This “Notice Concerning Your Personal Data” is issued pursuant to the Malaysian Personal Data Protection Act 2010. We, KAF Investment Funds Berhad (“KIFB”), are committed to protecting the privacy of our existing investors accessing and managing their unit trust portfolios through our official KAF eFunds Web Platform (the “Site”).

1. Digital Profile Consent

1.1 Digital Identity Migration

As an existing verified investor of KIFB, your core personal and financial data has already been collected, verified, and safely stored in our secure offline registry under standard Know Your Customer (KYC) compliance policies. Before activating your online web platform account or initiating digital fund requests, you will be presented with an electronic “Personal Data Consent” declaration.

1.2 Electronic Authorization

By clicking “Agree” or checking the mandatory acknowledgement box on the Site, you explicitly consent KIFB migrating, processing and utilizing your historical customer records to establish, manage and secure your online web platform profile.

2. What Personal Data We Process

Your Personal Data refers to information that relates directly or indirectly to you. For users operating on the KAF eFunds Web Platform, the personal data processed within the digital ecosystem includes: 

• General Identifications: Full Name, Identity Number (New/Old NRIC), date of birth, nationality, gender, race, religion, marital status and number of dependants.
• Contact & Employment details: Residential and correspondence address, mobile number, email address, employment status, occupation, nature of business and name & address of employer.
• Financial & Investment Parameters: Annual Income, source of wealth, asset net worth, purpose of investment and transactions history.
• Regulatory & Compliance Data: Registered bank account details for redemptions, transaction history logs, internal Anti Money Laundering (AML) risk screening scores, and Investor suitability assessment form (ISAF) risk profile results. 

3. The Purposes for Processing Your Personal Data

We process your Personal Data electronically through the Site for the following core operational and legal purposes: 

• Online Profile Provisioning: To securely establish your online web platform profile by retrieving your pre-existing, verified customer record without requiring manual data entry error risk.
• Mandatory Compliance Screening: To accept, validate, and clear your online investment transactions, including fund subscriptions (purchases), unit switching, and redemptions (repurchases). 
• Risk Profiling: To evaluate your investment risk tolerance via digital Investor Suitability Assessment questionnaires and match your account with appropriate mutual funds. 
• Payment Clearance: To process your subscription payments securely via integrated online payment systems (e.g., FPX) and disburse redemption proceeds directly to your pre-validated personal bank account (manually).
• Administrative & Security Operations: To deliver digital one time passwords (OTP) via email for secure login and transaction authorization, alongside delivering automated e - statements, portfolio valuations, and digital transaction receipts.

4. How We Collect and Secure Your Data

4.1 Digital Collection

Your data is retrieved electronically when you initialize your web account registration using your NRIC/Passport number and pre-registered contact details. You may also provide additional or updated data when filling in missing mandatory financial fields on the online profile maintenance screens.

4.2 Web Security & Account Lockdown Protocols
 We implement strict technical steps to safeguard your online portal from unauthorized access. 

• Every secure session login and transaction confirmation requires a unique, system-generated 6-digit OTP sent straight to your verified email address. 
• To prevent brute-force attacks and unauthorized access, entering an incorrect email OTP exceeding three (3) consecutive failed attempts will result in your online platform account being temporarily locked. Account reactivation will require verified customer service intervention.

4.3 Data Retention

Your Personal Data will be securely retained for as long as necessary to fulfil the operational purposes of your investments, or for a mandatory regulatory period of not less than seven (7) years as dictated under the Capital Markets and Services Act and prevailing capital market laws. 

5. Third Party Disclosures

Your Personal Data may be disclosed or transferred to the following categories of third parties as part of your web platform servicing: 

• KAF Group Companies: Shared securely across corporate entities (including KAF Digital Bank) specifically for cross-entity security checks or cross-platform investment transactional purposes. 
• Third-Party Service Providers: Integrated systems crucial to web portal operation, including our core back-office investment registry (MFund), cloud identity directory systems (Microsoft Entra ID) managing your login OTPs, and regulated payment networks (FPX) facilitating purchases. 
• Regulatory & Law Enforcement Bodies: Government institutions, statutory regulators, tax authorities (maintaining international FATCA/CRS compliance), or law enforcement agencies to strictly comply with financial market laws and anti-money laundering regulations. 

6. Your Rights to Access, Correct and Limit Processing

6.1 Profile Modification Tracking 
You can view and update key aspects of your Personal Data dynamically through the "Profile" settings area of the Site. However, under regulatory guidelines, if you make digital updates to your core financial status—such as altering your Marital Status, Occupation, or Annual Income—the platform will automatically flag your profile and require you to complete a fresh digital ISAF risk questionnaire before you can make further purchases. 

6.2 Consequences of Withdrawing Consent

1. You maintain the right to limit the processing of your data or entirely withdraw your consent for online portal transactions. However, because this personal and financial mapping is structurally necessary for investment compliance, withdrawing your consent means you will be unable to operate, trade, or maintain an active profile on the KIFB Web Platform. 
2. We provide a clear, accessible, and operationalised mechanism for you to withdraw your consent for data sharing between KAF Digital Bank Berhad (KDB) and KAF Investment Funds Berhad (KIFB) at any time.

If you are accessing the platform via the KDB Mobile App or the Web Portal (PWA), you may exercise this right by contacting Customer Service.

Upon receipt of your request to withdraw consent:

1. KDB shall immediately cease the transmission of any further personal data to KIFB.
2. KIFB shall cease processing your Personal Data for any new investment activities or transactions under this collaboration.
3. Both KDB and KIFB shall handle your existing Personal Data strictly in accordance with statutory retention requirements and our internal data destruction policies.

Important Notice Regarding Withdrawal: Please understand that the data-sharing gateway between KDB and KIFB is essential for operating your KAF eFunds account. Therefore, withdrawing your consent for data sharing means we will no longer be able to facilitate new purchases and it may result in the limitation or termination of your access to the KAF eFunds platform.

7. Contact Our Data Protection Team

If you have questions regarding this digital privacy notice, wish to make inquiries, or want to exercise your data access rights, please contact KIFB Customer Service through any of our official channels: 

• Email Support: KIFBclientservicing@kaf.com.my
• Telephone Support: 03-9767 6000 during office hours: Mondays through Fridays from 9:00 a.m.– 5:00 p.m.