Arorra Privacy Policy

Introduction

This Policy should be read together with ARORRA’s Terms and Conditions and any other policies published on the Platform from time to time.

By registering an account, submitting information, or using the ARORRA application, website, software, Platform or related services, you acknowledge that you have read and understood this Privacy Policy and, to the extent permitted or required by applicable law, consent to ARORRA processing your personal data in accordance with this Policy.

Last updated: 31 July 2026

1. Scope of Application

1.1

This Policy applies to personal data processed by ARORRA in the following circumstances:

A user or agent registers an account;
An individual applies for, maintains or terminates agent status;
An individual uses the ARORRA application, website, system or Platform;
An individual purchases, orders, collects, receives delivery of, returns or exchanges products;
An individual applies for credit sales or a credit limit;
An individual participates in commissions, bonuses, rewards, points, promotions or agent programmes;
An individual contacts customer service personnel, sales personnel, agents, employees or other representatives;
An individual submits information relating to complaints, disputes, refunds or outstanding amounts;
An individual conducts transactions or communicates with ARORRA electronically or through other means.

2. Personal Data We May Collect

ARORRA may collect one or more of the following types of information according to its actual business needs:

2.1 Identification and Registration Information

Name;
Username;
Identity card number, passport number or other identification details;
Date of birth;
Nationality;
Gender;
Photograph, profile picture or identification document;
Signature;
Agent number, customer number or account number.

2.2 Contact Information

Mobile phone number;
Telephone number;
Email address;
Correspondence address;
Residential address;
Company or business address;
WhatsApp, WeChat or other communication account details.

2.3 Company and Business Information

Company or trade name;
Company registration number;
Business licence;
Company address;
Information relating to directors, shareholders, partners or persons in charge;
Nature of business;
Sales territory;
Tax information;
Information relating to agent, downline agent or customer relationships;
Registration code and referral code.

2.4 Account and Security Information

Username and encrypted password;
OTP and verification status;
Login date and time;
Login records;
IP address;
Device information;
Browser type;
Operating system;
Application version;
Device identifier;
Account security records;
Password reset records;
Suspicious or unauthorised login records.

ARORRA will not ask you to provide your complete password or complete OTP by telephone, text message or instant messaging.

2.5 Order and Transaction Information

Order details;
Products, quantities and prices;
Delivery address;
Recipient information;
Invoices, receipts and proof of payment;
Payment status;
Return, refund and exchange information;
Credit sales, credit limits and payment terms;
Records of overdue payments and outstanding amounts;
Order cancellation or dispute records;
Transaction information relating to customers, downline agents or agents.

2.6 Financial and Payment Information

Bank name;
Bank account number;
Receiving account information;
Payment method;
Transfer records;
Credit and payment records;
Information relating to commissions, bonuses, rewards, rebates, points and refunds;
Records relating to outstanding amounts, set-offs and debt recovery.

Where payments are processed by a third-party payment service provider or bank, ARORRA may not directly retain complete bank card information.

2.7 Communication and Interaction Information

Emails;
Telephone records;
WhatsApp, WeChat, text messages and in-Platform messages;
Voice messages;
Complaints, enquiries and customer service records;
Relevant communications between agents and customers or downline agents submitted to ARORRA;
Records confirming orders, credit arrangements, payment obligations or outstanding amounts.

2.8 Images, Recordings and Activity Information

Training sessions and activities;
Closed-circuit television recordings;
Audio recordings or videos;
Records of entry into offices, warehouses or event venues.

Where audio recordings, video recordings or photographs are used for other purposes, ARORRA will provide separate notice where reasonably appropriate.

