Privacy Policy Dana77

Dana77 collects your personal information through several channels — directly when you register an account, through your use of our platform, or automatically via tracking technologies integrated into our systems. All data collection is carried out on a legitimate basis and within the necessary scope only.

The following are the main categories of information we collect:

In certain cases, we may also receive information about you from trusted third-party sources such as identity verification service providers, credit bureaus, or fraud prevention agencies — solely for security and legal compliance purposes.

Every piece of information you provide to dana77 is used for a clear and specific purpose and does not exceed the stated scope. We do not use your data for unrelated purposes without obtaining your consent first.

• Verifying your identity and meeting KYC requirements as mandated by law.
• Processing deposits and withdrawals securely and efficiently.
• Sending important account communications such as security notifications and policy updates.
• Monitoring account activity to detect fraud, money laundering, and suspicious activity.
• Improving the user experience based on usage patterns and feedback.
• Complying with legal obligations and requirements from relevant regulatory authorities.
• Providing efficient and effective customer support.
• Sending promotional information and special offers — only with your prior consent.

Dana77 understands that your personal information is a trust we uphold with full responsibility. We do not share your data with third parties except in the following limited and controlled circumstances:

• Payment Service Providers — FPX, DuitNow, Touch 'n Go, GrabPay, and bank transfer providers receive only the information necessary to process your financial transactions
• Identity Verification Providers — authorized third parties assisting with the KYC process receive encrypted copies of identity documents for verification purposes only
• Authorities & Enforcement Agencies — dana77 will disclose information when required by law, court order, or official request from a relevant government agency
• Technology Service Providers — infrastructure and cloud computing providers operating dana77's systems are subject to strict confidentiality agreements

Dana77 implements multiple layers of technical and organisational security to ensure your personal data is protected at every stage — whether in transit, in storage, or during processing.

• 256-bit SSL/TLS encryption for all communications between browser and server.
• Member passwords are stored using the bcrypt hashing algorithm, which cannot be decrypted.
• Two-factor authentication (2FA) is available and encouraged for all member accounts.
• Real-time security monitoring system that detects and blocks unauthorized access attempts
• Regular security audits by independent third parties to identify and address vulnerabilities
• Data environment separation between production and development systems.
• Role-based access control — staff can only access data required for their specific duties.

While dana77 takes all reasonable precautions, no system can be guaranteed 100% secure. In the event of a data breach that may affect you, dana77 is committed to notifying you within 72 hours of becoming aware of it, in line with industry best practices.

Dana77 uses cookies and similar tracking technologies to enhance platform functionality, understand usage patterns, and personalise your experience. Cookies are small text files stored on your device when you visit our platform.

You can manage your cookie settings through your web browser at any time. However, disabling essential cookies may affect platform functionality. Dana77 does not use cross-site tracking cookies for third-party advertising purposes.

Under the Personal Data Protection Act 2010 and Dana77's policy, you have the following rights regarding your personal data. We fully respect each of these rights and will process any related requests within 14 business days.

Dana77 retains your personal data only for as long as necessary to fulfil the purposes stated in this policy or as required by applicable law. Once data is no longer needed, it will be securely deleted or anonymised.

• Active account data is retained for the duration of your active membership with Dana77
• Financial and transaction records are retained for a minimum of 7 years in accordance with Malaysian financial legal requirements.
• Login and security activity logs are retained for 90 days for incident investigation purposes
• KYC documents are retained for 5 years after account closure in accordance with compliance requirements
• Customer support communication data is retained for 2 years after case resolution

Once the retention period expires, dana77 uses secure deletion methods including multi-pass overwrite for digital files and secure disposal for physical documents. This ensures your data cannot be recovered by any party after deletion.

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, the dana77 Data Protection Officer (DPO) team is ready to assist you.

You can reach us via:

• Live chat within the dana77 platform — available 24 hours a day, 7 days a week.
• Official email: [email protected] — response within 1 business day
• Account Settings section — for self-service data access and correction requests

Dana77 reserves the right to update this Privacy Policy from time to time to reflect changes in business practices, technology, or legal requirements. Any significant changes will be communicated to members via email or in-platform notification at least 7 days before taking effect.