MaxDuit

Max Limit, Secure Duit.

GS MAJU ENTERPRISE

45-2, JALAN PUTERI 2/1, BANDAR PUTERI, 47100 PUCHONG, SELANGOR

Customer Support:

Legal

Privacy Policy

Last updated: 10 August 2026

This Privacy Policy explains how GS MAJU ENTERPRISE (“GS Maju”, “we”, “us”, or “our”) collects, uses, discloses, stores, and protects personal data when you use the MaxDuit mobile application, website, and related services (the “Services”). We are committed to handling personal data responsibly and in accordance with the Personal Data Protection Act 2010 of Malaysia (“PDPA”) and other applicable laws.

1. Who we are

MaxDuit is operated by GS MAJU ENTERPRISE. For privacy and data protection matters, please contact our Customer Support:

  • Address: 45-2, JALAN PUTERI 2/1, BANDAR PUTERI, 47100 PUCHONG, SELANGOR
  • Email:

2. Personal data we collect

Depending on how you use MaxDuit and the permissions you grant, we may collect the following categories of personal data:

2.1 Identity and contact information

  • Full name, date of birth, gender, nationality
  • MyKad / NRIC number and related identity details
  • Mobile phone number, email address, residential or mailing address
  • Selfie / facial image and identity document images used for verification (where applicable)
  • Emergency contact details you choose to provide (for example name, relationship, and phone number)

2.2 Financial and loan information

  • Bank account details under your name for disbursement and repayment

2.3 Device model and status information

  • Device model, manufacturer, operating system and version, app version, language, and time zone
  • Device identifiers and network information (for example IP address, connection type)
  • Device status signals used for security and integrity (for example battery/network status, whether the device appears rooted/jailbroken, emulator detection indicators, and similar fraud-risk signals, where available)
  • Crash logs, diagnostics, and performance data

2.4 SMS-related information

  • Where you grant SMS permission, we may access SMS content or metadata necessary for account verification, OTP auto-fill, transaction confirmation, and fraud / credit-risk assessment related to loan review
  • We do not use SMS access to send messages on your behalf without your instruction, and we do not sell SMS content

2.5 Camera information

  • Images or video captured through the camera for MyKad / identity document capture, selfie / liveness checks, and other verification steps you initiate in the app
  • Camera access is used only when you actively use a verification or document-upload feature

2.6 Approximate location

  • Approximate (non-precise) location derived from network/GPS signals when permission is granted
  • Used for fraud prevention, unusual-activity detection, service integrity, and (where relevant) regional product eligibility

2.7 Installed application information

  • A list or summary of applications installed on your device, package names, and related metadata, where permission is granted
  • Used to detect fraud patterns, assess credit / device risk, and protect the integrity of loan applications (for example identifying emulator, malware, or multi-accounting indicators)

2.8 Communications and support

  • Customer support messages, feedback, and complaints
  • In-app notification preferences and delivery status

2.9 Information from third parties

Where permitted by law and with appropriate notices/consents, we may receive information from identity verification providers, banking partners, credit reference sources, fraud-prevention services, and analytics providers to verify your identity, assess applications, and protect the Services.

3. App permissions

MaxDuit may request the following Android / device permissions. You can allow or deny permissions in your device settings. Denying optional permissions may limit certain features (for example auto OTP reading or camera-based KYC), and in some cases may prevent us from completing loan review.

3.1 APP List Permission Statement

With your explicit consent, MaxDuit may collect limited installed application information from your device, including app name, package name, app category, version, install time, update time and related device-risk indicators. This data is used only for loan-service risk review, fraud prevention, malware or fake-app detection, duplicate-account prevention and account security. The data is collected during registration, loan application, limit review, account security review or anti-fraud verification, and is not used for unrelated advertising or sale. The data is encrypted in transit and stored at https://www.maxduit.com. If you refuse or withdraw this permission, automated risk assessment, fraud review, account security checks or loan eligibility review may be unavailable.

