Last updated: 22 October 2026

    1. About this notice

      Pawnlink is operated by ALPHACLOUD SDN. BHD., company registration number 201501033750 (1159070-K) (“Alphacloud”, “we”, “us” or “our”). This notice explains how personal data is collected, used, disclosed and protected when you use the Pawnlink mobile application, member portal, website and related services.
      Alphacloud is the data controller for Pawnlink account registration and identity verification. Participating pawnshops are the controllers of their pawn-ticket, loan and transaction records; Alphacloud processes those records on their behalf to provide Pawnlink services.
      The Pawnzon loyalty programme is managed by Pawnzon. Alphacloud processes related membership and points information on behalf of the programme operator. Pawnzon loyalty benefits apply only at eligible Pawnzon shops.
      Pawnlink registration is available to people aged 18 or above, including those who do not yet have a pawn ticket.

    2. Personal data we collect

      Depending on the services you use, we collect and process:

      • Account and contact information, such as your name, email address, telephone number, account identifiers, authentication information and preferences.
      • Identity and verification information, such as your IC/passport details, information shown in your identity document, identity-document images, selfies or face-verification captures, and verification results.
      • Pawnbroking and transaction information, such as participating shop details, pawn-ticket and pledged-item information, loan amounts, interest, relevant dates, payment records, transaction status and service requests.
      • Bank-account information and ownership proof, including the receiving-account details you provide and a bank statement or other document required to verify account ownership.
      • Loyalty information, such as membership details, points, relevant activity and communication preferences where you use Pawnzon loyalty services.
      • Technical and diagnostic information about your device, application and technical errors, to support operation, security and troubleshooting.
      • Communications, including enquiries, complaints and supporting information you send us.

      We receive information directly from you, from participating pawnshops through their integrated management systems, from your use of Pawnlink, and from providers involved in the transactions or services you request.
      To view pawn tickets, you must activate ticket access through a subscribed pawnshop. After activation, Pawnlink can display your records from other subscribed shops associated with the same verified identity. This customer view does not give one shop unrestricted access to another shop’s records.

    3. How we use personal data

      We use relevant personal data to:

      • register and administer your account, verify your identity and link you to the correct records;
      • display pawn tickets and process supported services, including interest payment, renewal, principal reduction and requests for additional borrowing against an existing pledge;
      • verify bank-account ownership, facilitate payments and approved disbursements, reconcile transactions and investigate errors;
      • administer applicable loyalty benefits and communication preferences;
      • provide customer support, service notices and security communications;
      • maintain service reliability, investigate technical problems, prevent misuse and protect accounts; and
      • meet applicable legal obligations, maintain necessary records and handle disputes.

      If you choose to receive optional promotions, we also use relevant information for those communications as explained in section 6. We obtain consent where required by law.
      Providing information needed for registration, verification or a transaction is necessary for that function. If you do not provide it, we may be unable to provide the relevant service.

    4. Identity checks, device functions and payments

      Identity verification. For identity verification during mobile registration, you may be asked to scan your IC/passport and submit a selfie or face-verification capture. Authorised staff and appointed verification-support providers review the submitted material. Providers performing this task act solely on Alphacloud’s instructions, without using the records for separate purposes. Uploaded verification material is retained in accordance with section 8.

      Camera, files and approximate location. When you use a related function, Pawnlink may access your camera or files you select for ticket scanning, identity checks or document uploads. If you choose to use location in the Explore feature, Pawnlink uses your approximate device location to help you find nearby shops. You can manage device permissions in your settings; declining a permission may prevent the related function from working.

      Device authentication. Where you enable biometric sign-in, Pawnlink uses your device’s supported authentication functionality to help secure account access. This is separate from the identity documents and selfie captures submitted for registration.

      Technical monitoring. We use technical-monitoring providers to help investigate errors and maintain reliability. Monitoring does not include screenshots, session replay, or audio/video recording of your app use beyond the identity captures you submit for verification.

      Payment authentication. For online banking/FPX and e-wallet payments, passwords, PINs and OTPs are entered on the payment provider’s screens. Pawnlink does not collect or store those payment-authentication credentials.

      Add Loan receiving accounts. Separately, Pawnlink collects and stores your bank-account details and passes them to the relevant pawnshop through its integrated management system. Adding a bank account requires ownership proof. If the pawnshop approves an Add Loan request, it transfers the approved additional amount to your bank account through online banking. Customer transaction funds do not pass to Alphacloud.

