Privacy Policy

1. Introduction

This Privacy Policy explains how Opg Capital Holdings Sdn Bhd ("we", "us" or "our"), as the operator of CreditXpress Plus, collects, uses, processes, stores, protects and discloses personal data when you access or use the application, website, loan application services, customer support channels and related financial services.

We process personal data in accordance with the Personal Data Protection Act 2010 of Malaysia, applicable moneylending and consumer-protection requirements, and other laws and regulatory obligations that apply to our services.

By creating an account, submitting a loan application, using CreditXpress Plus, or granting a device permission after receiving the relevant disclosure, you acknowledge that you have read and understood this Privacy Policy and consent to the processing described below. Where consent is optional, you may refuse or withdraw it, although the related feature or automated assessment may become unavailable.

2. Personal Data We Collect

Depending on the services you request and the permissions you grant, we may collect your name, identity-card or passport number, date of birth, gender, email address, mobile number, residential address, employment and income information, bank-account and payment information, loan application details, repayment information, government-issued identification documents, identity-verification images, customer-service communications, marketing preferences, IP address, device and network information, and other information you submit when registering for or using our services.

Personal data that must be uploaded or retained is transmitted through encrypted channels and stored on protected systems associated with https://www.creditxpressplus.com. We collect only data reasonably connected to identity verification, loan processing, risk control, fraud prevention, account security, service delivery, legal compliance and customer support.

3. Permission-Based Data Collection

CreditXpress Plus requests device permissions only when needed for a clearly stated function. Before requesting sensitive permission, we provide an in-app disclosure explaining the data involved and its purpose. Permission-based data that is uploaded or retained is encrypted in transit and stored on protected systems associated with https://www.creditxpressplus.com.

You may refuse or revoke a permission through your device settings. Revoking a permission does not affect processing already lawfully completed, but may prevent identity verification, document submission, automated risk assessment, repayment reminders or other related functions.

3.1 Location Information

With your explicit permission, CreditXpress Plus may collect approximate or precise location signals while you actively use the application or complete a loan application. We use location information to confirm service availability, support identity and address verification, detect abnormal access, assess fraud risk and protect your account.

We do not use location information for unrelated advertising or continuous unrelated background tracking. Location data that is uploaded or retained is encrypted and stored on protected systems associated with https://www.creditxpressplus.com, and is accessible only to authorised personnel and service providers with a legitimate need.

3.2 Photos, Media, Storage and Files

With your permission, CreditXpress Plus may allow you to select and upload specific photos or files required for a loan application, identity verification, income verification, bank-account verification, agreement execution, repayment evidence or customer support. We do not intentionally scan or upload unrelated personal photos, videos or files.

The files you select are transmitted through HTTPS encryption and stored on protected systems associated with https://www.creditxpressplus.com. They are retained only for the service purpose, legal obligation, dispute handling, fraud prevention or record-keeping period that applies to the relevant file.

3.3 Camera

With your permission, CreditXpress Plus uses the camera only when you actively capture an identity document, selfie, liveness image, verification video, supporting document or repayment evidence. The camera is not used for unrelated background monitoring.

Camera images and videos that you submit are encrypted during transmission and stored on protected systems associated with https://www.creditxpressplus.com. They are used for identity verification, fraud prevention, loan processing, account security and regulatory compliance.

3.4 Device and Identification Information

CreditXpress Plus may collect device model, operating-system version, application version, device identifiers, IP address, language and region settings, network information, SIM or network status, session identifiers, login records, crash diagnostics and security-risk signals.

We use this information to authenticate sessions, detect duplicate or suspicious applications, prevent account takeover, identify device cloning or emulator abuse, troubleshoot technical problems and comply with security obligations. Data that is uploaded or retained is encrypted and stored on protected systems associated with https://www.creditxpressplus.com.

3.5 Installed Applications

With your explicit permission, CreditXpress Plus may collect limited metadata about applications installed on your device, including application name, package name, version, installation time and update time. We do not access private content, messages, files or account information inside other applications.

