Privacy Policy for KGT Mobile and ednd.my

This Privacy Policy explains how Kelantan Gold Trade Sdn Bhd ("KGT", "we", "us" or "our") collects, uses, discloses, protects and retains personal data when you use KGT Mobile, ednd.my and related KGT services. It applies to customers, applicants, account holders, parents or guardians using child-account services, introducers and saudagar.

1. Personal data we collect

Depending on the services you use, we may collect:

Account and contact information: name, email address, telephone number, account or customer reference, role, referral information and login credentials.
Identity and KYC information: MyKad, passport or SSM details, identity number, date of birth, address, city, postcode, country, identity-document images, company documents and a photo of you holding your original IC or passport beside your face for verification.
Child-account information: parent or guardian details and a child's name, identity details, date of birth, relationship and supporting documents where those services are used.
Financial and transaction information: bank name and account number, payment and billing references, wallet balances, precious-metal holdings, purchases, sales, transfers, exchanges, withdrawals, delivery or collection details, fees and transaction history.
Support and communication information: support category, subject, message, correspondence, notification preferences and records needed to respond to a request.
Device, session and security information: a randomly generated mobile installation identifier, device or session name, access-token and session records, IP address, timestamps, app version, request records and security or fraud-prevention logs.

KGT Mobile may access the camera or photos you select to scan transfer QR codes or submit KYC documents. Document photos are uploaded for AI processing when you consent and select Read document & continue, before completing your KYC submission. Your documents and the photo of you holding your ID are uploaded when you submit KYC. Face ID is processed by Apple's operating system on your device; KGT Mobile receives only the authentication result and does not receive or store your Face ID biometric template.

2. How we use personal data

We use personal data where necessary to:

register, verify, administer and secure your account;
perform KYC, identity, eligibility, fraud-prevention and regulatory checks;
provide wallet, precious-metal, payment, transfer, exchange, withdrawal, delivery, child-account, introducer and saudagar services;
process and reconcile transactions, maintain ownership and audit records, issue receipts and respond to disputes;
send service, security, transaction and account communications, and promotional alerts where you have enabled them;
provide customer support, diagnose technical issues and improve the reliability and safety of our services; and
comply with applicable legal, tax, accounting, audit, anti-fraud, anti-money-laundering and regulatory obligations.

KGT Mobile does not use personal data for third-party advertising or to track you across apps and websites owned by other companies.

You can browse products and prices without creating an account. MyKad, passport and SSM details, document photos and a photo of you holding your ID are collected during KYC, when you choose to use services that require identity verification; they are not required for mobile registration.

3. When we disclose personal data

We may disclose only the data reasonably needed to:

Service providers: operate hosting, secure storage, communications, email, SMS, customer support and other technology used for KGT services.
AI processing provider: OpenAI processes document photos for KGT AI with your explicit consent, as explained below.
Payment providers: create and reconcile payments. When ToyyibPay is used, transaction amount, reference, name and contact details required for the payment may be provided to ToyyibPay. Information entered directly on a payment provider's page is also governed by that provider's privacy policy.
KGT-authorised personnel and professional advisers: verify accounts, service transactions, investigate issues, perform audits and obtain legal, accounting or compliance advice.
Authorities and other parties required by law: respond to lawful requests, enforce rights, prevent fraud, protect users or satisfy regulatory obligations.
Corporate transactions: support a lawful merger, restructuring or transfer, subject to appropriate confidentiality and data-protection requirements.

We do not sell or rent personal data.

3A. AI document processing (KGT AI)

KGT AI uses OpenAI as an external processing provider through an API account owned by KGT, using OpenAI's standard data-handling settings. With your consent, KGT sends your MyKad front and back photos, passport photo page or SSM document photo to OpenAI. This includes information visible in the images, such as your name, identity or registration number, address, printed date of birth and document portrait, where present. This document-reading request does not include your separate KYC photo holding your ID, bank-account details, password or transaction history.

For child-account document checks, the birth-certificate and MyKid images may also be sent to OpenAI with the parent or guardian's consent. This includes the child's printed identity details and the parents' names and identity numbers where visible on the birth certificate. KGT uses the extracted text to prefill details and check document consistency; it does not ask OpenAI to identify faces or prove guardianship. The child-account flow also offers manual HQ review without sending the documents through this AI scan.

