Privacy Policy

1. Identity of the Data Controller

Galasmas Holdings Sdn. Bhd. ("Company", "we", "us", "our") is a company incorporated under the laws of Malaysia, operating as an authorised money services agent of Lulu International Exchange Sdn. Bhd. ("Lulu Money"). We operate a money changing and international remittance counter at Lot 12780, Plot 31, Ground Floor Sublot 79, Galacity, Jalan Tun Jugah, 3 Storey Shophouse, 93250 Kuching, Sarawak, Malaysia.

This Privacy Policy governs all personal data collected, processed, stored, and disclosed through this website ("Site") and its associated online forms. By submitting any information through this Site, you confirm that you have read, understood, and freely consented to the practices described in this Policy. If you do not agree with any part of this Policy, you must not use this Site or submit any forms.

2. Scope and Application

This Policy applies exclusively to personal data provided by individuals ("you", "your") through the digital forms available on this Site, including the Remittance Request Form and the General Enquiry Form, which prepare a message for you to send through WhatsApp. It does not apply to personal data collected through other channels such as in-person counter transactions, telephone communications, or platforms operated independently by Lulu Money or any other third party.

The processing of personal data in connection with actual remittance transactions — including the collection of identification documents, biometric data, and financial information — is governed separately by Lulu Money's own data policies, transaction records, and applicable Bank Negara Malaysia regulations, which are outside the scope of this Policy.

3. Personal Data We Collect

We collect only such personal data as you voluntarily choose to provide when completing and submitting a form on this Site. Depending on the form, this may include:

• Full name
• Mobile phone number
• Email address
• Destination country and currency (remittance requests)
• Intended transfer amount and preferred transfer date (remittance requests)
• Enquiry type and currency of interest (general enquiries)
• Any additional information you voluntarily include in the message or notes field

We do not collect through this Site: payment card numbers, bank account details, MyKad or passport numbers, biometric identifiers, income information, or any supporting documents. Such information, where required to complete an actual transaction, is collected in person at our licensed counter premises in accordance with applicable law.

We do not automatically collect technical data including IP addresses, browser fingerprints, device identifiers, geolocation data, or behavioural tracking data. This Site does not deploy cookies, analytics tools, advertising pixels, session recording software, or any third-party monitoring technology of any kind.

4. Purpose and Legal Basis for Processing

Personal data collected through this Site is processed solely for the following lawful purposes:

• Service delivery: To respond to your enquiry or remittance request, to verify the information you have provided, and to contact you by phone or email to arrange the completion of your intended transaction.
• Internal recordkeeping: To maintain internal business records for operational, staff coordination, and quality assurance purposes.
• Legal and regulatory compliance: To comply with applicable Malaysian law, including but not limited to the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA), directions issued by Bank Negara Malaysia, and any applicable obligations under our agency agreement with Lulu Money.

We do not process your personal data for direct marketing, profiling, automated decision-making, cross-selling, or any secondary purpose not explicitly listed above, without your prior express written consent.

5. Exchange Rate and Information Disclaimer

Exchange rates and currency information displayed on this Site are sourced from our internal pricing database and are updated periodically at our sole discretion. All rates and information published on this Site are provided for general informational and indicative purposes only. They do not constitute, and shall not be construed as, a binding offer, firm quotation, representation, warranty, or commitment to transact at any stated rate or on any stated terms.

Actual transaction rates are confirmed by our authorised staff at the time of processing and are subject to real-time market conditions, transaction volume, currency availability, and other operational factors. The Company accepts no responsibility or liability whatsoever for any loss, damage, cost, or consequence arising directly or indirectly from any reliance placed on exchange rate information or other content displayed on this Site.

All information on this Site is provided on an "as is" and "as available" basis without any warranty of any kind, express or implied, including but not limited to warranties of accuracy, completeness, timeliness, fitness for a particular purpose, or non-infringement.

6. Data Storage, Security and Retention

The Site does not currently store enquiry or remittance form submissions in its own website database. When you submit either form, the information you entered is used to prepare a WhatsApp message and you are redirected to WhatsApp to choose whether to send it. If you send that message, its handling is subject to WhatsApp's and Meta's applicable terms and privacy practices, as well as our handling of the message after we receive it.

We implement reasonable and appropriate administrative, physical, and technical safeguards to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. However, no electronic transmission over the internet or electronic storage system is completely secure. Whilst we take all commercially reasonable steps to protect your personal data, we cannot guarantee absolute security and, to the maximum extent permitted by applicable law, shall not be liable for any unauthorised access to or disclosure of personal data that occurs despite such measures.

Personal data that you choose to send to us through WhatsApp may be retained for as long as reasonably necessary for customer service, operational, legal, regulatory, and recordkeeping purposes. Retention requirements for completed money services transactions may differ and are governed by the applicable transaction process, law, regulatory requirements, and the principal operator's policies.

