses and other authorities;
7. from banks, payment service providers, custodians, nominees, credit reporting agencies, screening databases, identity verification providers, eKYC providers, AML/CFT screening providers, technology providers and other third-party service providers;
   ‍

4. Purposes for Collecting and Processing Personal Data

4.1     SJ Securities may collect, use, process, store, disclose and transfer personal data for the following purposes:

1. to process account opening applications, onboarding, identity verification, suitability assessment, risk profiling and client due diligence;
2. to provide, operate, maintain and administer trading accounts, CDS accounts, nominee accounts, margin accounts, cash upfront accounts, online trading accounts and other accounts or facilities;
3. to provide securities trading, order execution, settlement, custody, nominee, corporate finance, research, client servicing and other capital market services;
4. to process instructions, orders, trades, transactions, payments, settlements, transfers, withdrawals, deposits and account activities;
5. to provide access to SJenie, online trading portal, client portal, mobile applications, market data, electronic services and digital platforms;
6. to communicate with you, respond to enquiries, provide notices, statements, contract notes, confirmations, alerts, reminders and service updates;
7. to verify your identity, authority, eligibility, account status, instructions, transactions and access rights;
8. to conduct anti-money laundering, counter financing of terrorism, counter proliferation financing, sanctions, politically exposed person, adverse media, fraud prevention and other regulatory screening;
9. to comply with legal, regulatory, supervisory, exchange, depository, clearing, tax, audit, risk management, reporting and record-keeping obligations;
10. to monitor, record, review and analyse communications, transactions, account activities, system usage, online access, instructions and trading activities;
11. to detect, prevent, investigate and respond to fraud, unauthorised access, suspicious activity, market misconduct, cyber incidents, operational incidents, complaints, disputes and breaches;
12. to manage credit risk, margin risk, settlement risk, operational risk, technology risk, cybersecurity risk, legal risk, compliance risk and business risk;
13. to maintain internal records, audit trails, management reports, risk registers, compliance reports, regulatory submissions and business records;
14. to enforce our rights, recover debts, manage claims, conduct legal proceedings, respond to subpoenas, court orders, regulatory requests or lawful demands;
15. to manage business operations, administration, finance, accounting, internal controls, governance, training, quality assurance and business continuity;
16. to conduct system maintenance, testing, upgrades, migration, cybersecurity monitoring, access control, data backup, disaster recovery and technology support;
17. to engage, manage and monitor vendors, service providers, professional advisers, auditors, consultants, insurers, banks, custodians, nominees and other third parties;
18. to provide information about products, services, events, campaigns, notices, updates or educational materials, subject to applicable laws and your marketing preferences;
19. to conduct surveys, client service reviews, service improvement, analytics, research and internal business planning;
20. to comply with any requirement imposed by Bursa Malaysia, Securities Commission, Bank Negara Malaysia, Inland Revenue Board of Malaysia, Companies Commission of Malaysia, law enforcement agencies, courts or other authorities; and
21. for any other purpose that is incidental, ancillary or related to the above purposes or permitted by law.
    ‍

5. Legal Basis and Consent

5.1     Where required by law, SJ Securities will obtain your consent for the collection, use, processing, disclosure or transfer of your personal data.

5.2     Your consent may be given expressly, including through signing forms, submitting applications, clicking “I Agree”, using our website, portal, platform or services, or otherwise providing personal data to us.

5.3     In certain circumstances, SJ Securities may process personal data without further consent where permitted or required by law, including where processing is necessary for:

1. performance of a contract with you;
2. compliance with legal, regulatory, exchange, depository, clearing, tax, audit or court requirements;
3. prevention or detection of crime, fraud, market misconduct, money laundering, terrorism financing, proliferation financing or unauthorised activity;
4. protection of our legal rights, business operations, systems, clients, employees or third parties;
5. compliance with requests from regulators, authorities, courts, law enforcement agencies or market operators; or
6. any other lawful basis recognised under applicable law.

5.4     If you withdraw your consent or refuse to provide required personal data, SJ Securities may be unable to open, maintain or operate your account, provide services, process transactions, comply with regulatory obligations or continue dealing with you.

5.5     Withdrawal of consent shall not affect any processing carried out before the withdrawal or any processing which SJ Securities is required or permitted to continue under law, regulation, contract, regulatory requirement or legitimate business necessity.

