This Privacy Policy is issued pursuant to the Personal Data Protection Act 2010 (Malaysia), as amended.

Omniteam Sdn Bhd (Company Registration No. 200001030682) (“Omniteam”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy (also referred to as our Privacy Notice) explains how we collect, use, disclose, transfer, store and protect your personal data when you interact with us, and sets out your rights under the Personal Data Protection Act 2010 of Malaysia (“PDPA”), including the amendments introduced by the Personal Data Protection (Amendment) Act 2024.

1. Scope of this Policy

This Policy applies to personal data processed by Omniteam through:

• our website at omniteam.com.my and any campaign microsites or web forms we operate (for example, our OmniWeb participation pages);
• our official business accounts and channels on WhatsApp, operated through the WhatsApp Business Platform (WhatsApp Business API) provided by Meta Platforms, Inc. and its affiliates (“Meta”), including our WABA Contest and Omnirewards services;
• our contest, promotion, redemption and loyalty programmes, including proof of purchase submission and processing, winner management and prize fulfilment, whether conducted in our own right or on behalf of the brand owners and companies that engage us (“Brand Partners”);
• events organised or managed by us, whether in our own right or on behalf of Brand Partners, including roadshows, brand activations, product launches, sampling activities, redemption counters and prize-giving ceremonies (“Events”); and
• our other digital services, including Omnitrack, and our general business dealings with clients, suppliers and visitors.

2. Our role: controller and processor

Omniteam operates contests, promotions, redemption programmes, prize fulfilment and Events both for itself and on behalf of Brand Partners.

Where we act as data controller (referred to in the PDPA as the data controller, formerly data user), such as for our own website, our own marketing, and programmes or Events we run in our own right, this Policy governs our processing of your personal data.

Where we act as data processor on behalf of a Brand Partner, such as when we manage a contest, fulfil prizes or run an Event that the Brand Partner has commissioned, the Brand Partner determines the purposes of processing and its privacy notice applies, supplemented by the campaign-specific terms and privacy statements published for that contest, promotion or Event. In those cases we process your personal data on the Brand Partner’s documented instructions and remain responsible under the PDPA for the security of the personal data we process.

Where a campaign-specific privacy statement is published for a particular contest, promotion or Event, that statement prevails over this Policy to the extent of any inconsistency for that campaign or Event.

3. Personal data we collect

Depending on how you interact with us, we may collect and process the following categories of personal data:

We do not intentionally collect sensitive personal data (such as data concerning health, religious beliefs or biometric data) unless it is strictly necessary for a stated purpose and we have obtained your explicit consent, or the processing is otherwise permitted by the PDPA.

4. How we collect your personal data

• Directly from you, when you message our official WhatsApp business numbers, scan a campaign QR code, complete a web form or microsite entry, upload a proof of purchase, redeem a reward, register for or attend an Event, or contact us by telephone, email or post.
• In person at Events, roadshows and redemption counters that we operate, including through registration forms, on-site verification and photography or videography conducted at the Event.
• From Brand Partners or their appointed agencies, where you have participated in a programme or Event they commissioned and your data is provided to us for processing in accordance with their instructions and applicable law.
• Automatically, through cookies and similar technologies when you use our website (see Section 16).

5. Purposes of processing

We process your personal data for the following purposes:

• to register, validate and administer your participation in contests, promotions, redemption and loyalty programmes and Events;
• to receive, digitise and verify proof of purchase submissions, including automated extraction and validation of receipt data using OCR and AI technology, and manual review where required;
• to conduct winner selection, judging, notification and publication of results where provided for in the applicable campaign terms;
• to fulfil, deliver and account for prizes, rewards and redemptions, including identity verification and disbursement;
• to organise, manage and document Events, including registration, admission, on-site operations and post-event reporting;
• to provide customer support through chatbot and live-agent channels, and to respond to your enquiries and complaints;
• to detect, investigate and prevent fraudulent, duplicate, tampered or otherwise invalid entries, and to protect the integrity of our platforms and Events;
• to send you service and transactional messages relating to a programme or Event you have joined, such as entry confirmations, status updates, winner notifications and event reminders;
• to send you marketing and promotional communications, only where you have opted in, and with the ability to opt out at any time;
• to prepare reporting and analytics for Brand Partners on campaign and Event performance, using aggregated or anonymised data wherever practicable;
• to maintain the security of our systems, and to meet our audit, legal, regulatory and contractual obligations; and
• for purposes related to any of the above.

6. Contest management, prize fulfilment and events on behalf of Brand Partners

Omniteam manages contests, promotions, redemption programmes, prize fulfilment and Events end to end on behalf of Brand Partners.

