Data Protection & PDPA

Privacy Policy

Bagus POS Solution Sdn Bhd (Company No. 202201037292 (1482989-D))•Last updated: 25 July 2026

1. Introduction

Bagus POS Solution Sdn Bhd ("Bagus", "we", "us" or "our") provides point-of-sale systems, payment acceptance solutions and merchant acquiring support services in Malaysia. This includes the BagusONE cloud POS platform (bagusone.app), the BagusWIN and BagusNiaga products, and BagusPay payment services (together, the "Services").

This Privacy Policy explains how we collect, use, disclose and protect personal data in the course of providing the Services. It is issued in accordance with the Personal Data Protection Act 2010 ("PDPA").

We are the data user in respect of the personal data described in this Policy, except where we process personal data on behalf of a financial institution in our capacity as an appointed Master Merchant, in which case we act on that institution's instructions.

By using the Services or providing personal data to us, you acknowledge this Policy. If you do not agree with it, please do not use the Services.

2. Who this Policy applies to

This Policy applies to:

Merchants and merchant personnel: business owners, directors, partners and authorised representatives of businesses that apply for or use our POS, payment acceptance or merchant acquiring services.
Merchant staff users: cashiers, supervisors and administrators who hold user accounts on the BagusONE platform.
Consumers: individuals who register for a merchant's membership or loyalty programme operated through our platform, or who transact at a merchant outlet using our systems.
Website visitors: individuals who visit our websites or submit enquiries.

3. Personal data we collect

3.1 Merchants and merchant personnel

Name, contact number, email address and correspondence address
Business information: registered business name, business registration (SSM) details, business address, nature of business, outlet details
Identification documents of directors, partners or proprietors, where required for merchant onboarding, know-your-customer and identity verification purposes
Bank account details required for settlement of payment transactions
Photographs of business premises taken for merchant verification purposes
Financial information supporting a merchant application, such as bank statements

3.2 Merchant staff users

Name, user identifier and assigned role or permission level
Contact number and email address, where provided
Activity records within the platform, including transactions processed and authorisations given

3.3 Consumers

Name, contact number and email address, where the individual registers for a merchant's membership or loyalty programme
Membership number, points balance, vouchers and reward entitlements
Purchase and transaction history at participating merchant outlets

3.4 Technical data

IP address, device type, operating system and browser type
Access logs, including pages accessed and times of access
Cookies and similar technologies, as described in Section 9

3.5 What we do not collect

We do not collect, process or store full payment card numbers, card expiry dates, card verification values (CVV/CVC), magnetic stripe or chip track data, or PIN data. Card payment transactions are processed by certified payment terminals supplied by our terminal partners, and only a truncated card number and transaction reference are returned to our systems.

4. How we collect personal data

We collect personal data:

When a merchant applies for our products or services, or completes an application form for a payment acceptance facility
When our sales or onboarding personnel collect and verify supporting documents
When an account is created on the BagusONE platform
When a consumer registers for a merchant's membership or loyalty programme
When transactions are processed through our systems
When you contact us with an enquiry, support request or complaint
Automatically, when you access our platform or websites

Where a merchant provides us with the personal data of its directors, employees or customers, the merchant confirms that it has obtained the necessary consent for that data to be processed in accordance with this Policy.

5. Why we use personal data

We use personal data for the following purposes:

To assess, process and submit merchant applications to acquiring banks
To carry out know-your-customer, identity verification, due diligence and fraud prevention checks
To install, configure, program and maintain point-of-sale terminals and software
To provide, operate and support the Services, including technical support and merchant training
To process, record and reconcile payment transactions and settlements
To operate membership and loyalty programmes on behalf of merchants
To investigate and respond to chargebacks, disputes and suspected fraudulent activity
To monitor merchant activity for compliance with acquiring bank requirements, including transaction pattern monitoring
To communicate with you regarding your account, transactions, service updates and support matters
To comply with legal, regulatory and contractual obligations, including obligations owed to acquiring banks and to Bank Negara Malaysia
To maintain records required by law, including anti-money laundering record-keeping obligations
To improve and develop our products and services
With your consent, to send you marketing communications about our products and services

6. Disclosure of personal data

We may disclose personal data to:

Acquiring banks and financial institutions: where necessary to submit merchant applications, process transactions, settle funds, or respond to disputes and enquiries
Payment networks and scheme operators: including PayNet, Visa and Mastercard, as required to process transactions
Payment terminal and payment gateway providers: to enable payment acceptance at merchant outlets
Regulatory and governmental authorities: including Bank Negara Malaysia, the Inland Revenue Board and law enforcement, where required by law or where we are legally compelled
Professional advisers: including auditors, legal advisers and insurers, under obligations of confidentiality
Service providers: who provide hosting, infrastructure or technical services to us, under contractual obligations of confidentiality and data protection

We do not sell personal data. We do not share personal data with advertising networks or data brokers for their own marketing purposes.