6. Disclosure of Personal Data

6.1     SJ Securities may disclose personal data to the following parties where necessary or appropriate for the purposes stated in this Privacy Policy:

1. Bursa Malaysia, Bursa Malaysia Depository Sdn Bhd, Bursa Malaysia Securities Clearing Sdn Bhd, Securities Commission, Bank Negara Malaysia, Inland Revenue Board of Malaysia, Companies Commission of Malaysia and other regulators, exchanges, depositories, clearing houses, authorities, courts or law enforcement agencies;
2. banks, payment service providers, custodians, nominees, settlement agents, registrars, issuing houses, share registrars, transfer agents and other market intermediaries;
3. dealers, remisiers, authorised representatives, agents, nominees, attorneys, trustees, professional advisers, auditors, consultants, insurers and service providers;
4. technology providers, order management system providers, trading system providers, market data providers, cloud service providers, cybersecurity providers, data centre providers, eKYC providers, identity verification providers, AML/CFT screening providers and other vendors;
5. debt collection agencies, legal advisers, courts, tribunals, dispute resolution bodies and enforcement agencies;
6. related companies, affiliates, successors, assigns, transferees, business partners or parties involved in any corporate exercise, restructuring, merger, acquisition, transfer, sale or disposal of business or assets;
7. your authorised persons, representatives, joint account holders, directors, shareholders, beneficial owners, controllers, guarantors, contact persons or persons acting on your behalf;
8. any party to whom disclosure is required or permitted by law, regulation, rule, directive, guideline, court order, contractual obligation or regulatory requirement; and
9. any other party where you have given consent or where disclosure is necessary for the purposes stated in this Privacy Policy.

6.2     SJ Securities shall take reasonable steps to ensure that personal data disclosed to third parties is limited to what is necessary for the relevant purpose.

6.3     Where we engage third-party service providers to process personal data on our behalf, we will take reasonable steps to require such service providers to protect the personal data and use it only for the purposes for which it was disclosed.
‍

7. Cross-Border Transfer of Personal Data

7.1    Personal data may be transferred, stored, processed or accessed outside Malaysia where necessary for the purposes stated in this Privacy Policy, including where our service providers, vendors, systems, cloud services, data centres, support teams, affiliates, regulators, exchanges or information sources are located outside Malaysia.

7.2    Where personal data is transferred outside Malaysia, SJ Securities will take reasonable steps to ensure that such transfer is carried out in accordance with applicable laws and that appropriate safeguards are applied where required.

7.3    By providing personal data to SJ Securities or using our services, you acknowledge and agree that your personal data may be transferred, stored, processed or accessed outside Malaysia where necessary for the purposes stated in this Privacy Policy.
‍

8. Security of Personal Data

8.1    SJ Securities will take reasonable technical, organisational and administrative measures to protect personal data against unauthorised access, disclosure, alteration, loss, misuse, destruction or damage.

8.2    Such measures may include access controls, authentication controls, system monitoring, encryption where appropriate, firewalls, anti-malware protection, backup procedures, audit trails, internal policies, staff training and vendor management controls.

8.3    However, no method of transmission over the internet, electronic communication, online trading platform, mobile application or digital storage is completely secure. SJ Securities does not guarantee absolute security of personal data transmitted through or stored in any electronic system.

8.4    You are responsible for safeguarding your login credentials, password, trading PIN, security code, device, email account, mobile number and authentication method. You must notify SJ Securities immediately if you suspect any unauthorised access, loss, compromise or misuse of your account or credentials.
‍

9. Personal Data Breach Notification

9.1     SJ Securities will take reasonable steps to detect, assess, manage and respond to any personal data breach involving personal data under its control.

9.2     Where required by applicable law, SJ Securities will notify the Personal Data Protection Commissioner and/or affected data subjects of a personal data breach within the prescribed time and manner.

9.3     SJ Securities may also take such remedial actions as it considers appropriate, including investigation, containment, recovery, notification, enhancement of controls and engagement with relevant regulators, authorities, service providers or affected parties.
‍

10. Personal Data Contact Person

10.1    SJ Securities may designate an officer or contact person to handle enquiries,access requests, correction requests, complaints, withdrawal of consent orother matters relating to client personal data.

10.2    For client personal data matters,  the designated contact person shall be the Complaints Officer,  or such other officer as SJ Securities may designate from time to time.

