Privacy Policy

The information we process will depend on the account referred to us and the services we have been asked to perform.

This includes:

• Identification details, such as your name, identification number and date of birth;
• Contact details, including your addresses, telephone number(s) and email addresses;
• Account and financial information, including the relevant creditor, account or facility reference, outstanding amount, repayment history and payment information;
• Employment or income information, where relevant and lawfully provided;
• Communications with us, including calls, call recordings where applicable, emails, letters, SMSes, WhatsApp messages and interaction notes;
• Information relating to enquiries, disputes, complaints or repayment arrangements; and
• Technical information generated through the use of our website, such as IP address, browser or device information and cookies, where applicable.

We only process information that is relevant to the services we provide, encompassing our legal, regulatory and operational responsibilities.

In most cases, personal data relating to an account is provided to us by the bank, financial institution, company or any other creditor that appointed us.

We may also receive information:

• Directly from you;
• From an authorised person to act on your behalf;
• Through our communications and interactions with you;
• From service providers or professional advisers involved in the relevant account, where appropriate; and
• From public, official or other lawful sources where permitted.

We use your data only for purposes connected with our business and the services that we have been appointed to provide.

These purposes may include:

• Managing and recovering outstanding accounts;
• Confirming your identity and account information;
• Communicating with you about the relevant account;
• Maintaining accurate records;
• Administering authorised repayment or settlement arrangements;
• Recording and reconciling payments, where applicable;
• Responding to enquiries, disputes and complaints;
• Monitoring service quality and training our personnel;
• Preventing and investigating fraud, impersonation or security incidents;
• Carrying out audit, compliance and risk-management activities;
• Fulfilling lawful requirements imposed by our clients; and
• Complying with applicable legal and regulatory obligations.

Personal data obtained in connection with our business is not sold or used by us for any unrelated purposes.

All Personal data and information relating to an account is treated as strictly confidential.

Where necessary and permitted, information may be shared with:

• The creditor or company that appointed us;
• Our authorised personnel;
• A person properly authorised to act on your behalf;
• SKP or other regulatory and governmental authorities;
• Law enforcement agencies; and
• Courts, Lawyers, Auditors and/or any other persons where disclosure is required or permitted by law.

All credit-consumer information is strictly handled in accordance with the confidentiality and disclosure requirements prescribed by Suruhanjaya Kredit Pengguna (SKP).

SOHO maintains appropriate technical, organisational and physical safeguards designed to protect personal data against loss, misuse, unauthorised access, alteration and/or disclosure.

Access to personal data is limited to only authorised person(s) who require it for legitimate purposes.

We also maintain control governing the handling of credit-consumer information throughout its lifecycle, including its collection, storage, use, transmission, disclosure and disposal.

We do not retain personal data indefinitely. Information is kept for the period it is required to:

• Manage the relevant account;
• Satisfy legal and regulatory obligations;
• Meet applicable contractual, audit, compliance requirements; and
• Deal with complaints, disputes and/or legal proceedings.

When information is no longer required, steps are taken to securely delete, destroy or otherwise dispose of it.

Subject to the PDPA and any applicable limitations or exceptions, you may request:

• Access to personal data held about you; and
• Correction of personal data that is inaccurate, incomplete, misleading or not up to date.

We may ask you to provide sufficient information to verify your identity before acting on a request.

Where the relevant personal data is controlled by the creditor that appointed us, we may refer or coordinate your request with that creditor where appropriate.

You may also contact us if you have concerns about the way your personal data is being handled.

Certain information may be required so that we can:

• Verify your identity;
• Identify the relevant account(s);
• Communicate account-specific information;
• Investigate a dispute, complaint; or
• Process a request relating to the account(s).

If the required information is not provided, we may be unable to verify your identity or deal with the relevant request.

A failure to provide information does not by itself affect, waive or discharge any obligation you may have to the relevant creditor.

Accurate information helps us communicate with you properly and manage the relevant account appropriately.

If your contact details have changed, or you believe information held by us is inaccurate or incomplete, please kindly notify us so that the relevant records may be reviewed and updated where appropriate.

If you wish to request access for the correction of your personal data, raise a privacy concern, or ask a question about this Privacy Notice, please contact:

Where your concern relates to the conduct of our representative or the handling of your account, you may also contact us through our Complaints & Feedback channel.