Privacy Notice.

The personal information we collect from you in relation to our Facilities that you have requested — or that has been requested by others whose obligation is guaranteed by you, whom you represent and are authorised to act on behalf of, or whom you are associated with — shall be deemed willfully provided by you. This includes but is not limited to:

The Bank may also collect your personal information from other sources, including regulatory bodies, supervisory authorities, credit bureaus, credit reporting agencies, financial crime reference agencies, your employer, your guarantors and other sources to which the Bank has access.

The supply of your personal information to the Bank is necessary in connection with the provision of the Facilities we offer. Failure to supply such information may result in the Bank being unable to provide you the Facilities and/or failure to comply with regulatory requirements.

The purposes ("Purpose") for which your personal information is collected and processed depend on the nature of your relationship with the Bank as a data subject. Broadly, the Purpose may comprise part or all of the following:

1. 01The processing of the Facilities you are currently enjoying and/or the Facilities you have requested.
2. 02Prevention and detection of financial crime (including money laundering, and fraud prevention, detection and prosecution).
3. 03Notifying you of important changes to the features of the Facilities.
4. 04Supporting the operational activities of the Facilities.
5. 05Updating and managing the accuracy of the data you have provided to the Bank.
6. 06Enforcement of your obligations to the Bank within the provision of the Facilities, including the collection and recovery of amounts outstanding from you or obligated upon you.
7. 07Determining your credit worthiness and maintaining your credit history for present and future reference, including checking your CCRIS and any other credit reporting agencies under the Credit Reporting Agencies Act 2010 (CRAA 2010).
8. 08Determining the amount of indebtedness owed by you or to you and designing improved financial solutions for you.
9. 09Assessment and analysis including credit, lending, insurance risks, behaviour scoring, product analysis and market research.
10. 10As required by any law or regulation.
11. 11Communications and ensuring customer satisfaction, which may include conducting surveys, responding to inquiries and complaints and resolving disputes.
12. 12Protecting Bank Islam Group's interest and other ancillary and/or related purposes.
13. 13Performing an employment check with the personnel empowered to give such confirmation in your organisation.

The Bank will not reveal your personal information, including your address, telephone number or email address, to any external party other than the parties listed below (the "Authorised Parties") and other than for the Purpose above, unless the Bank has your permission or is under a legal obligation or any other duty to do so:

• Any officer, employee, agent or director of the Bank.
• Relevant third parties such as professional advisers, strategic business partners and alliances, service providers, insurers / Takaful operators or insurance / Takaful brokers, outsourced agents, merchants, vendors, business partners and business agents who support the operational activities of the Bank and who are under a legal obligation of confidentiality.
• Any actual or potential participants or assignee, novatee or transferee of the Bank's rights and/or obligations under any transaction between the Bank and you (or any agents or professional advisers).
• Any rating agency or direct / indirect provider of credit protection to the Bank.
• Any party as required by any law or any government, quasi-government, administrative, regulatory / supervisory body or authority, court or tribunal.
• Any credit reporting agency that the Bank uses for credit assessment or credit review of you and parties related to the facilities provided by the Bank to you.
• Any financial crime reference agencies, other financial institutions and any of their respective agents.
• Any guarantor or collateral provider for your facilities.
• Any parties from whom the Bank seeks an employee reference.

The above disclosure is subject at all times to any laws (including regulations, standards, guidelines and/or obligations) applicable to the Bank. In addition, this Privacy Notice serves as a consent for any credit reporting agency to disclose your credit information to the Bank pursuant to section 24(1)(a) of the CRAA 2010.

The Bank may transfer your personal information outside of Malaysia if any of the Bank's service providers are located in countries outside Malaysia. Such transfers are necessary to perform or conclude the Bank's services to you, to perform or conclude the Bank's contract(s) with relevant third parties, and for legal proceedings or obtaining legal advice.

Should the operational need arise where your personal information is to be processed, used, transferred to or stored at a location outside of Malaysia, the Bank will take necessary steps to ensure that your personal information is treated securely and that any service providers engaged by the Bank are contractually bound not to use your personal information for any reason other than what they are contracted to provide, in accordance with this Privacy Notice and the respective jurisdictions' personal data laws. In these regards, you give your consent for us to transfer your personal information outside Malaysia.

Information provided by you shall be retained as long as the Purpose for which the information was collected continues to exist. Destruction / permanent deletion of data will be made once the purpose for which the information was collected has ceased permanently, unless it is to be retained to meet any legal and/or regulatory requirements or to protect the Bank's legitimate interest.

Where you are required to and have provided personal information relating to others, including that of co-applicant(s), spouse, related parties, contact persons, referees and employers (including but not limited to from SSM and any credit reporting agency governed by CRAA 2010) for the Purpose, you shall undertake and be deemed to have obtained their consent, or that you are entitled to provide their information to the Bank.

The Bank would like to contact you to keep you informed of our latest products and services, other products and services offered, marketing campaigns, advertisements and promotions, including those jointly run with our current and future partners and affiliates (referred to as "direct marketing"). Hence, the Bank will use your contact details including your address, telephone numbers and email address for the purpose of direct marketing activities including the administration of offers and competitions.

If you do not wish to be contacted for direct marketing activities, you may opt out via email at email@bankislamtrust.com.my. Please be informed that we will process your request within three (3) months from the date of your request.

You have the right to request access to your personal information held by the Bank. The Bank may charge you a nominal fee for such a request. You may also update and correct your personal information held by the Bank. For such requests, you may visit any of our offices or speak to our Contact Centre agents. You will be required to complete the "Data Access Request" form or "Data Correction Request" form available at our offices.

If you have any questions concerning this Privacy Notice, you may visit any of our offices, whose locations you can obtain from our website, or you may call our Contact Centre or write to the Bank at the given address. You may also contact us to convey your complaints relating to this Privacy Notice or otherwise relating to any misuse or suspected misuse of your personal information.

The Bank reserves the right to amend this Privacy Notice at any time and will place notice of such amendments on the Bank's website and/or at the Bank's offices and/or via such other suitable methods. This Privacy Notice is not intended to, nor does it, create any contractual rights or any contractual obligations on the Bank or any other party or on behalf of any party.

By continuing to use our Facilities, you acknowledge that you have read this Privacy Notice, understand its content and agree to be bound by it.