What We Collect and Why It Matters to You
We collect personal information you provide directly — your name, email address, date of birth, and the payment credentials linked to your account wallet. When you fund your account through Touch 'n Go eWallet, Boost, or GrabPay, we record transaction references so we can match deposits
-
1
and process withdrawals accurately. We also collect device identifiers, browser session data, and IP addresses to protect your account from unauthorised access. This data is processed to fulfil your account contract with us, to comply with applicable obligations under Malaysian law, and to detect activity that
-
2
may indicate fraud or account misuse. We do not sell, rent, or trade your personal data to unaffiliated third parties for their own marketing purposes. Where we share data with service partners — payment processors, identity-verification providers, or fraud-screening services — those parties are contractually bound
-
3
to use it only for the purpose we specify. Retention periods vary by data type: account registration records are held for as long as your account remains active and for a further period required by applicable law; transaction logs tied to your DuitNow or FPX transfers
-
4
are retained in line with financial-record obligations. Access to your data is restricted to staff whose role requires it, and all stored data is encrypted. Your eligibility to use our platform depends on local law and is available only where local law permits.
Service availability depends on eligible regions and local law. Users should check local rules before opening an account.