Privacy Policy for KGT Mobile and ednd.my

This Privacy Policy explains how Kelantan Gold Trade Sdn Bhd ("KGT", "we", "us" or "our") collects, uses, discloses, protects and retains personal data when you use KGT Mobile, ednd.my and related KGT services. It applies to customers, applicants, account holders, parents or guardians using child-account services, introducers and saudagar.

1. Personal data we collect

Depending on the services you use, we may collect:

Account and contact information: name, email address, telephone number, account or customer reference, role, referral information and login credentials.
Identity and KYC information: MyKad, passport or SSM details, identity number, date of birth, address, city, postcode, country, identity-document images, company documents and a photo of you holding your original IC or passport beside your face for verification.
Child-account information: parent or guardian details and a child's name, identity details, date of birth, relationship and supporting documents where those services are used.
Financial and transaction information: bank name and account number, payment and billing references, wallet balances, precious-metal holdings, purchases, sales, transfers, exchanges, withdrawals, delivery or collection details, fees and transaction history.
Support and communication information: support category, subject, message, correspondence, notification preferences and records needed to respond to a request.
Device, session and security information: a randomly generated mobile installation identifier, device or session name, access-token and session records, IP address, timestamps, app version, request records and security or fraud-prevention logs.

KGT Mobile may access the camera or photos you select to scan transfer QR codes or submit KYC documents. Document photos are uploaded for AI processing when you consent and select Read document & continue, before completing your KYC submission. Your documents and the photo of you holding your ID are uploaded when you submit KYC. Face ID is processed by Apple's operating system on your device; KGT Mobile receives only the authentication result and does not receive or store your Face ID biometric template.

2. How we use personal data

We use personal data where necessary to:

register, verify, administer and secure your account;
perform KYC, identity, eligibility, fraud-prevention and regulatory checks;
provide wallet, precious-metal, payment, transfer, exchange, withdrawal, delivery, child-account, introducer and saudagar services;
process and reconcile transactions, maintain ownership and audit records, issue receipts and respond to disputes;
send service, security, transaction and account communications, and promotional alerts where you have enabled them;
provide customer support, diagnose technical issues and improve the reliability and safety of our services; and
comply with applicable legal, tax, accounting, audit, anti-fraud, anti-money-laundering and regulatory obligations.

KGT Mobile does not use personal data for third-party advertising or to track you across apps and websites owned by other companies.

You can browse products and prices without creating an account. MyKad, passport and SSM details, document photos and a photo of you holding your ID are collected during KYC, when you choose to use services that require identity verification; they are not required for mobile registration.

3. When we disclose personal data

We may disclose only the data reasonably needed to:

Service providers: operate hosting, secure storage, communications, email, SMS, customer support and other technology used for KGT services.
AI processing provider: OpenAI processes document photos for KGT AI with your explicit consent, as explained below.
Payment providers: create and reconcile payments. When ToyyibPay is used, transaction amount, reference, name and contact details required for the payment may be provided to ToyyibPay. Information entered directly on a payment provider's page is also governed by that provider's privacy policy.
KGT-authorised personnel and professional advisers: verify accounts, service transactions, investigate issues, perform audits and obtain legal, accounting or compliance advice.
Authorities and other parties required by law: respond to lawful requests, enforce rights, prevent fraud, protect users or satisfy regulatory obligations.
Corporate transactions: support a lawful merger, restructuring or transfer, subject to appropriate confidentiality and data-protection requirements.

We do not sell or rent personal data.

3A. AI document processing (KGT AI)

KGT AI uses OpenAI as an external processing provider through an API account owned by KGT, using OpenAI's standard data-handling settings. With your consent, KGT sends your MyKad front and back photos, passport photo page or SSM document photo to OpenAI. This includes information visible in the images, such as your name, identity or registration number, address, printed date of birth and document portrait, where present. This document-reading request does not include your separate KYC photo holding your ID, bank-account details, password or transaction history.

For child-account document checks, the birth-certificate and MyKid images may also be sent to OpenAI with the parent or guardian's consent. This includes the child's printed identity details and the parents' names and identity numbers where visible on the birth certificate. KGT uses the extracted text to prefill details and check document consistency; it does not ask OpenAI to identify faces or prove guardianship. The child-account flow also offers manual HQ review without sending the documents through this AI scan.

OpenAI reads the printed details and checks document type, image quality and visible consistency. KGT uses the results to prefill details for you to check and correct, support preliminary eligibility checks and identify submissions needing review. These checks do not prove document authenticity or verify that a face belongs to you. Automated and KGT administrator reviews are recorded separately; administrator approval is still required for full transaction access.

The scan screen asks for your explicit consent before sending the photos for AI processing. If you do not consent, the photos are not sent through this scan step and you cannot continue the current adult KYC flow. Contact KGT Support for assistance or to withdraw consent for future processing. Withdrawal cannot undo processing already completed.

Processing may take place outside Malaysia. KGT disables storage of the generated response for later retrieval from OpenAI. KGT does not use a Zero Data Retention arrangement. This does not mean zero retention: OpenAI may retain content in abuse-monitoring logs for up to 30 days by default, with longer retention for legal or safety reasons and exceptions for image inputs. OpenAI does not use API data to train its models by default, unless the API customer explicitly opts in. See OpenAI's API data controls for details. KGT's retention of submitted KYC documents, extracted details and review records is covered by section 4 below.

3B. Face photos and device biometrics

What we collect and why: when you complete KYC, we collect a photograph of you holding your original IC or passport beside your face, with both visible in the same photo, and the portrait visible in your separate identity-document photographs, where present. KGT uses these photographs for identity review, to help prevent impersonation and fraud, and to support KYC decisions and related audit records. We do not create face templates, face embeddings or facial recognition profiles, or use these photographs for advertising, marketing or tracking.