3. Sources of Personal Data

ARORRA may obtain your personal data from the following sources:

Directly from you;
Registration forms, applications or websites;
Agent applications or account updates;
Order, invoice, payment, return or refund records;
Agents, customers or downline agents introduced, referred or managed by you;
ARORRA’s agents, employees, sales personnel, customer service personnel or authorised representatives;
Banks, payment service providers, logistics companies, SMS or OTP service providers;
Identity verification service providers;
Lawfully registered credit reporting agencies;
Government authorities, regulatory authorities or law enforcement agencies;
Lawfully available public sources;
Third parties authorised by you to provide information to ARORRA;
Device and usage records automatically generated by the system.

If you provide ARORRA with information relating to another person, you confirm that:

You have the lawful right to provide such information;
The information is true, accurate and up to date;
You have notified the relevant person where necessary;
ARORRA may process such information in accordance with this Policy.

4. Purposes of Collecting and Processing Personal Data

ARORRA may use personal data for the following purposes:

4.1 Registration and Account Management

Processing account registrations;
Creating and activating accounts;
Verifying identities and contact details;
Verifying mobile phone numbers and sending OTPs;
Processing password resets;
Managing usernames, logins and devices;
Reviewing, approving, rejecting or deferring agent applications;
Updating, suspending, restricting or terminating accounts.

4.2 Agent and Business Management

Managing agent eligibility;
Verifying relationships involving agents, referrers, downline agents and customers;
Managing sales territories, agent levels and business arrangements;
Providing training, policies, price lists and business guidelines;
Evaluating sales performance;
Processing agent applications, authorisations and internal approvals;
Investigating breaches of agent policies or terms.

4.3 Orders, Products and Delivery

Receiving and processing orders;
Verifying products, quantities and prices;
Arranging payments, warehousing, delivery and receipt of goods;
Processing returns, refunds, exchanges and cancellations;
Contacting customers, agents, drivers, warehouses or logistics service providers;
Providing order status updates and transaction records;
Handling product complaints or disputes.

4.4 Payment, Credit and Outstanding Amount Management

Verifying payments;
Managing credit sales, credit limits and deferred payments;
Assessing payment and credit risks;
Recording unpaid amounts and overdue debts;
Contacting agents, customers or downline agents to recover outstanding amounts;
Making authorised set-offs against commissions, bonuses, rewards, rebates, points, refunds or other amounts payable;
Appointing third-party debt recovery agencies, lawyers or advisers to recover amounts;
Commencing, handling or defending legal proceedings;
Submitting true, accurate and verifiable trade or overdue payment information to lawfully registered credit reporting agencies where permitted by applicable law and the relevant conditions.

4.5 Commission, Reward and Financial Management

Calculating and paying commissions;
Managing bonuses, rewards, rebates, points and promotional benefits;
Verifying eligibility based on sales and payments;
Processing adjustments, reversals, set-offs or recoveries;
Preparing financial, tax, audit and internal reports;
Preventing duplicate, unusual or fraudulent transactions.

4.6 Security, Fraud Prevention and Risk Management

Verifying identities;
Protecting account and Platform security;
Detecting unusual logins or transactions;
Preventing fraud, abuse and unauthorised activities;
Investigating complaints, security incidents or suspicious conduct;
Carrying out internal risk, compliance and audit procedures;
Maintaining the security of systems, servers, databases and networks.

4.7 Customer Service and Communications

Responding to enquiries, complaints and requests;
Providing customer or technical support;
Sending notices relating to orders, accounts, payments, security or policies;
Sending important service information;
Handling disputes, refunds or claims;
Recording and improving the quality of customer service.

4.8 System and Business Improvement

Maintaining and improving the application, website and Platform;
Analysing system usage and faults;
Conducting testing, statistical analysis, data analysis and business planning;
Improving products, processes, agent services and user experience;
Developing new functions and services.

4.9 Marketing and Promotions

Where the necessary consent has been obtained or where permitted by law, ARORRA may:

Send information relating to products, promotions, events or rewards;
Provide personalised product and business information;
Invite you to participate in training, events, surveys or promotional programmes;
Contact you through email, text message, WhatsApp, WeChat, Platform notifications or telephone.

