XposedAuto (“we”, “us”, “our”), the Malaysian recond car marketplace for Japan CBU recon vehicles, respects your privacy and is committed to protecting your personal data in accordance with the Personal Data Protection Act 2010 of Malaysia (“PDPA”).
This notice explains what personal data we collect, why we use it, who may receive it, and how you can exercise your rights. The Bahasa Malaysia notice is available alongside this English version. Where consent is required, we request and record it separately.
1. Personal data we collect
We collect only the personal data reasonably necessary to operate the marketplace and provide our services. Depending on how you use this website, this may include:
- Identity and contact details — name, email address, telephone number and address provided when you register an account, send an enquiry or apply as a dealer.
- Dealer business details — company name, registration number (SSM), business address and authorised representatives provided during dealer onboarding.
- Dealer verification records — an SSM registration document supplied by the authorised dealer applicant. An SSM document may also identify other people. Dealer applications do not require an owner or director's identity card (IC).
- Agent verification records — the front and back of an agent's IC, supplied by the dealer administrator with the agent's authorisation.
- IC images may include a photograph, identity number, address and religion or other information that needs particular care. We do not ask you to provide unrelated documents or details.
- Enquiry and preference details — vehicles you view or enquire about, estimates you request, and communications between you and dealers conducted through the website.
- Technical and usage data — device and browser information, pages visited, and interactions, collected through cookies and similar technologies (see section 5).
2. How we use your data
We process your personal data for the following purposes:
- Creating and administering your account, including authentication and security.
- Forwarding your enquiries and contact details to the relevant dealer so the dealer can respond to you.
- Operating, maintaining and improving the marketplace, including producing estimates and personalising content.
- Communicating with you about your account, enquiries, reservations and support requests.
- Conducting due diligence on dealer applications and monitoring listings for fraud prevention and platform safety.
- Checking the company registration against the dealer application and SSM record, deciding whether to approve the dealer, and managing later account, dispute, fraud and legal issues where necessary.
- Storing the agent's IC for team onboarding and managing dealer team access. The dealer administrator is responsible for checking the agent's identity and IC validity. XposedAuto checks file safety and does not automatically validate the IC or conduct a routine human review of agent ICs.
- Complying with legal obligations, including requests from Malaysian authorities and courts.
- Where required under the PDPA, we will obtain your consent before using your data for direct marketing, and you may opt out at any time.
3. Required verification documents and their source
An SSM record is required to complete a new dealer application. The authorised applicant accepts the Terms & Conditions and this Privacy Notice on the application form. An agent's front and back IC are required before that agent can access a dealer workspace. You may decline to provide the required document, but we cannot complete the relevant approval or access request without it. These documents are not required to browse public listings.
A dealer administrator supplies the agent's IC with the agent's authorisation. The agent accepts the identity notice when claiming their invitation. The administrator's authority declaration is separate from the agent's choice.
4. Disclosure of your data
We do not sell your personal data. We disclose it only as described below:
- Dealers — when you send an enquiry about a listing, the relevant dealer receives your name, contact details and enquiry contents so it can respond.
- Service providers — trusted processors who provide hosting, analytics, communications and technical support, bound to use data only on our instructions.
- Verification documents — designated XposedAuto reviewers may access dealer application records. An agent's IC is available to authorised administrators of that dealer for their team workflow; XposedAuto personnel may access it only through restricted, audited incident or legal handling. Essential storage and processing providers may handle the documents on our instructions. Verification documents are not used for marketing or shown in public listings.
- Authorities — the Royal Malaysian Police, Malaysian Communications and Multimedia Commission, courts or other lawful authorities where required by law.
- Business transfers — in connection with a merger, acquisition or sale of assets, subject to confidentiality safeguards.
5. Transfer of data outside Malaysia
Our servers and some service providers may be located outside Malaysia. Where personal data is transferred abroad, we take reasonable steps to ensure the receiving party continues to protect it to a standard comparable to the PDPA, as required by section 129 of the PDPA.
6. Cookies and similar technologies
We use cookies and similar technologies to keep you signed in, remember your preferences (such as sort order and filters), measure website performance, and understand how the marketplace is used. You can control cookies through your browser settings; disabling them may affect some features, such as staying signed in.
7. Security and retention
We use access restrictions, encrypted connections, private document storage and access records appropriate to the sensitivity of identity documents. Routine document previews carry an xposedauto mark in an added margin so it does not cover the document's text. A mark does not prevent copying, so access restrictions remain essential.
We keep verification documents during the application or agent onboarding and, after a decision, only while reasonably needed for account administration, disputes, fraud investigation, or a documented legal obligation or hold. We review that need and delete documents when it ends, including after an account closes. Restricted backups may expire later under a bounded backup cycle. We do not claim a fixed Malaysian legal retention period for these documents.
8. Your rights
Under the PDPA, you have the right to request access to your personal data held by us (section 30) and to request correction of inaccurate or incomplete data (section 34). To exercise these rights, or to withdraw consent, limit processing, or complain about our handling of your data, contact us through the contact details published on this website.
We will respond within the timeframes required by law and may need to verify your identity first. A prescribed fee may apply to access requests as permitted under the PDPA. If you remain dissatisfied, you may lodge a complaint with the Personal Data Protection Commissioner of Malaysia.
9. Children
This website is not directed at persons under 18 years of age, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, please contact us so we can delete it.
10. Changes to this policy and contact
We may update this Privacy Policy from time to time. Material changes will be published on this page with a revised “Last updated” date. If a change affects a new collection or purpose that needs consent, we will present the relevant notice and request that consent separately.
For any question about this policy or your personal data, please contact us through the contact details published on this website.
11. Privacy contact
Contact for privacy requests and complaints: XposedAuto · [email protected].