PDPA Privacy Policy

Personal Data Protection Act 2010 (Malaysia) — Notice and Choice Statement

1. Who we are

Orion ("we", "the Platform") is an independent technology matching directory. We are not a money lender. We connect borrowers with Credit Community lenders licensed by KPKT under the Moneylenders Act 1951.

2. Personal data we collect

• Identity details — full name, IC/passport number
• Contact details — phone number, email address
• Location data — address, city, state, postcode, and GPS coordinates you share
• Loan request details — requested amount and related declarations
• Technical data — device/browser information, submission timestamps, abuse-prevention signals

3. How we use your data

• To match your loan request with licensed lenders operating within a 10km radius of your location
• To allow a matched lender to contact you about your request
• To detect and prevent duplicate, fraudulent, or abusive submissions
• To maintain security audit trails required for platform integrity
• To communicate status updates about your request

4. Who we share it with

• Matched licensed lenders — only lenders within your 10km matching radius receive your request details
• Platform administrators — for verification, fraud review, and support
• Legal authorities — where disclosure is required by law

We do not sell your personal data, share it with advertisers, or disclose it to unrelated third parties. We never collect upfront fees.

5. Your rights under PDPA

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Withdraw consent — withdraw your loan request and consent at any time, subject to legal/contractual limits
• Limit processing — request that we stop processing your data for optional purposes

6. Retention & security

Data is retained only as long as needed for the purposes above and legal compliance. Records are stored with encryption at rest and in transit, tenant-isolated access controls, masked PII displays, and full access audit logging.

7. Contact

For PDPA access, correction, or consent-withdrawal requests, contact our Data Protection Officer through your portal's support enquiry feature or via the contact details on this website.