Where we hold merchant information in our capacity as an appointed Master Merchant, that information remains the property of the appointing financial institution and is handled in accordance with our agreement with that institution.

7. Where personal data is stored

7.1 Merchant acquiring and BagusONE

Personal data collected in connection with our merchant acquiring services, and data generated through the BagusONE platform, is stored and processed within Malaysia.

The BagusONE platform and its transaction records are hosted on cloud infrastructure located in Malaysia.
Merchant onboarding records are held on our internal systems hosted in Malaysia.
Backups of both are retained within Malaysia.

We do not transfer this data outside Malaysia. Where a transfer outside Malaysia would become necessary, we will only do so in accordance with the Personal Data Protection Act 2010 and, where the data relates to services provided to an acquiring bank, with that bank's prior written consent.

7.2 BagusWIN and BagusNiaga

BagusWIN and BagusNiaga synchronise data to cloud infrastructure located in Singapore.

The data synchronised from these products comprises merchant business information and transaction records. It does not include personal data. Specifically: merchant owner and proprietor details are not held in these products; system user accounts for merchant staff use display names rather than identifying personal details; these products do not operate membership or loyalty programmes; and merchants accepting card payments are incorporated entities, so merchant business information does not identify an individual.

BagusWIN additionally stores data locally on the merchant's own equipment. Merchants are responsible for the security of that equipment, as set out in our Terms of Use.

Merchants who require all data relating to their business to be held within Malaysia should contact us to discuss migration to BagusONE.

7.3 Website analytics

Our corporate websites use Google Analytics to understand how visitors use the sites. Google Analytics collects technical data including IP address, device and browser type, and pages visited, and transmits that data to Google, whose servers may be located outside Malaysia, including in the United States.

This applies to our corporate websites only. Google Analytics is not used in the BagusONE, BagusWIN or BagusNiaga merchant portals. No merchant data, transaction data or merchant acquiring data is transmitted to Google.

You can prevent collection by Google Analytics through your browser settings or by installing the Google Analytics opt-out browser add-on.

8. Security

We implement organisational and technical measures to protect personal data against loss, misuse and unauthorised access, including:

Restricting access to personal data to authorised personnel on a need-to-know basis
Encrypting data in transit using industry-standard transport security
Encrypting data at rest within our hosting environments
Role-based access controls and authorisation requirements within the platform
Confidentiality obligations imposed on our employees and contractors
Secure disposal of physical documents once they are no longer required
Documented incident response procedures

No system can be guaranteed to be completely secure. We will notify affected individuals and relevant authorities of a personal data breach where required to do so.

9. Cookies

Our platform and websites use cookies and similar technologies to keep you signed in, remember your preferences, and understand how our sites are used.

Cookies used in the merchant portals are limited to those necessary for the operation of the service, including session and authentication cookies. Our corporate websites additionally use analytics cookies, as described in section 7.3.

You can restrict or disable cookies through your browser settings, though some features may not function correctly as a result.

10. Retention

We retain personal data only for as long as it is required for the purposes described in this Policy, or for as long as required by law or by our contractual obligations.

Records relating to merchant acquiring transactions are retained for seven (7) years, consistent with our record-keeping obligations to acquiring banks and under applicable law.
Merchant application records held on behalf of an acquiring bank are retained, returned or destroyed in accordance with that bank's instructions.
Physical merchant application documents are securely destroyed once the application has been closed and the required records have been retained in digital form.
Consumer membership data is retained for as long as the membership remains active, and thereafter in accordance with the merchant's instructions.

When personal data is no longer required, we securely delete or anonymise it.

11. Your rights

Under the PDPA, you have the right to:

Request access to the personal data we hold about you
Request correction of personal data that is inaccurate, incomplete or out of date
Withdraw your consent to our processing of your personal data
Limit the processing of your personal data for direct marketing purposes
Enquire about the disclosure of your personal data

To exercise any of these rights, contact us using the details in Section 14. We may need to verify your identity before responding. We will respond within the period required by the PDPA.

Please note that withdrawing consent may mean we can no longer provide some or all of the Services to you, and may require us to terminate your account or agreement.

Where we hold personal data on behalf of an acquiring bank, we may need to refer your request to that institution.

12. Individuals under 18

The Services are intended for business use and are not directed at individuals under the age of 18. We do not knowingly collect personal data from individuals under 18. If we become aware that we have collected such data without appropriate consent, we will delete it.

13. Changes to this Policy

We may update this Policy from time to time. The current version will always be published on our website, with the date of last update shown at the top. Where changes are material, we will take reasonable steps to notify affected individuals.

14. Contact us

For questions about this Policy, to exercise your rights, or to make a complaint about how we handle personal data:

Data Protection Officer

Bagus POS Solution Sdn Bhd

No. 3-1, Jalan OP 1/6, Pusat Dagangan One Puchong, Bandar Puchong Jaya, 47160 Puchong, Selangor, Malaysia

Email: admin@baguspos.com

Telephone: +60 16-336 1142