10.3    The designated contact person may be contacted using the contact details stated in this Privacy Policy.
‍

11. Accuracy and Updating of Personal Data

11.1    You are responsible for ensuring that all personal data provided to SJ Securities is accurate, complete, current and not misleading.

11.2    You must promptly notify SJ Securities of any change to your personal data, including your address, contact details, bank account details, employment details, financial information, tax residency, authorised persons or other relevant information.

11.3    SJ Securities may request updated information, documents, declarations or confirmations from time to time to comply with legal, regulatory, operational, risk management or internal requirements.

11.4    If you fail to provide accurate, complete or updated personal data, SJ Securities may be unable to provide services, process transactions, maintain your account or comply with regulatory obligations
‍

12. Retention of Personal Data

12.1     SJ Securities will retain personal data for as long as necessary to fulfil the purposes for which it was collected, including to provide services, maintain accounts, comply with legal and regulatory obligations, resolve disputes, enforce agreements, defend claims, conduct audits and maintain business records.

12.2     Without limiting Clause 12.1, SJ Securities may retain personal data for at least seven (7) years after the termination of any account, facility, transaction, contract or business relationship, or for such longer period as may be required or permitted under applicable laws, regulations, regulatory requirements, audit requirements, tax requirements, AML/CFT/CPF requirements, limitation periods, dispute resolution requirements or legitimate business purposes.

12.3    When personal data is no longer required, SJ Securities will take reasonable steps to securely destroy, delete, anonymise or restrict access to such personal data in accordance with applicable laws and internal policies.

13. Cookies and Online Tracking

13.1     Our website, portal, platform and electronic services may use cookies, web beacons, pixels, log files, analytics tools or similar technologies to collect information about your access and usage.

13.2     Such information may include IP address, browser type, device type, operating system, pages visited, date and time of access, session duration, referring website, login activity, usage patterns and other technical information.

13.3     We may use cookies and similar technologies for the following purposes:

1. to enable website and portal functionality;
2. to maintain login sessions and authentication;
3. to enhance security and detect suspicious activity;
4. to remember user preferences;
5. to analyse website traffic and usage;
6. to improve user experience and service performance;
7. to conduct system monitoring, troubleshooting and maintenance; and
8. to comply with legal, regulatory, security and operational requirements.

13.4     You may adjust your browser settings to refuse or disable cookies. However, if you disable cookies, certain website, portal, platform or electronic service functions may not operate properly or may become unavailable.
‍

14. Direct Marketing and Service Communications

14.1     SJ Securities may use your contact details to send service-related communications, including account notices, contract notes, statements, regulatory notices, system alerts, security alerts, operational updates and important service information.

14.2     Where permitted by law and subject to your consent or marketing preferences, SJ Securities may also send information relating to products, services, events, campaigns, educational materials, market updates or other communications which may be of interest to you.

14.3     SJ Securities will not disclose your personal data to third parties for their own direct marketing purposes unless you have consented to such disclosure or where permitted by law.

14.4     You may opt out of receiving marketing communications by contacting SJ Securities through the contact details stated in this Privacy Policy or by following the unsubscribe instructions, where available.

14.5     Please note that even if you opt out of marketing communications, SJ Securities may continue to send you service-related, account-related, transactional, regulatory, legal, security or operational communications.
‍

15. Rights of Access and Correction

15.1     Subject to the PDPA and applicable laws, you may request access to or correction of your personal data held by SJ Securities.

15.2     Any request for access or correction must be made in writing to SJ Securities using the contact details stated in this Privacy Policy.

15.3     SJ Securities may require verification of your identity before processing any access or correction request.

15.4     SJ Securities may refuse or limit access or correction where permitted by law, including where the request is frivolous, vexatious, disproportionate, affects the rights of others, relates to confidential commercial information, legal privilege, regulatory investigation, enforcement action or where disclosure is not required under applicable law.

15.5     SJ Securities may charge a prescribed fee, where permitted by law, for processing access requests.
‍

16. Personal Data of Minors

16.1     Our website, portal, platform and services are not intended for persons below eighteen (18) years old unless permitted under applicable law and with the necessary consent or authorisation from a parent, guardian or legal representative.

16.2     If you provide personal data relating to a minor, you represent and warrant that you have the necessary authority and consent to do so.
‍

17. CCTV, Call Recording and Monitoring

17.1     SJ Securities may use CCTV, call recording, email monitoring, system monitoring, access logs and other monitoring tools for security, regulatory, operational, audit, training, quality assurance, dispute resolution, investigation and record-keeping purposes.

