1. Overview

Ai Business Solutions Sdn Bhd (Registration No. 1227830-P), operating the IMAN+ and AIVEX brands at imanplus.my ("IMAN+", "we", "us", "our"), is committed to protecting your personal data in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia, as amended by the Personal Data Protection (Amendment) Act 2024.

This Privacy Policy explains what personal data we collect when you use imanplus.my, why we collect it, how it is used, stored, and protected, and what rights you have as a data subject under Malaysian law.

2. Data We Collect

We collect personal data that you provide directly, and limited data collected automatically when you browse our site.

We do not collect or store full credit/debit card numbers, CVV codes, or banking credentials. These are handled exclusively by our PCI-DSS compliant payment gateway, Chip — see Section 6.

3. How We Use Your Data

We use personal data strictly for purposes connected to operating IMAN+ and AIVEX, including:

• Processing and fulfilling your orders, including coordinating delivery via EasyParcel
• Communicating with you about order status, delivery updates, and support requests
• Issuing invoices and maintaining records required under Malaysian tax and company law
• Improving our products, website, and customer experience
• Detecting and preventing fraud or misuse of our platform
• Sending marketing communications, where you have opted in (you may unsubscribe at any time)

4. Consent & Legal Basis

In accordance with the General Principle under Section 6(1) of the PDPA, we only process your personal data where you have given consent, or where processing is necessary to perform a contract with you (such as fulfilling an order), comply with a legal obligation, or pursue our legitimate business interests in a manner that does not override your rights.

Where consent is the basis for processing — for example, marketing emails — that consent is voluntary, informed, and recorded. You may withdraw consent at any time without affecting orders already placed.

5. Sharing & Disclosure

We do not sell, rent, or trade your personal data. We share data only with service providers strictly necessary to operate IMAN+, under contractual obligations to protect it:

• Chip — our payment gateway, to process payments securely
• EasyParcel — our delivery partner, to arrange and track shipments (your name, address, and phone number are shared for delivery purposes only)
• Hosting providers — to securely store and serve our website and order data
• Regulatory or government authorities — where required by Malaysian law, such as tax reporting

We do not transfer personal data outside Malaysia unless the receiving party provides a standard of protection comparable to the PDPA, as required under Section 129 of the Act.

6. Payment Data (Chip)

All payment processing on imanplus.my is handled by Chip, a licensed Malaysian payment gateway. When you check out, your card or banking details are entered directly into Chip's secure, PCI-DSS compliant payment interface — they are not transmitted to or stored on IMAN+ servers. We receive only a transaction reference, payment status, and the last 4 digits of your card for your order record.

7. Delivery Data (EasyParcel)

To fulfil your order, we share your name, delivery address, and contact number with EasyParcel and its courier partners, solely for the purpose of arranging pickup, transit, and delivery of your parcel. EasyParcel processes this data under its own privacy policy as an independent data controller for delivery operations.

8. Data Retention & Archival

We retain personal data only for as long as necessary to fulfil the purposes outlined in this policy, or as required by Malaysian law — for example, financial and tax records are typically retained for 7 years in accordance with the Income Tax Act 1967. Data no longer required is securely deleted or anonymised.

When you close your account or your erasure request is approved (see Section 10), we archive your account rather than immediately deleting it. Archiving removes your data from active services — your account is closed, hidden from the storefront, and can no longer be used to sign in or place orders. Your personal data is then retained in restricted, access-controlled storage, separate from day-to-day operations, only where we have a lawful basis to keep it, namely:

• compliance with legal, accounting and tax obligations (e.g. completed-order records under the Income Tax Act 1967);
• the detection, prevention and investigation of fraud, abuse or unlawful activity;
• the establishment, exercise or defence of legal claims and the resolution of disputes.

Archived data is accessible only to authorised personnel for these specific purposes, is never used for marketing or profiling, and is securely and permanently deleted once the applicable retention period ends and no lawful basis to retain it remains.

9. Security Measures

We implement appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, alteration, or disclosure, in line with the Security Principle of the PDPA. These include encrypted data transmission (HTTPS/TLS), restricted internal access on a need-to-know basis, and regular review of our data handling practices.

No system is completely immune to risk; if a data breach occurs that is likely to affect you materially, we will notify affected individuals and, where required, the Personal Data Protection Commissioner, without undue delay.

10. Your Rights

Under the PDPA, you have the right to:

• Access the personal data we hold about you, and download a copy from your account
• Correct inaccurate or incomplete data
• Withdraw consent for processing based on consent (e.g. marketing)
• Limit processing of your data for specific purposes
• Request erasure of your personal data where there is no overriding lawful reason for us to keep it
• Lodge a complaint with the Personal Data Protection Commissioner of Malaysia if you believe your data has been mishandled

How an erasure request works. You can submit an erasure request from your account ("Privacy & Data"), or by emailing legal@imanplus.my. Erasure is not automatic — a member of our team reviews each request and verifies your identity first. If approved, we archive and close your account: it is removed from the storefront and can no longer sign in, and your personal data is moved into restricted retention as described in Section 8. Where the law requires us to keep certain records (for accounting/tax) or where we need to retain data to investigate fraud or resolve a dispute, that data is retained only for as long as that basis applies and is then securely deleted. We will confirm the outcome of your request to you.

To exercise any of these rights, contact us using the details in Section 14. We may need to verify your identity before processing your request, and may charge a nominal processing fee for access requests as permitted under the PDPA.

11. Cookies & Tracking

We use cookies and similar technologies to keep you signed in, remember your cart, and understand how visitors use our site. You can disable cookies in your browser settings, though some features of imanplus.my may not function correctly as a result.

12. Children's Privacy

IMAN+ products are intended for purchase by adults. We do not knowingly collect personal data from children under 18 without parental or guardian consent. If you believe a child has provided us with personal data, please contact us so we can remove it.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be notified via our website or by email where appropriate. The "Last updated" date at the top of this page reflects the most recent revision.

14. Contact Us

For privacy-related questions, access requests, or complaints, contact our data protection point of contact:

Ai Business Solutions Sdn Bhd (1227830-P)
Suite 109, Block D, Level 1, Kelana Square, Jalan SS7/26, Kelana Jaya, Selangor, Malaysia
Email: legal@imanplus.my