Installed-application metadata is used only for fraud detection, device-risk assessment, identification of suspicious tools, emulator or cloned-device detection, and prevention of repeated or false loan applications. The metadata is encrypted and stored on protected systems associated with https://www.creditxpressplus.com; it is not sold or used for unrelated advertising.

3.6 Main Account Information

With your explicit permission and where supported by the operating system, CreditXpress Plus may process limited information associated with the primary account configured on your device, such as an account identifier or account status. We use this information for identity-consistency checks, duplicate-registration detection, fraud prevention, account security, risk assessment and loan pre-qualification.

We do not access your account password, email content, private messages, cloud files or unrelated account content. Information that is uploaded or retained is encrypted and stored on protected systems associated with https://www.creditxpressplus.com.

3.7 Calendar Information

With your explicit permission, CreditXpress Plus may process financial calendar information from the previous 12 months and may create or manage loan-service reminders. Relevant entries may include repayment dates, billing dates, salary dates and other financial events connected to repayment planning.

We use calendar information to help prevent missed payments, support repayment scheduling and verify financial-schedule consistency. We do not intentionally collect, modify or delete unrelated personal events. Calendar data that is uploaded or retained is encrypted and stored on protected systems associated with https://www.creditxpressplus.com.

3.8 Microphone and Identity-Verification Recording

With your explicit permission, CreditXpress Plus may use the microphone when you actively record an identity-verification video, complete a voice-verification step, confirm information during the loan process, or provide evidence for customer support or dispute resolution. The microphone is not activated for unrelated or continuous background listening.

Audio and video submitted through this process are used for identity verification, fraud prevention, account security, loan processing and dispute handling. The recording is encrypted during transmission and stored on protected systems associated with https://www.creditxpressplus.com for only as long as necessary for those purposes or applicable legal obligations.

3.9 Call Log

CreditXpress Plus may request Call permission with your consent to support loan verification, fraud prevention, account security, repayment follow-up, and customer service in Malaysia.

When this permission is enabled, we may collect limited call-related information such as phone number, call type, call time, call duration, and call status. We do not record call audio, monitor call content, read your private conversations, or use this information for advertising or resale.

The collected call-related information is encrypted during transmission and securely stored at https://www.creditxpressplus.com. Access is restricted to authorized personnel and trusted service providers only for loan assessment, risk control, compliance review, and customer support.

You may disable Call permission at any time in your device settings. However, disabling this permission may affect identity verification, fraud prevention checks, or certain loan service features.

3.10 Contacts

With your explicit permission, CreditXpress Plus may access contact-directory information, including contact names, phone numbers and available creation or addition dates. We use this information for reference or emergency-contact screening, identity consistency, fraud prevention, account recovery, credit-risk assessment and lawful loan servicing.

Contact information is not sold or used for unrelated marketing. Contact data that is uploaded or retained is transmitted through encrypted channels and stored on protected systems associated with https://www.creditxpressplus.com. Access is limited to authorised functions and personnel, and the data is deleted or anonymised when it is no longer required by the service or law.

3.11 Financial SMS Information

With your explicit permission, CreditXpress Plus may process financial SMS messages from the previous 12 months. The scope is limited to messages that appear related to banking, salary payments, payment confirmations, wallet transactions, loan disbursement, loan repayment, transaction alerts and other financial activity. Relevant fields may include sender, timestamp, transaction description and amount.

We use financial SMS information for credit-risk assessment, repayment-capacity analysis, fraud prevention, identity consistency and loan review. We do not intentionally collect private social messages unrelated to financial services. Financial SMS data is encrypted during transmission and stored on protected systems associated with https://www.creditxpressplus.com; it is not sold or used for unrelated advertising.

4. Purposes of Processing

We process personal data to register and maintain accounts; verify identity and eligibility; review loan applications; assess affordability and credit risk; prevent fraud and unauthorised access; prepare and perform loan agreements; disburse funds and process repayments; manage overdue accounts; provide support; resolve complaints and disputes; improve service security and performance; maintain business, audit and accounting records; send service communications; and comply with legal, regulatory, court and government requirements.

