Capitalink

Privacy Policy

Effective 19 July 2026 · Capitalink Sdn Bhd

1. Scope and data controller

This Privacy Policy explains how Capitalink Sdn Bhd (“Capitalink”, “we”) collects, uses, discloses, and protects personal data in connection with the Capitalink marketplace, in accordance with the Malaysian Personal Data Protection Act 2010 (PDPA). Capitalink is the data controller for the personal data described below.

2. What we collect

Depending on whether you use Capitalink as a Borrower, Lender, or visitor, we collect:

  • Identity data — full name, IC/passport number, date of birth.
  • Contact data — email address, phone number, residential address.
  • Employment and income data — employment type, employer/business name, income, employment duration, existing loan commitments — used only to help Lenders assess an application, never published publicly.
  • Loan application data — amount requested, purpose, tenure, and uploaded supporting documents.
  • Sensitive personal data — race is an optional field, collected only with your explicit, separate consent as required under the PDPA, and used solely to support a Lender's own assessment.
  • Institution data (Lenders) — legal name, licence number, licence documents, and the identity of authorised institution users.
  • Technical data — IP address, device/browser information, and login activity, collected for security and fraud-prevention purposes.

3. Why we collect it

  • To assess your application for completeness (not creditworthiness) and list it to Lenders;
  • To allow a matched Lender to make contact and carry out its own credit assessment;
  • To verify a Lender institution's licence before activating its account;
  • To calculate and verify platform fees owed at the point of a Match;
  • To detect fraud, monitor for policy violations (such as attempts to share contact details before a Match), and keep the platform secure;
  • To comply with our own legal and regulatory obligations.

4. Who we share it with

Your application data is shown to Lenders only in anonymised form (loan amount, purpose, tenure, country, loan type) until a Lender expresses interest — your name, IC number, and contact details are shared with a specific Lender only once that Lender is reviewing your matched application. We do not sell personal data to third parties, and we do not share it for third-party marketing purposes.

We may disclose personal data where required by Malaysian law, regulation, or a valid order from a court or regulator (including Bank Negara Malaysia or the Consumer Credit Commission in connection with a Lender's licence).

5. How long we keep it

We retain personal data for as long as your account is active, and for a reasonable period afterward to meet our legal, accounting, and regulatory record-keeping obligations, or to resolve disputes. You may request deletion of your account data at any time, subject to any information we're required to retain by law.

6. How we protect it

Uploaded documents are encrypted at rest and served via short-lived signed URLs. Passwords are hashed, never stored in plain text. Access to personal data within Capitalink is role-restricted — for example, an admin reviewing document completeness does not have access to fee or financial configuration, and vice versa. All traffic to our platform is encrypted in transit (HTTPS/TLS).

7. Your rights under the PDPA

You have the right to:

  • Request access to the personal data we hold about you;
  • Request correction of inaccurate or incomplete data;
  • Withdraw consent for the collection of sensitive personal data (such as race) at any time, without affecting the lawfulness of processing carried out before withdrawal;
  • Request that we limit further processing of your data, subject to our legal obligations;
  • Lodge a complaint with the Personal Data Protection Commissioner of Malaysia if you believe your data has been mishandled.

To exercise any of these rights, contact privacy@capitalink.io.

8. Cookies

We use essential cookies/local storage to keep you signed in and remember your language preference. We do not currently use third-party advertising or tracking cookies.

9. Children's data

Capitalink is not intended for use by anyone under 18, and we do not knowingly collect data from minors.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified in-app or by email before they take effect.

11. Contact us

For any privacy question or request, contact privacy@capitalink.io.