OpenAI reads the printed details and checks document type, image quality and visible consistency. KGT uses the results to prefill details for you to check and correct, support preliminary eligibility checks and identify submissions needing review. These checks do not prove document authenticity or verify that a face belongs to you. Automated and KGT administrator reviews are recorded separately; administrator approval is still required for full transaction access.

The scan screen asks for your explicit consent before sending the photos for AI processing. If you do not consent, the photos are not sent through this scan step and you cannot continue the current adult KYC flow. Contact KGT Support for assistance or to withdraw consent for future processing. Withdrawal cannot undo processing already completed.

Processing may take place outside Malaysia. KGT disables storage of the generated response for later retrieval from OpenAI. KGT does not use a Zero Data Retention arrangement. This does not mean zero retention: OpenAI may retain content in abuse-monitoring logs for up to 30 days by default, with longer retention for legal or safety reasons and exceptions for image inputs. OpenAI does not use API data to train its models by default, unless the API customer explicitly opts in. See OpenAI's API data controls for details. KGT's retention of submitted KYC documents, extracted details and review records is covered by section 4 below.

3B. Face data (KYC face photos) and device biometrics

In this policy, face data means the photographs described below that show your face. KGT does not create face templates, face embeddings, face maps or facial recognition profiles from them.

Face data we collect: when you complete KYC, we collect a photograph of you holding your original IC or passport beside your face, with both visible in the same photo, and the portrait printed on your identity document, which appears in your separate document photographs. We collect face data only when you choose to complete KYC. You can browse products and prices without it.

Why we collect it and how we use it: KGT is a dealer in precious metals and a reporting institution under the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA). Before you can buy, sell, transfer or withdraw precious metals, KGT must verify your identity through customer due diligence. Authorised KGT personnel use these photographs to confirm that the person opening the account is the holder of the identity document, to help prevent impersonation and fraud, and to keep the KYC and audit records that AMLA requires. We do not use face data for any other purpose, including advertising, marketing, profiling, tracking or signing you in.

Who receives face data: your identity-document photographs, including the printed portrait, are sent to OpenAI only after your separate consent on the scan screen, for the document-reading purposes in section 3A. OpenAI is not asked to recognise, identify or match faces. The separate photo of you holding your ID is not included in that request. Swiss Link Communication Sdn Bhd hosts KGT's server and backups in Malaysia, where the photographs are stored. KGT may also disclose face data to authorities, such as Bank Negara Malaysia, when the law requires it. We do not sell face data or share it with advertisers, analytics providers or data brokers.

Same or equal protection: every third party with whom KGT shares face data to provide its services, namely OpenAI and Swiss Link Communication Sdn Bhd, is required under its agreement with KGT to provide the same or equal protection of face data as stated in this Privacy Policy, and to use face data only to provide its service to KGT.

Where face data is stored: photographs submitted through KGT Mobile are stored in KGT's private server storage in Malaysia. They are available only through access-controlled services to you and to authorised KGT personnel who review identity.

How long we keep face data: face photographs are part of your KYC records. KGT keeps them while your account is open and for seven years after it is closed, under KGT's internal policy, so that KGT can meet its record-keeping obligations under AMLA. Closing your account revokes access but does not automatically erase these records or photographs. Where no legal obligation requires KGT to keep them, face photographs are deleted on request as described below. OpenAI's separate retention rules for document photographs are described in section 3A.

How to withdraw consent or delete your face data: in KGT Mobile, go to Profile > Help & support > Submit Ticket, choose Account, and ask to withdraw your consent or delete your face data. If you can no longer sign in, write to KGT at the address in section 10. After verifying your identity, KGT will, within 30 days:

stop using your face data, except for records that the law requires KGT to keep;
delete your face photographs from KGT's server storage, unless AMLA or another law requires KGT to keep them; and
confirm the outcome to you. If a legal obligation applies, KGT will tell you which photographs are kept and until when, limit them to compliance use, and delete them when that period ends.

Your choices: you may leave KYC at any point before submission and continue browsing products and prices. KYC-dependent transactions remain unavailable without verification, including after you withdraw consent. Withdrawing consent does not reverse processing already completed, including OpenAI's processing described in section 3A. You can also request account deletion using the in-app or web options in section 4.

Face ID is different: optional device authentication is handled by the operating system. KGT receives a success or failure result, not Face ID images, a face map or a biometric template. KGT does not store or share the device's Face ID data.

