Legal

Personal Data Protection Notice

Issued pursuant to the Personal Data Protection Act 2010 ("the Act")

1. Data user

Capital Island Sdn Bhd, operating the Kredit Lab brand, of Lot 5.66, 5th Floor, Wisma Central, Jalan Ampang, 50450 Kuala Lumpur, Malaysia.

2. Personal data processed

Name, identification details, contact details, company information, and financial information contained in documents you provide (financial statements, management accounts, bank statements).

3. Purposes of processing

  • Producing the analysis reports and advisory services you engage us for;
  • Communicating with you about your engagement;
  • Billing and record-keeping;
  • Compliance with legal and regulatory obligations;
  • Preparing anonymised examples of our work, with all identifying details removed.

4. Sources

Personal data is collected directly from you, from documents you provide, and from publicly available registries where relevant to the engagement.

5. Disclosure

We do not disclose your personal data to third parties except: our service providers for delivering the service, including cloud hosting, AI-assisted analysis and document reading, some of which process data outside Malaysia; parties you explicitly instruct us to share with; and where required by law.

6. Your rights under the Act

  • The right to access your personal data;
  • The right to correct inaccurate, incomplete, or outdated data;
  • The right to withdraw consent to processing, subject to legal and contractual restrictions;
  • The right to limit processing, including for direct marketing (which we do not do).

Requests may be made in writing to advisory@kreditlab.my. We may charge a prescribed fee for access requests as allowed under the Act.

7. Obligatory data

Providing the personal data described above is necessary for us to deliver the service; without it, we may be unable to produce your report or complete the engagement.

8. Retention

We keep your documents for as long as we need them for your engagement and any follow-up work, and for as long as the law requires. After that, we delete them or remove anything that identifies you.