Privacy Policy & PDPA Notice

Pertubuhan Kebajikan Amal En Xin Negeri Sembilan ("the Society", "En Xin Charity", "we", "us", or "our") values the privacy of our donors, volunteers, beneficiaries, and visitors. This Privacy Notice is issued in compliance with the Personal Data Protection Act 2010 of Malaysia ("PDPA") and explains how we collect, use, process, safeguard, and retain your personal data.

1. Personal Data We Collect

Depending on your interaction with us (such as making a charitable donation, registering as a volunteer, submitting an enquiry, or enrolling in our care centres), we may collect and process personal data including but not limited to:

• Identification Details: Full name, Identity Card (NRIC) number or Passport number, nationality, and date of birth.
• Contact Information: Postal address, telephone/mobile number, and email address.
• Donation & Transaction Records: Donation amounts, transaction date and time, payment method, bank transfer proof, and payment reference identifiers issued by our payment gateway. (Note: We do NOT collect or store your complete credit/debit card numbers or CVV codes; online payments are encrypted and processed directly by our licensed payment gateway provider).
• Volunteer & Operational Records: Emergency contact information, skills, availability, and background information necessary for safe community volunteering.
• Visual Media: Photographs and video recordings captured during charitable distributions, community events, and centre activities.

2. Source of Personal Data

We obtain personal data directly from you when you:

• Submit our online donation form or bank transfer notification.
• Communicate with us via WhatsApp, telephone, email, or contact forms.
• Register to attend events, sponsor meal drives, or apply as a volunteer.
• Visit our centres or participate in our welfare programmes.

3. Purpose of Processing Personal Data

Your personal data is processed strictly for legitimate charitable and legal purposes, including:

• Generating, issuing, and delivering official donation receipts.
• Complying with statutory accounting, auditing, and annual reporting obligations required by the Registrar of Societies (ROS) and Malaysian laws.
• Verifying and reconciling payment transactions with our bank and licensed payment gateway.
• Communicating operational updates, administrative notices, and responses to enquiries or complaints.
• Safeguarding vulnerable beneficiaries, children, and volunteers across our care facilities.

4. Disclosure of Personal Data

We maintain strict confidentiality over your personal data. We will not sell, rent, lease, trade, or commercially disclose your personal data to any commercial third party. Personal data may only be shared with:

• Licensed Payment Gateway Providers: Razer Merchant Services Sdn Bhd (Fiuu) for secure transaction processing.
• Professional Advisors & Auditors: External certified auditors and legal advisors bound by professional confidentiality.
• Government Authorities & Law Enforcement: Official regulatory authorities (such as the Registrar of Societies or law enforcement agencies) only where strictly required by Malaysian statutory legislation or court order.

5. Security & Data Retention

We employ technical, organisational, and administrative safeguards to protect your personal data from unauthorised access, loss, misuse, modification, or disclosure. Online donation pages are protected with SSL/TLS encryption.

Personal data will be retained only for as long as necessary to fulfil the purposes for which it was collected, or as required by Malaysian law (for example, financial and receipting records are retained for seven (7) years in compliance with statutory audit standards).

6. Beneficiary Media & Photo Removal Policy

To demonstrate accountability and transparency to our donors and community supporters, En Xin Charity documents charitable drives, food distributions, and centre events through photographs and videos. We make every reasonable effort to respect beneficiary dignity and obtain prior verbal or written consent.

7. Your Rights Under the PDPA

Under the Personal Data Protection Act 2010, you have the following rights regarding your personal data:

• Right of Access: Request a copy of your personal data held by us.
• Right to Rectification: Request the correction of any incomplete, inaccurate, or outdated personal data.
• Right to Limit Processing: Request restrictions on how your data is processed.
• Right to Withdraw Consent: Withdraw your consent for non-statutory communications at any time.

8. Contact Our Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact our administrative office: