How we collect, use, disclose and protect personal data in connection with our services and commercial activities.
This Personal Data Protection Notice (“Notice”) is issued by Magnuscale Resource and Management Sdn. Bhd. (202501002223) (“Magnus”, “we”, “us” or “our”) pursuant to the Personal Data Protection Act 2010 [Act 709], as amended from time to time (“PDPA”).
For the purposes of the PDPA, Magnus acts as a data controller in respect of personal data for which we determine the purposes and means of processing.
This Notice explains how we collect, use, disclose, store and otherwise process personal data in connection with our commercial activities and services.
This Notice should be read together with our Privacy Policy and, where applicable, the relevant engagement letter, consent, authorisation or other contractual documentation.
Depending on the nature of your enquiry, relationship or engagement with Magnus, we may process personal data including:
Where particular information constitutes sensitive personal data under the PDPA, it will be processed only in accordance with applicable legal requirements.
We may obtain personal data:
directly from you;
through our website or enquiry forms;
through telephone, email, WhatsApp or other communications;
during meetings or consultations;
from documents and information supplied by you;
from persons whom you have authorised;
from financial institutions or other third parties where access or disclosure has been lawfully authorised;
from credit-reporting or other lawful information sources where applicable and authorised;
from publicly available sources where lawful and relevant; and
through website, security or information-system technologies.
Personal data may be processed for purposes including:
Personal data may, where appropriate and lawful, be disclosed to the following classes of third parties:
financial institutions and financing providers where disclosure is authorised and relevant to an engagement;
service providers and data processors supporting information technology, hosting, communications, document management, security, administration or related functions;
professional advisers, including lawyers, accountants, auditors or compliance advisers;
authorised representatives or persons whom you have authorised us to communicate with;
regulators, courts, governmental bodies, law-enforcement agencies or other competent authorities where required or permitted by law;
parties involved in the establishment, exercise or defence of legal rights; and
other parties where disclosure is reasonably necessary for an agreed purpose and is lawful under the PDPA.
Magnus does not sell personal data.
The provision of personal data is generally voluntary at the initial enquiry stage.
The provision of personal data is generally voluntary at the initial enquiry stage.However, certain personal data may become obligatory where it is reasonably necessary for Magnus to:
verify identity;
evaluate your circumstances;
perform an agreed advisory service;
prepare an assessment or report;
coordinate an authorised financing-related process;
comply with legal, regulatory, professional, audit or record-keeping obligations; or
administer the engagement.
Where required personal data is not provided, Magnus may be unable to:
Where consent is required by law, Magnus will obtain the appropriate consent before carrying out the relevant processing.
Where applicable, you may communicate choices regarding particular processing activities to us through the contact details in this Notice.
Withdrawal of consent will not affect processing already lawfully carried out before withdrawal and may affect our ability to continue providing services where the relevant information is necessary.
Magnus will take practical and reasonable steps to protect personal data against:
loss;
misuse;
unauthorised or accidental access;
unauthorised disclosure;
alteration; and
destruction.
Where a service provider processes personal data on our behalf, we will take reasonable steps appropriate to the circumstances to require suitable security and confidentiality measures.
Personal data will not be retained longer than necessary for the purposes for which it is processed, subject to applicable legal, regulatory, contractual, professional, audit and record-retention requirements.
Where personal data is no longer required, reasonable steps will be taken to securely destroy, permanently delete or anonymise the information, where appropriate.
We take reasonable steps to ensure that personal data is accurate, complete, not misleading and kept up to date having regard to the purpose for which it is processed.
You are responsible for providing accurate information and should notify Magnus where relevant personal information has changed or requires correction.
Subject to the PDPA and applicable exceptions, you may request:
access to personal data held by Magnus; and
correction of personal data that is inaccurate, incomplete, misleading or not up to date.
Magnus may require verification of identity before acting on a request and may apply any procedure or fee permitted by applicable law.
Subject to applicable law and the circumstances of the processing, you may have rights to:
withdraw consent to processing where applicable;
prevent processing likely to cause substantial damage or substantial distress where the statutory conditions are satisfied;
prevent processing for direct-marketing purposes;
request data portability in accordance with applicable PDPA requirements, including technical feasibility and compatibility of data format; and
exercise other rights provided by law from time to time.
Requests may be subject to statutory exceptions, verification and procedural requirements.
Magnus will process personal data for direct-marketing purposes only in accordance with applicable law.
Where you receive direct marketing from us, you may request that such processing cease by contacting us using the details below or through an available opt-out mechanism.
Certain service providers, technology providers, communication platforms or cloud infrastructure used by Magnus may involve the transfer, access, hosting or processing of personal data outside Malaysia.
Where personal data is transferred to a place outside Malaysia, Magnus will take reasonable steps to ensure that the transfer is carried out in accordance with section 129 of the Personal Data Protection Act 2010 and applicable guidance issued by the Personal Data Protection Commissioner.
Such transfer will be undertaken only where a condition permitted under section 129 is satisfied and appropriate safeguards, precautions or due-diligence measures required in the circumstances are applied.
Where appropriate, Magnus will also take reasonable steps to assess the protection applicable to personal data transferred outside Malaysia.
Magnus may engage third-party service providers to process personal data on our behalf.
Where applicable, we will take reasonable steps to ensure that such providers implement appropriate security measures and process personal data consistently with applicable legal requirements and our instructions.
Third-party platforms such as WhatsApp may also process information independently under their own privacy terms.
Magnus will assess and manage any personal data breach in accordance with the PDPA and applicable requirements issued by the Personal Data Protection Commissioner.
Where notification to the Commissioner or affected data subjects is legally required, Magnus will take the applicable notification steps.
If you provide personal data concerning another individual, you represent that you are authorised to provide the information or have otherwise complied with applicable requirements for doing so.
Where appropriate, you should ensure that the individual has been informed of this Notice.
Our services are generally directed to adults and business owners.
Where personal data relating to a minor or person lacking legal capacity is required, Magnus will process such information only where appropriate and in accordance with applicable law and any necessary consent or authority.
Questions, access requests, correction requests, withdrawal notices or other personal-data enquiries may be directed to:
Registration Number: 202501002223
Please provide sufficient information to allow us to verify your identity and understand the request.
If you believe that your personal data has been processed in a manner inconsistent with applicable personal-data-protection requirements, you may contact Magnus using the details above. You may also have the right to make a complaint to the Personal Data Protection Commissioner of Malaysia in accordance with applicable law.
Magnus may update this Notice from time to time to reflect changes in law, regulation, guidance, technology, our operations or our processing activities. The latest version will be made available on our website.
This Notice is made available in English and Bahasa Malaysia.
In the event of any inconsistency arising from translation, the versions should be interpreted, as far as possible, consistently with the requirements of applicable Malaysian law.
© 2026 Magnuscale Resource and Management Sdn Bhd (202501002223). All rights reserved.