You may request to stop receiving non-essential marketing communications at any time by following the unsubscribe instructions contained in the relevant communication or by contacting ARORRA. Opting out of marketing communications will not affect notices relating to your account, orders, payments, security or legal matters.

5. Consequences of Not Providing Personal Data

Some personal data is provided voluntarily, while other personal data is required for ARORRA to provide services, verify identities, process orders, payments and agent applications, or comply with legal requirements.

If you do not provide the required information, ARORRA may be unable to:

Register or activate an account;
Verify your identity or mobile phone number;
Review an agent application;
Process orders, payments or deliveries;
Provide credit sales or a credit limit;
Calculate or pay commissions and rewards;
Process refunds, complaints or disputes;
Provide certain Platform functions;
Continue to maintain your agent status or account.

An email address may be designated as optional information. However, if you choose to provide one, it must remain true, accurate and valid.

6. Disclosure of Personal Data

ARORRA will not sell your personal data without a valid reason.

For the purposes described in this Policy, ARORRA may disclose personal data, to the extent necessary, to the following persons or parties:

ARORRA’s directors, employees and authorised personnel;
Affiliates, subsidiaries or related companies;
Your referring agent, responsible agent, upline agent or authorised business representative;
Warehouse, logistics, transportation and delivery service providers;
Banks, payment gateways and other payment service providers;
SMS, email, OTP, cloud, hosting and information technology service providers;
Identity verification providers, auditors, accountants, tax advisers, insurers and professional advisers;
Lawyers, debt recovery agencies and dispute resolution personnel;
Lawfully registered credit reporting agencies;
Government, tax, regulatory, law enforcement or judicial authorities;
Potential or actual parties involved in a corporate merger, acquisition, sale, restructuring or asset transfer;
Other persons authorised by you or permitted by law.

Where reasonably practicable, ARORRA will require its service providers to process personal data only for authorised purposes and to implement appropriate security measures. According to guidance issued by Malaysia’s personal data protection authority, a data controller that appoints a data processor remains responsible for ensuring that the processor implements security measures to protect personal data.

7. Submission of Information to Credit Reporting Agencies

Where you, a customer for whom you are responsible, or a downline agent has an overdue debt that meets the requirements of applicable law and the relevant submission conditions, ARORRA may, in accordance with the Terms and Conditions and applicable law, submit the following true, accurate and verifiable information to the CTOS Electronic Trade Reference System or another lawfully registered credit reporting agency:

Name or company name;
Identification or company registration information;
Contact information;
Transaction and invoice information;
Amounts due and overdue;
Payment status;
Records of outstanding amounts and debt recovery;
Dispute or settlement status;
Other information reasonably required to verify the trade reference.

Such information may appear in an individual or business credit report and may affect future applications for credit sales, loans, credit limits or other commercial services.

If the relevant outstanding amount has been settled, ARORRA will update the relevant record in accordance with the applicable procedures of the relevant credit reporting agency.

8. Cross-Border Transfer

Some of the service providers, servers, cloud services or technology providers used by ARORRA may be located outside Malaysia or may access personal data from outside Malaysia.

Where it is necessary to transfer personal data across borders, ARORRA will take reasonable measures and process the transfer in accordance with applicable personal data protection laws and relevant guidelines, including assessing the level of protection in the recipient’s jurisdiction, adopting contractual safeguards or obtaining the necessary consent.

9. Data Security

ARORRA will implement reasonable and appropriate administrative, technical and physical security measures to protect personal data, including:

Restricting access to personal data;
Using passwords, OTPs and identity verification;
Monitoring system and account activities;
Imposing confidentiality requirements on employees and service providers;
Maintaining the security of servers, systems and devices;
Performing regular backups and security updates;
Preventing unauthorised access, use, modification, disclosure, copying or deletion;
Investigating and handling security incidents.

However, no method of transmission over the internet, electronic storage or communication can guarantee absolute security. You are also responsible for protecting your username, password, OTP, device and account information.