Who receives the photographs: the document photographs, including any printed portrait, are sent to OpenAI after your separate document-processing consent, for the document-reading purposes in section 3A. OpenAI is not asked to recognise, identify or match faces. The separate photo of you holding your ID is not included in that request. Submitted document photographs and photos of you holding your ID are stored in KGT's private server storage and are available through access-controlled services to you and authorised KGT personnel for identity review. Swiss Link Communication Sdn Bhd provides the server and backup hosting in Malaysia, as described in section 8. Lawful disclosures are described in section 3.

Retention and deletion: KGT retains submitted face photographs as part of the KYC records described in section 4, under KGT's internal policy of seven years from the date your account is closed. Closing your account revokes access but does not automatically erase these records or photographs. Contact Support to request deletion of your photo holding your ID or separate document photographs, or to withdraw consent for future processing. KGT will assess any applicable record-retention obligation when handling that request. OpenAI's separate retention rules for document photographs are described in section 3A.

Your choices: you may leave KYC before submission and continue browsing products and prices. KYC-dependent transactions remain unavailable without verification. Withdrawing consent does not reverse document processing already completed. You can request account deletion using the in-app or web options in section 4.

Face ID is different: optional device authentication is handled by the operating system. KGT receives a success or failure result, not Face ID images, a face map or a biometric template. KGT does not store or share the device's Face ID data.

4. Data retention and account deletion

You can request account deletion from Profile > Delete Account in KGT Mobile or through our web account deletion page. Once the request is successfully verified, sign-in access to that account is closed and all API sessions are revoked.

Records kept after closure: KGT keeps the closed-account profile, original email address and identity number where provided, closure history, transaction, precious-metal ownership, payment, audit and KYC records. KYC records include submitted identity-document photographs, the photo of you holding your ID and verification decisions. These records preserve the history of the closed account, identify past transactions and verification decisions, and support reconciliation, disputes, fraud prevention and applicable legal or regulatory obligations. Closing account access does not automatically erase these personal records or photographs.

Retention period: KGT's internal policy sets a retention period of seven years from the date your account is closed for financial records and KYC documents and photographs, including identity-document images and the photo of you holding your ID. The same policy period applies to backup copies of these records. This is KGT's internal retention policy, subject to applicable data-protection requirements and individual requests under section 6; it does not remove your rights to request deletion.

Registering again: your email address and identity number are released for a new registration while the original details remain in the closed-account record. A new registration creates a separate account and requires verification again. Previous balances, transactions and approvals stay with the closed account and are not transferred automatically. Contact KGT Support about remaining holdings or unsettled transactions before closing your account.

Requests about retained data: contact KGT through the official support channels in section 10 to request deletion of retained personal data or withdraw consent for future processing. KGT is responsible for handling these requests and managing deletion on its server. KGT will assess the request against the records involved and any applicable retention obligation. The seven-year retention period is not a deadline for responding to your request. Account closure and registration of a new account do not themselves complete deletion of the retained data. OpenAI's separate retention of document photographs is described in section 3A.

5. Security

We use reasonable administrative, technical and organisational safeguards appropriate to the nature of the data, including encrypted network transmission, authentication, access controls and session management. Mobile access tokens are stored using platform-protected storage. No method of storage or transmission is completely risk-free, so users should protect their password, transaction PIN and device and notify KGT of suspected unauthorised access.

6. Your choices and rights

Subject to applicable law and verification of your request, you may:

request access to or correction of your personal data;
update eligible profile and bank-account information through KGT services;
change available communication or promotional-alert preferences;
withdraw consent where processing is based on consent, noting that this may affect services that require the data; and
request account deletion as described above.

We may need to verify your identity before fulfilling a request and may retain information where an applicable exception or legal obligation requires it.

7. Children and dependent accounts

A parent or legal guardian must have authority to provide and manage personal data for a child or dependent account. The responsible adult should use KGT's child-account process and provide accurate relationship and supporting information. Contact KGT if you believe child information was submitted without appropriate authority.

Child registration uses a birth certificate and MyKid as supporting documents. AI-assisted document reading and the manual HQ-review option are explained in section 3A. Submitted documents are stored privately with KGT's account records; the applicable retention policy and requests about retained data are explained in section 4.

8. International processing and external services

Server and backup location: KGT's application server and backups are hosted in Malaysia by Swiss Link Communication Sdn Bhd. KGT has access to its server and is responsible for handling privacy and deletion requests. The policy period for backup copies of financial and KYC records is described in section 4.

External document processing: OpenAI is a separate processing provider. The Malaysian location of KGT's server and backups does not mean OpenAI processing is limited to Malaysia. Document images sent to OpenAI may be processed outside Malaysia, under the standard settings and separate retention rules explained in section 3A.

Other service providers may also process data in locations outside Malaysia. Where this occurs, we take reasonable steps to require appropriate confidentiality and data-protection safeguards, subject to applicable law. Links opened to third-party services are governed by the privacy terms of those services.

9. Changes to this policy

We may update this policy when our services, providers or legal obligations change. The updated date will be shown above. Material changes may also be communicated through KGT Mobile, ednd.my or another appropriate channel.

10. Contact us

For privacy questions or requests, use the Support section in KGT Mobile or the official support channels published through KGT services. You may also contact Kelantan Gold Trade Sdn Bhd at Tingkat 3, Bangunan PMBK, Jalan Kuala Krai, 15050 Kota Bharu, Kelantan, Malaysia.