3.2 SMS Permission Statement

With your explicit consent, MaxDuit may read and analyze financial or loan-related SMS messages on your device. Relevant SMS data may include sender, date and time, transaction amount, transaction status and financial message content that helps verify income, bank or e-wallet activity, repayment behavior, account ownership, existing loan obligations or fraud risk. We do not use SMS access to read unrelated private conversations, personal chats, unrelated one-time passwords or non-financial messages for marketing. SMS data is requested during loan application, credit limit review, account verification or anti-fraud review, encrypted in transit and stored at https://www.maxduit.com. If you refuse or withdraw this permission, automated credit assessment, affordability review or fraud verification may be unavailable.

3.3 Device Information Permission Statement

When you use MaxDuit, we may collect device and technical information such as device model, operating system version, app version, device identifiers, resettable advertising identifier where available, IP address, network type, mobile carrier, SIM/network status, language, time zone, login time, diagnostic logs, crash logs, root or emulator indicators and other risk signals. This data is used only to identify your device, protect your account, detect abnormal logins, prevent fraud, improve app reliability, troubleshoot errors, prevent duplicate accounts and meet legal or security requirements. Device information is encrypted in transit and stored at https://www.maxduit.com. If this data is limited or blocked, secure login, fraud prevention, risk review or reliable app services may be affected.

3.4 Camera Permission Statement

With your permission, MaxDuit may access your camera only when you open a camera function inside the app to capture identity documents, selfies, liveness-check images, supporting loan documents, income evidence, bank or repayment proof, or other materials required for loan review. Camera access is user-initiated and is used only for KYC, identity verification, account protection, fraud prevention, loan application review, dispute handling and legal compliance. Captured images and verification results are encrypted in transit and stored at https://www.maxduit.com. We do not turn on your camera in the background, take photos without your action or record video without a separate feature notice and consent. If you refuse or withdraw camera permission, some verification or loan functions may be unavailable.

3.5 Location Permission Statement

With your permission, MaxDuit may collect location information, including GPS location, network-based location, approximate region, IP-derived location and location timestamp. Location access may be requested during registration, loan application, risk review, account recovery, anti-fraud checks or security-sensitive transactions. This data is used only to confirm service-region eligibility, reduce identity fraud, detect abnormal account behavior, support responsible credit review, protect accounts and meet applicable legal or regulatory requirements. Location data is encrypted in transit and stored at https://www.maxduit.com. We do not track your location continuously in the background for advertising or unrelated purposes. If you refuse or withdraw location permission, automated review or security functions may be limited.

3.6 Emergency Contact Permission Statement

When you apply for or manage a loan, MaxDuit may ask you to provide emergency or reference contact information, such as contact name, mobile number, relationship, address or other details you submit. If a contact-picker function is provided, we collect only the contact entries that you select or confirm for the loan service, not your full phonebook unless we separately disclose and obtain consent for broader access. Emergency contact information is used only for identity verification, fraud prevention, application review, account recovery, repayment reminders, overdue communication where permitted by law, dispute handling and customer support. The data is encrypted in transit and stored at https://www.maxduit.com. We do not sell emergency contact information or use it for unrelated marketing. If required emergency contact information is not provided, loan application review, account recovery or repayment support may be unavailable.

4. How we collect personal data

  • Directly from you when you register, complete forms, upload documents, grant permissions, or contact support
  • Automatically through the app (device APIs, SDKs, logs) when you interact with the Services and grant relevant permissions
  • From third parties involved in verification, payments, credit assessment, or customer service, where lawful

5. Purposes of processing

We process personal data for the following purposes:

  • Loan review and servicing: verify identity, assess eligibility and risk, underwrite applications, disburse funds, manage repayments, and administer your account
  • Security and fraud prevention: detect and prevent unauthorized access, identity fraud, device abuse, multi-accounting, and misuse of the Services
  • Permission-enabled verification: complete OTP verification, document/selfie capture, location- and device-based risk checks, and emergency-contact workflows
  • Customer support: respond to inquiries and complaints
  • Legal and regulatory compliance: meet record-keeping, audit, anti-money laundering, and other legal obligations
  • Service improvement: analyse app performance, fix bugs, and improve user experience in aggregated or de-identified form where practicable
  • Communications: send service notices, repayment reminders, and (where permitted) product updates or marketing messages — you may opt out of marketing at any time

Consistent with our Safety & Commitment principles, your data is used for loan review and related legitimate service purposes — not for unrelated sale of personal data.

