Privacy Policy

This Privacy Policy explains how CHEVIN Sdn. Bhd. (“CHEVIN”, “we”, “us”, or “our”) collects, uses, discloses, stores, and otherwise processes personal data in connection with your use of our website (www.chevinglobal.com), products, services, and programs, including our referral activities and Brand Partner Program.
This Privacy Policy is issued in compliance with Malaysia’s Personal Data Protection Act 2010 (PDPA), which regulates the processing of personal data in commercial transactions. By accessing our website, registering an account, making a purchase, or participating in any of our programs, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy.

1. Definitions

“Member”: any individual who has successfully registered an account on the CHEVIN platform.
“Brand Partner”: a Member who has been approved to participate in the CHEVIN Brand Partner Program and is assigned a unique referral link.
“Referral”: a person who accesses the CHEVIN platform through a referral link or other referral source.
“Personal Data”: any information that identifies or can identify an individual, directly or indirectly, as defined under the PDPA 2010.
“Sensitive Personal Data”: personal data consisting of identity document data, which requires express consent for processing.
“eKYC”: the electronic Know Your Customer identity verification process conducted via our appointed third-party provider, Jumio Inc., required for Brand Partner application.

2. Who This Policy Applies To

This Privacy Policy applies to all persons who interact with CHEVIN, including:

Members who visit our website, register an account, or make a purchase;
Brand Partners who participate in the Brand Partner Program; and
any other individual whose personal data is processed in connection with our business operations.

Brand Partners are subject to additional data processing described in Section 8 (Brand Partner eKYC: Identity Verification Data) in addition to all general provisions.

3. Personal Data We May Collect

3.1 From All Members

Identity data: name, date of birth
Contact data: email address, telephone number, billing address, delivery address
Account data: login credentials, account preferences
Transaction data: purchase history, order details, payment records processed via our secure payment gateway
Loyalty and rewards data: CHEVIN Points balance and history, Birthday Reward records, Delivery Voucher records, referral activity
Communications data: enquiries, feedback, customer support interactions
Technical data: IP address, browser type, device information, operating system
Usage data: pages visited, features used, session duration, click behaviour
Marketing preferences: opt-in and opt-out records for marketing communications

3.2 Additionally From Brand Partners and Applicants

In addition to the data listed above, Brand Partners and applicants are subject to the following additional data collection:

Identity document data (Sensitive Personal Data): a copy of your government-issued identity document (MyKad or Passport), collected via Jumio eKYC for identity verification
Bank account details: account holder name, bank name, and bank account number, collected solely for Commission payout processing
Social media information: social media account details where provided in connection with Program participation
Affiliate performance data: referral records, L1 network sales data, Commission history, rank progression records, and dashboard activity
Tax information: where required by applicable law or for payout compliance purposes

4. How We Collect Your Personal Data

We collect personal data through the following means:

Directly from you when you register an account, place an order, apply as a brand partner,
contact our support team, or participate in our programs or promotions;
Automatically when you use our website, through cookies, analytics tools, and similar technologies (see section 9);
From our appointed identity verification provider, jumio inc., in connection with the brand partner ekyc process;
From payment service providers and financial institutions in connection with purchase and payout processing;
From logistics and delivery partners in connection with order fulfilment; and
From other lawful sources connected with our commercial activities.

5. Purposes of Processing

5.1 For All Members

Creating and managing your CHEVIN Account;
Processing orders, payments, and arranging delivery;
Administering Birthday Rewards, CHEVIN Points, Delivery Vouchers, and Referral Programs;
Providing customer service and responding to enquiries;
Communicating with you about orders, account updates, promotions, and policy changes;
Analysing website usage and improving our products, services, and user experience;
Fraud prevention, security monitoring, and risk management;
Complying with legal, regulatory, and tax obligations;
Internal record keeping and audit purposes; and
Marketing and promotional communications (you may opt out at any time).

5.2 Additionally For Brand Partners and Applicants

Verifying identity through the eKYC process as a condition of Brand Partner approval;
Administering the Brand Partner Program, including tracking referrals, L1 network sales, Commission calculations, and rank management;
Processing Commission payouts to the Brand Partner’s registered bank account;
Managing the Brand Partner’s dashboard, performance records, and program communications;
Complying with applicable laws, audit requirements, and financial regulations; and
Investigating suspected fraud, abuse, or breach of the Brand Partner Program Terms and Conditions.

6. Referral and Brand Partner Program Data

6.1 Where you access, register, or make a purchase through a referral link or other referral source, your activity may be recorded and associated with that referral source for tracking, reporting, and reward purposes.

6.2 Referral sources may include Brand Partners, Members, or other marketing and promotional channels.

6.3 Such referral associations may be maintained on an ongoing basis for future transactions, subject to CHEVIN’s system design, internal policies, and anti-fraud measures.

6.4 CHEVIN uses cookies, tracking identifiers, and similar technologies to establish and maintain referral relationships and to validate Commission entitlements.

6.5 Brand Partners will not be provided with full personal data of their attributed Members.
Brand Partners may only access limited, anonymised, or aggregated performance data through their Affiliate Dashboard, as determined by CHEVIN.