Malaysia’s personal data protection framework includes a security principle requiring data controllers to take practical measures to protect personal data against loss, misuse, modification, and unauthorised or accidental access or disclosure.

10. Data Breaches and Security Incidents

If a security incident occurs that may pose a risk to personal data, ARORRA may:

Investigate the cause and impact of the incident;
Suspend or restrict the relevant account;
Require a password change or identity re-verification;
Take measures to contain and remedy the incident;
Contact affected individuals;
Notify the personal data protection regulator where required by applicable law;
Retain records relating to the investigation and handling of the incident.

11. Accuracy of Personal Data

You are responsible for ensuring that the personal data provided to ARORRA is true, accurate, complete and up to date.

If your name, mobile phone number, email address, address, banking information, company information or other information changes, you should promptly update it through the Platform or contact ARORRA.

ARORRA may require you to provide supporting documents to verify the information or process a correction request.

12. Retention Period of Personal Data

ARORRA will retain personal data only for as long as necessary to fulfil the purposes for which it was collected, perform contractual obligations, comply with legal, tax and audit requirements, handle disputes, prevent fraud and maintain business records.

The retention period may vary depending on the type of information and applicable legal requirements. When personal data is no longer required, ARORRA will, where reasonably practicable:

Securely delete it;
Destroy it;
Anonymise it; or
Restrict its further use.

Even after an account has been closed or an agency relationship has been terminated, ARORRA may continue to retain certain information for the following purposes:

Incomplete orders or payments;
Recovery of outstanding amounts;
Tax and audit purposes;
Investigation of fraud or breaches;
Legal claims and disputes;
Regulatory and statutory retention requirements.

13. Withdrawal of Consent

Where the processing of personal data is based on your consent, you may withdraw your consent in writing.

The withdrawal of consent will not affect any lawful processing carried out before the withdrawal.

If the withdrawal of consent prevents ARORRA from completing identity verification, processing orders or payments, managing agent status, fulfilling legal obligations or maintaining Platform security, ARORRA may be unable to continue providing some or all of its services.

Even if you withdraw your consent, ARORRA may continue to process necessary personal data for the performance of a contract, compliance with legal obligations, establishment of legal claims, recovery of outstanding amounts, fraud prevention or other lawful grounds.

14. Cookies and Similar Technologies

ARORRA’s website, application or Platform may use cookies, software development kits, logs and similar technologies to:

Maintain login sessions;
Verify accounts;
Record language and system preferences;
Maintain Platform security;
Analyse system performance;
Detect fraud and unusual activities;
Improve functions and user experience.

You may manage certain cookies through your browser or device settings, but disabling certain functions may affect the proper use of the Platform.

15. Third-Party Websites and Services

The ARORRA Platform may contain links to third-party websites, payment platforms, maps, social media or other services.

Such third parties have their own privacy policies and data-processing practices. ARORRA does not control third-party services and is not responsible for their privacy practices.

You should read the relevant third party’s privacy policy before submitting personal data to it.

16. Automated Processing and Analysis

ARORRA may use systems or automated tools to assist with:

Verifying accounts and orders;
Calculating commissions, rewards or balances;
Identifying duplicate registrations;
Detecting unusual transactions, fraud or security risks;
Assessing orders or credit applications;
Improving user experience and business processes.

17. Updates to This Policy

ARORRA may amend this Privacy Policy from time to time to reflect:

Changes in laws and regulatory requirements;
Updates to systems and services;
Changes in business processes;
New products, functions or services;
Security and risk management requirements.

The latest version will be published through the application, website, Platform or other reasonable means.

Your continued use of the Platform after the updated Policy takes effect indicates that you have acknowledged the updated content.

18. Personal Data Enquiries

If you have any enquiries or requests regarding the collection, use, disclosure, correction or retention of your personal data, please contact ARORRA through the following methods:

Email: [email protected]
WhatsApp: +6016-302 2137 or +6016-874 3032

ARORRA Privacy Policy