6. Legal bases

Where required under the PDPA and related laws, we process personal data based on one or more of the following:

  • your consent (including device permission prompts and certain optional features or marketing);
  • performance of a contract with you (loan application, agreement, and servicing);
  • compliance with legal obligations; and/or
  • our legitimate interests in securing the Services and preventing fraud, balanced against your rights.

7. Disclosure of personal data

We do not sell your personal information. We may disclose personal data only as needed to:

  • service providers who support hosting, identity verification, SMS/OTP, risk scoring, communications, analytics, payment processing, or customer support, under confidentiality obligations;
  • banking and payment partners for disbursement and repayment;
  • professional advisers (legal, audit, compliance) under duty of confidentiality;
  • regulators, law enforcement, courts, or other authorities when required by law or to protect rights, safety, and property;
  • parties involved in a corporate transaction (merger, acquisition, or restructuring), subject to appropriate safeguards.

We require third parties who process personal data on our behalf to implement appropriate security measures and use the data only for instructed purposes.

8. Security measures

We implement technical and organisational measures designed to protect personal data, including:

  • encryption of sensitive identity, phone, SMS-derived, and private data in transit and at rest where appropriate;
  • access controls and staff confidentiality obligations;
  • monitoring for suspicious activity and vulnerability management;
  • secure development and vendor due-diligence practices;
  • limiting permission-derived data collection to stated loan-review, verification, and fraud-prevention purposes.

No method of transmission or storage is completely secure. Please protect your device, OTPs, and login credentials and notify us immediately of any suspected compromise.

9. Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, including servicing loans, resolving disputes, and meeting legal, accounting, and regulatory retention requirements. Permission-derived data (such as SMS signals used for risk checks, temporary camera captures, approximate location snapshots, installed-app lists, and device status signals) is retained only as needed for verification, risk assessment, audit, and dispute handling, then deleted, destroyed, or anonymised in a secure manner, subject to residual backup copies overwritten in the ordinary course.

10. Your rights and permission controls

Subject to the PDPA and applicable exemptions, you may have the right to:

  • request access to your personal data held by us;
  • request correction of inaccurate or incomplete personal data;
  • withdraw consent where processing is based on consent (this may affect our ability to provide certain Services, including loan approval);
  • limit processing of your personal data in certain circumstances;
  • opt out of direct marketing communications;
  • revoke device permissions (SMS, Camera, Location, and others) at any time in your phone settings — some app features may stop working after revocation;
  • request account cancellation and personal data deletion by contacting Customer Support (subject to outstanding loan settlement and legal retention requirements).

To exercise these rights, contact . We may need to verify your identity before fulfilling a request. We will respond within the timelines required by law.

11. Cookies and similar technologies

Our website may use cookies or similar technologies for essential functionality, security, and analytics. You can control cookies through your browser settings. Disabling certain cookies may affect site functionality. Mobile SDKs in the app may collect device and usage data as described in Sections 2 and 3.

12. Children’s privacy

MaxDuit is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided personal data to us, please contact us so we can take appropriate action.

13. Changes to this Policy

We may update this Privacy Policy from time to time. The “Last updated” date will change when revisions are published. Where required, we will provide additional notice through the app, website, SMS, or email. Continued use of the Services after an update constitutes acknowledgement of the revised Policy, except where mandatory consent is required.

14. Complaints

If you have concerns about how we handle personal data, please contact our Customer Support first. You may also have the right to lodge a complaint with the relevant data protection authority in Malaysia.

15. Contact

GS MAJU ENTERPRISE
45-2, JALAN PUTERI 2/1, BANDAR PUTERI, 47100 PUCHONG, SELANGOR
Customer Support
Email:

This Policy should be read together with our Terms & Conditions and any product-specific disclosures presented in the MaxDuit app at the time of application or disbursement.

← Terms & Conditions ← Back to home