6.6 CHEVIN reserves the right to determine the validity of any referral attribution, tracking record, or Commission entitlement.

7. Disclosure of Personal Data

- We may disclose your personal data to the following categories of recipients, only to the extent necessary for the purposes described in this Privacy Policy:
- Payment service providers and financial institutions (for processing purchases and Commission payouts);
- Logistics and delivery partners (for order fulfilment);
- Jumio Inc., our appointed identity verification service provider (for Brand Partner ekYC processing only – see Section 8);
- IT, hosting, analytics, and platform service providers;
- Professional advisers, including auditors, accountants, and legal counsel;
- Regulatory authorities, law enforcement agencies, or government bodies where required by law or by a valid court order; and
- Any other party with your prior written consent.

7.1 We do not sell your personal data to third parties for their own marketing or commercial purposes.

7.2 Where we engage third-party service providers to process personal data on our behalf, we require them to do so only in accordance with our instructions, applicable data protection laws, and appropriate confidentiality obligations.

8. Brand Partner eKYC: Identity Verification Data

This section applies to Brand Partners and applicants only

The following provisions govern the collection, processing, and transfer of Sensitive Personal Data collected during the Brand Partner identity verification (eKYC) process.

8.1 As a condition of applying to become a Brand Partner, CHEVIN requires all applicants to complete an electronic Know Your Customer (eKYC) identity verification process. This process is administered by Jumio Inc. (Jumio”), a third-party identity verification provider.

8.2 During the ekY process, the following Sensitive Personal Data is collected and processed by Jumio on CHEVIN’s behalf: a copy of your government-issued identity document (MyKad or Passport).

8.3 This data is collected solely to verify your identity as a condition of Brand Partner approval. Jumio operates internationally and your data may be stored and processed outside Malaysia – by submitting to eKYC, you expressly consent to this cross-border transfer. Jumio’s processing is also subject to Jumio’s own Privacy Policy (www.jumio.com/legal-information/privacy-notices). Identity document data is retained by Jumio as required by applicable law; CHEVIN retains eKYC verification outcome records for the duration of your Brand Partner participation and a minimum of seven (7) years thereafter.

8.4 You may withdraw your consent to the eKYC process at any time by contacting us at [email protected]. Withdrawal of consent will result in your inability to apply for or continue as a Brand Partner.

9. Cookies and Tracking Technologies

9.1 We use cookies and similar tracking technologies on our website to: (a) operate and maintain the website and your session; (b) remember your preferences and login information; (c) analyse website usage and improve user experience; and (d) support referral tracking and affiliate attribution for Commission purposes.

9.2 We may use third-party analytics and advertising tools on our website. Each tool is governed by its own privacy policy.

9.3 You may manage your cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of our website.

10. Cross-Border Data Transfer

10.1 Your personal data may be stored, processed, or transferred to countries outside Malaysia where necessary for our operations or service providers, including the transfer of Brand Partner identity verification data to Jumio Inc. as described in Section 8.

10.2 Where cross-border transfers occur, CHEVIN will take reasonable steps to ensure your personal data is handled with an appropriate level of protection consistent with PDPA 2010.

10.3 By providing your personal data and using our services, you consent to the transfer and processing of your personal data outside Malaysia as described in this Privacy Policy.

11. Data Security

11.1 We implement reasonable technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction.

11.2 All payment transactions are processed through our appointed secure payment gateway. CHEVIN does not store your full payment card details.

11.3 No internet transmission or electronic storage system is completely secure. We cannot guarantee absolute security.

12. Data Retention

12.1 We retain your personal data only for as long as reasonably necessary for the purposes for which it was collected, or as required by applicable law.

12.2 General guidelines: (a) Account and transaction data — minimum 7 years for financial and legal compliance; (b) eKYC verification records — duration of Brand Partner participation plus minimum 7 years; (c) Marketing preference records — until you opt out or request deletion.

12.3 Upon account deletion, we will retain only data required by law and delete or anonymise the remainder within a reasonable period.

13. Data Breach Notification and Data Protection Contact

13.1 In the event of a personal data breach that poses a risk to the rights and freedoms of individuals, CHEVIN will assess the incident and take appropriate steps in accordance with applicable data protection laws, including notifying the relevant regulatory authority and affected individuals where required by law.

13.2 CHEVIN may appoint or designate a Data Protection Officer or authorised privacy contact where required by applicable law. Any personal data enquiries, access or correction requests, withdrawal of consent, or data protection concerns may be directed to [email protected]

14. Your Rights Under PDPA 2010

Subject to applicable law, you have the following rights:

Right of Access: to request access to the personal data we hold about you;
Right of Correction: to request correction of inaccurate, incomplete, or out-of-date personal data;
Right to Withdraw Consent: to withdraw consent to certain processing activities – note that withdrawal may affect your ability to use certain features or participate in our programs;
Right to Object to Marketing: to opt out of marketing communications at any time; and
Right to Request Deletion: to request deletion of your personal data where no longer necessary, subject to legal retention obligations.

14.1 To exercise any of the above rights, please contact us in writing at [email protected]. We may require sufficient information to verify your identity before processing your request.