Marketing communications are sent only where permitted by law and subject to any required consent. You may opt out of marketing without affecting essential account, security, loan-status or repayment communications.

5. Legal Basis and Consent

We rely on consent, steps requested before entering a contract, performance of a contract, compliance with legal obligations, and legitimate interests in fraud prevention, information security, responsible lending, debt administration, service improvement and legal protection, as applicable to the processing activity.

Where processing is based on consent, you may withdraw that consent by changing device permissions or contacting us. Withdrawal does not affect processing completed before withdrawal and may limit the service that depends on the relevant data.

6. Disclosure to Third Parties

We may disclose personal data only where necessary to banks and payment providers, credit-reporting or credit-reference organisations where legally permitted, identity-verification providers, fraud-prevention and risk-control providers, cloud and technical-service providers, customer-support providers, professional advisers, auditors, lawful debt-management providers, regulators, courts, law-enforcement agencies and other competent authorities.

Recipients must process personal data only for authorised purposes and apply appropriate confidentiality and security safeguards. We do not sell personal data. We may also disclose information where required by law, to enforce an agreement, protect users or our legal rights, or investigate suspected fraud or security incidents.

7. International Transfers

Personal data may be processed in Malaysia or in another jurisdiction where an authorised service provider operates secure infrastructure. Where data is transferred across borders, we take reasonable steps to ensure that the transfer complies with applicable law and is protected by contractual, organisational and technical safeguards. Our primary website and disclosed storage endpoint is https://www.creditxpressplus.com.

8. Data Retention and Deletion

We retain personal data only for as long as necessary for the purpose for which it was collected and for any additional period required by law, licence conditions, accounting obligations, fraud prevention, dispute resolution, debt administration or enforcement of legal rights. Historical financial SMS and financial calendar access is limited to the previous 12 months at the time of collection.

When retention is no longer necessary, we delete, anonymise or securely destroy the data. A deletion request may be limited where we must retain information for an active agreement, outstanding obligation, legal claim, regulatory requirement, fraud investigation or other lawful reason.

9. Security Measures

We maintain reasonable administrative, technical and physical safeguards, including HTTPS or equivalent encryption in transit, access controls, authentication measures, role-based permissions, confidentiality obligations, security logging, monitoring, backup controls, fraud-detection measures and periodic security review.

No transmission or storage system can be guaranteed completely secure. If a security incident creates a legally reportable risk, we will take reasonable containment, investigation and notification measures required by applicable law.

10. Cookies and Similar Technologies

Our website may use cookies and similar technologies to maintain sessions, remember preferences, measure anonymous usage, diagnose errors, prevent abuse and improve service performance. You may control cookies through browser settings, although disabling essential cookies may affect website functionality.

11. Your Rights

Subject to the Personal Data Protection Act 2010 and other applicable law, you may request access to personal data we hold about you, correction of inaccurate or outdated data, information about processing and disclosure, withdrawal of consent, restriction of direct marketing, or deletion where no lawful retention ground applies.

To exercise a right, contact us at opgcapital3@gmail.com, call +60 11-6993 6134, or write to C-10-7 KL Trillion, 338 Jalan Tun Razak, 50400 Kuala Lumpur, Malaysia. We may request reasonable identity verification before acting on a request.

12. Children's Privacy

CreditXpress Plus is intended only for persons aged 18 or older who are legally eligible to use the financial services offered. We do not knowingly collect personal data from a person under 18. If we become aware that a minor's data was collected without a lawful basis, we will take reasonable steps to delete it.

13. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in law, regulatory requirements, technology, permissions or services. Material changes will be communicated through the application, website, email, SMS or another appropriate channel before or when the changes take effect, as required by law. The effective date at the beginning of the Policy identifies the current version.

14. Contact and Complaints

You may use these contact details for privacy questions, access or correction requests, consent withdrawal, complaints, or concerns about how your personal data is handled.