Legal

Privacy Policy

How Ottozo collects, uses and protects your personal data (PDPA 2010).

Draft notice: this template is drafted to protect Ottozo's interests within Malaysian law, but has not been reviewed by a lawyer. Note that mandatory consumer rights (e.g. Consumer Protection Act 1999) cannot be excluded and override one-sided terms. Have it verified by legal counsel (and against the PDPA 2010) before relying on it.

Last updated: 2026. This Privacy Notice is issued under the Personal Data Protection Act 2010 ("PDPA") by Ottozo [Sdn. Bhd.] (Company No. [—]) ("we"). By providing your personal data to us, you consent to its processing as described here.

1. Data we collect

Contact & identity details (name, phone, email, state; IC and payslip if you apply for loan pre-approval).
Financial inputs used to estimate loan eligibility and instalments.
Booking, review and enquiry records.
Usage data (pages visited, device/browser, IP) for analytics and security.

2. Purposes (why we process)

To respond to enquiries, process bookings and pre-approvals.
To connect you with advisors, agents, dealers, banks and insurers to fulfil your request.
To operate, secure and improve the site, and (with consent) send relevant offers.
To comply with legal obligations and prevent fraud.

Providing certain data is necessary to give you a quote or process a booking; if you do not provide it, we may be unable to assist.

3. Disclosure

We disclose data only to: our authorised agents and staff; dealers, principals, banks and insurers directly involved in your request; and service providers (e.g. hosting, payment gateway, email, analytics) acting as our data processors under confidentiality obligations. We do not sell your personal data.

4. Retention & security

We keep personal data only as long as necessary for the purposes above or as required by law, then delete or anonymise it. We apply reasonable technical and organisational measures to protect it; sensitive documents (e.g. IC, payslips) are stored with restricted access.

5. Your PDPA rights

You may request access to or correction of your personal data, limit or withdraw consent to its processing, and opt out of direct marketing at any time. We may charge a prescribed fee for access requests and may need to verify your identity.

6. Cookies & cross-border

We use cookies as described in our Cookie Policy. Some processors may store data outside Malaysia with safeguards consistent with the PDPA.

7. Data Protection Officer

In line with the PDPA (Amendment) Act 2024/2025, we have appointed a Data Protection Officer ("DPO") responsible for our compliance with the PDPA. You may contact our DPO directly for any data protection enquiry, complaint, or to exercise your rights under Section 5 above: dpo@ottozo.my.

8. Data breach notification

If we become aware of a personal data breach that is likely to result in significant harm to you, we will notify the Personal Data Protection Commissioner without unnecessary delay and, in any event, within seventy-two (72) hours of becoming aware of the breach, as required under the PDPA (Amendment) Act 2024/2025. Where the breach is likely to result in significant harm to you, we will also notify you directly without unnecessary delay, describing the nature of the breach, its likely consequences, and the measures taken or proposed to address it.

9. Contact

To exercise your rights or ask questions, email hello@ottozo.my. In case of any conflict between the BM and English versions of this notice, the Bahasa Malaysia version prevails (PDPA s.7(3)).