7. Disclosure of Personal Data to Third Parties

We do not sell, rent, lease, trade, or otherwise transfer your personal data to any third party for commercial or marketing purposes. Personal data may be disclosed only in the following strictly limited circumstances:

• Lulu Money (principal operator): Personal data relating to a remittance request may be shared with Lulu International Exchange Sdn. Bhd. or its designated processing agents, to the extent strictly necessary to facilitate and complete the international money transfer you have requested. Such disclosure is governed by Lulu Money's own privacy and data handling policies.
• Legal obligation: Where required or expressly permitted by Malaysian law, court order, subpoena, regulatory direction, or lawful request from a competent authority, including but not limited to Bank Negara Malaysia, the Financial Intelligence and Enforcement Department, the Royal Malaysia Police, or the Malaysian Anti-Corruption Commission.
• Protection of rights and safety: Where disclosure is reasonably necessary to protect the legal rights, property, or safety of the Company, its directors, employees, customers, or the public, or to detect, prevent, or address fraud, security incidents, or other unlawful activity.
• Corporate transactions: In connection with any merger, acquisition, restructuring, or sale of all or substantially all of the Company's assets, subject to the acquiring party agreeing to be bound by terms no less protective than this Policy.

8. Cookies and Tracking Technologies

This Site does not use cookies of any kind, including strictly necessary, functional, performance, analytical, or advertising cookies. No third-party analytics platforms, advertising networks, remarketing pixels, heatmap tools, or session recording services are deployed or active on this Site. We do not monitor, record, or profile any aspect of your browsing behaviour.

9. Third-Party Links and External Services

This Site may contain hyperlinks to third-party websites and services including but not limited to WhatsApp (Meta Platforms, Inc.), Google Maps (Google LLC), Google Fonts, and Google Sheets used to retrieve the exchange-rate data displayed on the Site. The Company has no control over the content, data practices, or privacy policies of such third-party platforms and does not endorse or accept any responsibility for them. We strongly recommend that you review the applicable privacy notices of any third-party platform before providing any personal data to that platform.

10. Your Rights Under the Personal Data Protection Act 2010 (Malaysia)

In accordance with the Personal Data Protection Act 2010 of Malaysia ("PDPA"), you have the following rights with respect to personal data held about you by the Company:

• Right of access: To submit a written request for a copy of the personal data we hold about you, subject to applicable fees and statutory exceptions.
• Right of correction: To request correction of personal data that is inaccurate, incomplete, misleading, or outdated.
• Right to withdraw consent: To withdraw your consent to the processing of your personal data at any time by notifying us in writing. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to the withdrawal and shall not prevent the Company from processing personal data where another lawful basis exists.
• Right to limit processing: To request, in writing, that the Company limit or cease use of your personal data for specified purposes, where permitted under the PDPA and not inconsistent with any overriding legal obligation.

To exercise any of the above rights, please contact us in writing using the details set out in Section 12 of this Policy. We will acknowledge your request promptly and respond within a reasonable period. We reserve the right to charge a prescribed processing fee where permitted under the PDPA and to decline requests that are unfounded, excessive, or contrary to applicable law.

11. Limitation of Liability and Indemnity

To the fullest extent permitted by applicable Malaysian law, the Company, its directors, officers, employees, agents, and affiliates shall not be liable for any direct, indirect, incidental, consequential, special, exemplary, or punitive loss or damage of any nature whatsoever, arising out of or in connection with: (a) your access to or use of, or inability to access or use, this Site or any content thereon; (b) any inaccuracy, error, omission, or incompleteness in exchange rate information or other content published on this Site; (c) any unauthorised access to, alteration of, or loss of your data beyond the Company's reasonable control; (d) any act or omission of any third-party service provider referenced on or linked from this Site; or (e) any delay, interruption, suspension, or unavailability of this Site, for any reason.

You agree to indemnify and hold harmless the Company and its directors, officers, employees, and agents from and against any and all claims, liabilities, damages, losses, costs, and expenses (including reasonable legal fees) arising out of or in connection with: (i) your use of this Site in violation of this Policy or any applicable law; (ii) any false, inaccurate, or misleading information submitted by you through this Site; or (iii) your infringement of any rights of any third party.

12. Contact Details

For any questions, concerns, access or correction requests, or complaints relating to this Privacy Policy or our handling of your personal data, please contact us through the following channels:

• WhatsApp: +60 11-1525 5858
• Counter address: Lot 12780, Plot 31, Ground Floor Sublot 79, Galacity, Jalan Tun Jugah, 3 Storey Shophouse, 93250 Kuching, Sarawak, Malaysia
• Operating hours: Monday – Saturday, 9:00 am – 5:30 pm MYT (excluding public holidays)

13. Governing Law and Jurisdiction

This Privacy Policy is governed by, and shall be construed exclusively in accordance with, the laws of Malaysia, including without limitation the Personal Data Protection Act 2010, the Communications and Multimedia Act 1998, and all other applicable Malaysian statutes and regulations. Any dispute, claim, or matter arising out of or in connection with this Policy, including any question regarding its existence, validity, or termination, shall be subject to the exclusive jurisdiction of the courts of Malaysia, and the parties irrevocably submit to the personal jurisdiction of such courts.

14. Amendments to This Policy

The Company reserves the right to amend, modify, update, or replace this Privacy Policy at any time and without prior notice to you. Any changes will be published on this page with a revised effective date. Your continued access to or use of this Site following the posting of an updated Policy constitutes your acceptance of, and agreement to be bound by, such changes. If you do not agree to the revised Policy, you must discontinue your use of this Site. We encourage you to review this page periodically to remain informed of our current practices.