In carrying out these activities, we process personal data as follows:

• Entry management: We register, validate, deduplicate and shortlist entries, and support judging and winner selection, in accordance with the applicable campaign terms and the Brand Partner’s documented instructions.
• Winner verification: Shortlisted or selected winners may be required to provide or produce identification documents (such as an NRIC or passport) so that we can verify identity and eligibility against entry records, satisfy the Brand Partner’s audit requirements, and prevent fraudulent claims.
• Publication of results: Where the applicable campaign terms so provide, winners’ names, and partially masked identification numbers where required to distinguish winners, may be published on campaign pages, our official channels or the Brand Partner’s channels.
• Prize fulfilment: We process personal data to notify winners, arrange prize collection or delivery, disburse cash or credited prizes, obtain acknowledgements of prize receipt, and maintain fulfilment records for audit and reconciliation.
• Event management: We process registration and attendance data, conduct on-site identity verification where required, and manage guest lists and admission.
• Photography and videography at Events: Photographs, videos or audio recordings may be taken to document Events and report to Brand Partners. Where consent has been obtained or the applicable Event notices provide, these materials may also be used for publicity, marketing and social media purposes.
• Reporting to Brand Partners: Reports are prepared using aggregated or anonymised data wherever practicable, with personal data included only where necessary.

Where these activities are carried out on behalf of a Brand Partner, the Brand Partner is the data controller and we act on its documented instructions.

7. Basis of processing and consent

We process your personal data based on your consent, contractual necessity, compliance with legal obligations and other lawful purposes permitted under the PDPA.

Certain personal data is mandatory for participation in campaigns or Events or for prize fulfilment. If you do not provide it, we may be unable to accept your entry, verify eligibility, admit you to an Event or fulfil your prize.

You may withdraw your consent at any time, subject to legal or contractual restrictions.

8. WhatsApp Business Platform

Our WhatsApp channels operate using the WhatsApp Business Platform provided by Meta.

• We only initiate WhatsApp messages where you have opted in.
• You may opt out at any time by replying STOP or contacting us.
• Messages are transmitted through WhatsApp and protected in transit according to WhatsApp’s encryption practices.
• Your use of WhatsApp is governed by WhatsApp’s own Terms of Service and Privacy Policy.
• Message routing may involve infrastructure operated outside Malaysia.

9. Disclosure of personal data

We may disclose your personal data to:

• Brand Partners and their appointed auditors or agencies;
• service providers and data processors;
• professional advisers;
• regulators and law enforcement agencies where required by law; and
• prospective or actual acquirers during a business transaction.

We do not sell your personal data.

10. Cross-border transfers

Your personal data may be transferred to, stored or processed outside Malaysia where required by our cloud infrastructure, WhatsApp Business Platform or service providers. Such transfers are carried out in accordance with the PDPA and appropriate safeguards.

11. Retention of personal data

We retain personal data only for as long as necessary.

As a general rule, campaign participation, prize fulfilment and Event data is retained for no longer than necessary, generally for up to six (6) months after the close of the relevant campaign or Event unless a longer period is required by law or contractual obligations.

When no longer required, personal data is securely deleted, destroyed or anonymised.

12. Security of personal data

Omniteam is certified to ISO/IEC 27001 and ISO 9001 and is EcoVadis rated.

We implement security measures including:

• encryption of data in transit;
• secured and access-controlled servers;
• role-based access control;
• logging and monitoring; and
• confidentiality obligations on personnel and vendors.

No method of transmission or storage is completely secure.

13. Your rights

Subject to the PDPA, you have the right to:

• Access your personal data.
• Correct inaccurate personal data.
• Withdraw consent.
• Limit processing.
• Stop direct marketing.
• Request data portability where applicable.

To exercise these rights, contact our Data Protection Officer.

14. Personal data of third parties

If you provide us with another individual’s personal data, you confirm that you have informed them of this Policy and obtained their consent.

15. Children and minors

Our campaigns, Events and WhatsApp channels are intended for individuals aged 18 years and above unless otherwise stated.

Where participation by minors is permitted, parental or guardian consent is required.

16. Cookies and website data

Our website and microsites use cookies and similar technologies to enable functionality, remember preferences and understand website usage.

You may manage cookies through your browser settings.

17. Personal data breach

In the event of a personal data breach, we will act in accordance with the PDPA, including notifying the Personal Data Protection Commissioner and affected individuals where required.

18. Changes to this Policy

We may update this Policy from time to time.

The latest version will be published with a revised effective date.

19. Language

This notice is issued in both English and Bahasa Malaysia.

In the event of any inconsistency, the English version shall prevail.

20. Contact us and our Data Protection Officer