4. Data retention and account deletion

You can request account deletion from Profile > Delete Account in KGT Mobile or through our web account deletion page. Once the request is successfully verified, sign-in access to that account is closed and all API sessions are revoked.

Records kept after closure: KGT keeps the closed-account profile, original email address and identity number where provided, closure history, transaction, precious-metal ownership, payment, audit and KYC records. KYC records include submitted identity-document photographs, the photo of you holding your ID and verification decisions. These records preserve the history of the closed account, identify past transactions and verification decisions, and support reconciliation, disputes, fraud prevention and applicable legal or regulatory obligations. Closing account access does not automatically erase these personal records or photographs.

Retention period: KGT's internal policy sets a retention period of seven years from the date your account is closed for financial records and KYC documents and photographs, including identity-document images and the photo of you holding your ID. The same policy period applies to backup copies of these records. As a reporting institution under AMLA, KGT must keep customer due diligence and transaction records after a business relationship ends; this is why these records are kept after closure. This is KGT's internal retention policy, subject to applicable data-protection requirements and individual requests under section 6; it does not remove your rights to request deletion.

Registering again: your email address and identity number are released for a new registration while the original details remain in the closed-account record. A new registration creates a separate account and requires verification again. Previous balances, transactions and approvals stay with the closed account and are not transferred automatically. Contact KGT Support about remaining holdings or unsettled transactions before closing your account.

Requests about retained data: contact KGT through the official support channels in section 10 to request deletion of retained personal data or withdraw consent for future processing. KGT is responsible for handling these requests and managing deletion on its server. KGT will assess the request against the records involved and any applicable retention obligation. The seven-year retention period is not a deadline for responding to your request. Account closure and registration of a new account do not themselves complete deletion of the retained data. OpenAI's separate retention of document photographs is described in section 3A. Requests about face photographs follow the process and 30-day timeframe in section 3B.

5. Security

We use reasonable administrative, technical and organisational safeguards appropriate to the nature of the data, including encrypted network transmission, authentication, access controls and session management. Mobile access tokens are stored using platform-protected storage. No method of storage or transmission is completely risk-free, so users should protect their password, transaction PIN and device and notify KGT of suspected unauthorised access.

6. Your choices and rights

Subject to applicable law and verification of your request, you may:

request access to or correction of your personal data;
update eligible profile and bank-account information through KGT services;
change available communication or promotional-alert preferences;
withdraw consent where processing is based on consent, noting that this may affect services that require the data;
withdraw consent for, or request deletion of, your face data as described in section 3B; and
request account deletion as described above.

We may need to verify your identity before fulfilling a request and may retain information where an applicable exception or legal obligation requires it.

7. Children and dependent accounts

A parent or legal guardian must have authority to provide and manage personal data for a child or dependent account. The responsible adult should use KGT's child-account process and provide accurate relationship and supporting information. Contact KGT if you believe child information was submitted without appropriate authority.

Child registration uses a birth certificate and MyKid as supporting documents. AI-assisted document reading and the manual HQ-review option are explained in section 3A. Submitted documents are stored privately with KGT's account records; the applicable retention policy and requests about retained data are explained in section 4.

8. International processing and external services

Server and backup location: KGT's application server and backups are hosted in Malaysia by Swiss Link Communication Sdn Bhd. KGT has access to its server and is responsible for handling privacy and deletion requests. The policy period for backup copies of financial and KYC records is described in section 4.

External document processing: OpenAI is a separate processing provider. The Malaysian location of KGT's server and backups does not mean OpenAI processing is limited to Malaysia. Document images sent to OpenAI may be processed outside Malaysia, under the standard settings and separate retention rules explained in section 3A.

Other service providers may also process data in locations outside Malaysia. Where this occurs, we take reasonable steps to require appropriate confidentiality and data-protection safeguards, subject to applicable law. Links opened to third-party services are governed by the privacy terms of those services.

9. Changes to this policy

We may update this policy when our services, providers or legal obligations change. The updated date will be shown above. Material changes may also be communicated through KGT Mobile, ednd.my or another appropriate channel.

10. Contact us

For privacy questions or requests, use the Support section in KGT Mobile or the official support channels published through KGT services. You may also contact Kelantan Gold Trade Sdn Bhd at Tingkat 3, Bangunan PMBK, Jalan Kuala Krai, 15050 Kota Bharu, Kelantan, Malaysia.