    5. Who receives personal data

      For the purposes described in this notice, relevant information is disclosed to:

      • participating pawnshops handling your records, requests and transactions;
      • verification and administrative support providers processing information on our instructions;
      • payment gateways, banks and e-wallet/payment service providers involved in your transactions;
      • cloud hosting and storage providers supporting the service;
      • technical monitoring and diagnostic providers supporting reliability and troubleshooting;
      • loyalty programme operators and eligible Pawnzon shops, where relevant to the benefits you use; and
      • professional advisers or public authorities where necessary for advice, legal obligations, lawful process, disputes or investigations.

      We require appropriate confidentiality, security and processing safeguards from providers acting on our behalf. These disclosures do not authorise unrelated use of your personal data.

      We do not sell or rent your personal data, or provide it to outside advertisers for their own marketing.

      External payment, navigation and other services may also have their own privacy notices. Information exchanged through services integrated into Pawnlink remains subject to the applicable disclosures in this notice.

    6. Communications and optional marketing

      Account, security and transaction communications are part of providing the service. You can manage device notification permissions through your settings.
      If promotional communications are introduced, including Pawnzon offers, they will use a separate optional marketing opt-in. You may decline or unsubscribe from marketing without losing access to your tickets or supported transactions. You can withdraw marketing consent through the unsubscribe option provided or by contacting us. This does not switch off necessary account, security or transaction communications.

    7. Security and processing outside Malaysia

      We take reasonable organisational and technical measures to protect personal data against loss, misuse and unauthorised access, alteration or disclosure. Access is limited to authorised personnel and providers for their relevant responsibilities. We consider privacy risks and data protection when designing and operating the service. No electronic system can guarantee absolute security.
      Personal data may be stored or processed outside Malaysia by providers supporting the service. In particular, uploaded identity-document images, selfie/face captures and bank-ownership proof are stored with a cloud-storage provider in Singapore. Overseas processing is subject to applicable Malaysian personal-data protection requirements and appropriate safeguards.

    8. Retention and account deletion

      We retain personal data only for as long as necessary for the purposes described in this notice and applicable legal obligations. In determining retention, we consider the nature and purpose of the information, the account or transaction relationship, verification and security needs, disputes, and relevant recordkeeping requirements. Information no longer required is securely destroyed, permanently deleted or, where appropriate and lawful, irreversibly anonymised.

      Requesting deletion of your Pawnlink account

      You may request deletion of your Pawnlink account and associated personal data by emailing privacy@pawnlink.com.my. This route is available without reinstalling the app. We may need to verify your identity before acting on your request.
      When processing deletion, we remove the account and associated data that no longer needs to be retained. Certain pawn-contract, transaction, payment, security or request-handling records may remain where necessary for legal obligations, fraud prevention or resolving disputes. Where retention is necessary, we explain the relevant information, reason and applicable retention period or criteria. We inform you when your request has been completed or explain any necessary further steps.
      Deleting a Pawnlink account does not cancel a pawn contract, repay a loan or change rights relating to a pledged item. The relevant pawnshop may need to retain its underlying records and remains your contact for those transactions. You may initiate a deletion request even if you have an active ticket.
      Uninstalling the app or logging out does not delete your account. Requests affecting loyalty information are handled with the programme controller according to the applicable membership terms and retention obligations.

    9. Your choices and requests

      Subject to applicable law, you may request access to or correction of your personal data, withdraw consent, request that processing be limited, or object to direct marketing. Where applicable, you may request transfer of your data to another controller, subject to the legal and technical conditions for data portability.
      Contact us using section 11. We may request information proportionate to verifying your identity and locating the relevant records. We explain any applicable limitation or reason a request cannot be fulfilled, and any permitted fee before charging it. Withdrawal of consent may affect a service that depends on that processing, but does not itself remove a legitimate recordkeeping obligation.
      We assist with routing requests concerning pawnshop records or loyalty data to the responsible controller. If you believe an account has been registered by someone under 18, please contact us.

    10. Changes to this notice

      We may update this notice when our services, data practices or applicable requirements change. The current version shows its last-updated date. We provide additional notice or seek consent where required before relevant new processing begins.
      Providers may change within the recipient categories described above. Such changes must remain consistent with the disclosed purposes, data handling and applicable requirements. A change to those practices will be reflected in this notice as needed.

    11. Contact us

      For privacy enquiries, personal-data requests or account-deletion assistance:
      ALPHACLOUD SDN. BHD. — Pawnlink Privacy Contact
      Company registration: 201501033750 (1159070-K)
      Privacy and account-deletion email: privacy@pawnlink.com.my
      Address: B-1-5, Block B, Pacific Place Commercial Centre, Jalan PJU 1A/4, 47301 Petaling Jaya, Malaysia
      Telephone: +603-7496 8705