17.2     Telephone conversations, electronic communications, online activities, system access, trading instructions and other interactions with SJ Securities may be recorded, monitored, retained and used as evidence in the event of any dispute, investigation, regulatory enquiry or legal proceeding.

17.3     SJ Securities’ records, including call recordings, system logs, electronic records and audit trails, may be relied upon by SJ Securities, subject to applicable laws and internal procedures.
‍

18. Third-Party Websites and Services

18.1     Our website, portal, platform or electronic services may contain links to third-party websites, platforms, applications or services.

18.2     SJ Securities is not responsible for the privacy practices, security, content, terms, policies or conduct of any third-party website, platform, application or service.

18.3     Your access to and use of third-party websites, platforms, applications or services is at your own risk and subject to the privacy policies and terms of the relevant third parties.
‍

19. Data Relating to Corporate Clients and Representatives

19.1     Where a client is a corporation, partnership, trust, association or other legal entity, SJ Securities may collect and process personal data relating to its directors, shareholders, beneficial owners, controllers, partners, trustees, officers, employees, authorised signatories, representatives, contact persons, guarantors and other related individuals.

19.2     The corporate client shall ensure that all such individuals have been informed of this Privacy Policy and that all necessary consents, notices or authorisations have been obtained for SJ Securities to collect, use, process, disclose and retain their personal data in accordance with this Privacy Policy.

19.3     The corporate client shall assist SJ Securities in providing updated information, documents and confirmations relating to such individuals where required for legal, regulatory, AML/CFT/CPF, tax, audit, operational or risk management purposes.
‍

20. Failure to Provide Personal Data

20.1     Where personal data is required by SJ Securities for account opening, client due diligence, transaction processing, regulatory compliance, service provision or contractual purposes, failure to provide such personal data may result in SJ Securities being unable to:

1. process your application;
2. open, maintain or operate your account;
3. provide products, services, facilities or access to electronic services;
4. process orders, transactions, payments, settlements or withdrawals;
5. comply with legal, regulatory, tax, audit or reporting obligations;
6. respond to enquiries, complaints or requests;
7. verify your identity, authority, eligibility or instructions; or
8. continue the business relationship with you.

20.2     SJ Securities may reject, suspend, restrict or terminate any account, service, transaction or relationship where required personal data is not provided or cannot be verified.
‍

21. Changes to this Privacy Policy

21.1     SJ Securities may amend, vary, supplement, replace or update this Privacy Policy from time to time.

21.2     Any updated version may be made available on our website, portal, platform, client notice, email, statement message or any other method determined by SJ Securities.

21.3     Your continued use of our website, portal, platform, services or continued dealings with SJ Securities after the updated Privacy Policy is made available shall constitute your acknowledgement of the updated Privacy Policy.

21.4     You are encouraged to review this Privacy Policy periodically.
‍

22. Language

22.1     This Privacy Policy may be issued in English and Bahasa Malaysia.

22.2     In the event of any inconsistency between the English version and any translated version, the English version shall prevail, unless otherwise required by applicable law.
‍

23. Contact Us

If you have any questions, requests, complaints or enquiries relating to this Privacy Policy or your personal data, please contact:

SJ Securities Sdn Bhd
26, Jalan Pendaftar U1/54, Temasya Glenmarie,
40150 Shah Alam, Selangor Darul Ehsan, Malaysia.

Attention: Complaints Officer
Email: complaint@sjsec.com.my
Telephone: 03-5567 3000
Website: www.sjsec.com.my
‍

24. Acknowledgement

By accessing, browsing, registering, logging in, using or continuing to use SJ Securities’ website, portal, platform, SJenie, online trading system, electronic services or by opening, maintaining or operating an account with SJ Securities, you acknowledge that:

1. you have read and understood this Privacy Policy;
2. you understand the purposes for which your personal data may be collected, used, processed, disclosed, transferred and retained;
3. you agree that SJ Securities may process your personal data in accordance with this Privacy Policy, applicable laws, regulatory requirements and relevant agreements;
4. you confirm that all personal data provided by you is accurate, complete and up to date;
5. where you provide personal data of another person, you confirm that you have obtained the necessary consent or authority to do so; and
6. you understand that failure to provide required personal data may affect SJ Securities’ ability to provide services, maintain your account or continue dealing with you.‍‍

‍