Privacy Notice

This Privacy Notice is issued under the Malaysian Personal Data Protection Act 2010 ("PDPA"). The data user is FANTAGON HOLDINGS SDN. BHD. (Company No. 202201006650) of No. 50-01, 50-02, Jalan Perjiranan 4/5, Bandar Dato Onn, 81100 Johor Bahru, Johor, Malaysia ("Fantagon", "we", "us" or "our"). It explains what personal data we collect about you, why we process it, who we share it with, how long we keep it, and the rights you have over it.

This Notice applies to registered distributors, to customers who purchase Fantagon products, and to visitors of this website, including visitors who scan a Fantagon NFC plaque. By registering an account, placing an order or continuing to use this website, you confirm that you have read this Notice and consent to the processing described in it.

1. Personal Data We Collect

Depending on how you interact with us, we may process:

• Identity data — your full name, nationality, NRIC or passport number and its expiry date, date of birth and gender.
• Contact data — mobile number, email address, correspondence address and delivery address.
• Financial data — bank name, bank account number and account holder name, used to pay bonuses and process withdrawals.
• Transaction data — orders, payment proofs, wallet and bonus records, withdrawal records and tax withholding records.
• Business network data — your sponsor, your placement position in the binary tree, your rank, and your personal and group sales volume.
• Technical data — login records, IP address, device and browser information, and cookies that are necessary for the website to work.
• Voluntary data — the date and time of birth you enter for a five-element energy assessment, the text of a wish inscription, and any profile photograph you upload.

We do not deliberately collect sensitive personal data as defined in the PDPA — such as data on your health, religious beliefs or political opinions — and you should not submit such data to us through free-text fields.

2. How We Collect Personal Data

• Directly from you, when you register, activate your account, place an order, upload a payment proof, request a withdrawal, update your profile or contact our support team.
• From your sponsor, where your registration is completed on your behalf. We will ask you to confirm and correct those details during account activation, and we record who completed the registration on your behalf.
• Automatically, when you use the website — through cookies, server logs and security records.
• From third parties who act for us, such as payment and logistics providers who confirm a payment or a delivery.

3. Why We Process Your Personal Data

• To create and administer your account, verify your identity and prevent duplicate or impersonated registrations.
• To process orders, payments and delivery, and to calculate and pay bonuses under the published compensation plan.
• To operate your wallets and process withdrawal requests.
• To comply with our legal obligations, including withholding under Section 107D of the Income Tax Act 1967, CP58 reporting, e-invoice submission, and record-keeping required of a licensed direct selling company.
• To maintain the security of the platform, audit money movements, investigate breaches of our rules and prevent fraud.
• To respond to your enquiries, complaints and requests for support.
• To send you product, event and compensation plan announcements, where you have not objected to receiving them.

Identity, contact, financial and transaction data are obligatory. If you do not provide them we cannot complete your registration, pay bonuses to you or process a withdrawal. The birth details you enter for a five-element assessment are voluntary and are used only to generate your assessment result and the related content shown to you.

4. Who We Disclose Your Personal Data To

We do not sell your personal data. We may disclose it to the following classes of third parties, and only to the extent necessary for the purposes described above:

• Payment gateways, banks and logistics providers, to collect payment, pay bonuses and deliver your order.
• Cloud hosting, database, email delivery and analytics providers that operate the platform on our behalf under contractual confidentiality and security obligations.
• Professional advisers, including accountants, auditors and lawyers.
• Government bodies and regulators entitled to the data by law, including the Inland Revenue Board (LHDN) and the Ministry of Domestic Trade and Cost of Living (KPDN).
• Your sponsor and upline, but limited to what is needed to manage the organisation — such as your member code, display name, rank, activity status and group volume. We do not disclose your NRIC or passport number, bank account details or contact details to your upline.
• A purchaser or successor entity, in the event of a reorganisation, merger or sale of the business, subject to the same protections set out in this Notice.

5. International Transfers

Our hosting, database and email services may be located outside Malaysia. Where personal data is transferred outside Malaysia, we take reasonable steps to ensure that the recipient is bound to a standard of protection comparable to that required by the PDPA, including through contractual data protection terms.

6. Cookies and Similar Technologies

We use cookies that are strictly necessary to keep you signed in, to remember your preferences and to protect the platform against fraudulent access, together with aggregated, non-identifying traffic analytics. You can block cookies through your browser settings, but the sign-in and checkout functions will not work if you do. We do not currently respond to browser "Do Not Track" signals.

7. Payment Processing

Card and online banking payments are handled by third-party payment processors. We do not receive or store your full card number or online banking credentials. Where you pay by bank transfer and upload a payment proof, that image is stored by us and reviewed by an authorised administrator solely to verify your payment.

8. How We Protect Your Personal Data

We apply reasonable technical and organisational measures, including encryption of data in transit (TLS), hashed password storage, row-level access control in the database, restricted and audited administrator access, an audit log of every money-related operation, and daily encrypted backups. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. How Long We Keep Your Personal Data

We keep your personal data for as long as your relationship with us continues. After your account is closed, transaction, bonus and tax records are retained for as long as Malaysian law requires — generally seven years — after which they are deleted or anonymised. Records that are needed to evidence a historic settlement or to defend a legal claim may be retained for the duration of that claim.

10. Your Rights Under the PDPA

• Right of access — to ask for a copy of the personal data we hold about you.
• Right of correction — to ask us to correct data that is inaccurate, incomplete, misleading or out of date.
• Right to withdraw consent — to withdraw your consent to any processing, in whole or in part.
• Right to limit processing — to ask us to stop processing your data for a specified purpose, including direct marketing, which you may stop at any time and free of charge.

To exercise any of these rights, write to us at support@fantagon.app. We will respond within 21 days of receiving your request. A prescribed fee may apply to a data access request, as permitted by the PDPA. Please note that if you withdraw your consent to the processing that is necessary to run your account, we may no longer be able to maintain your distributorship, pay bonuses to you or process withdrawals.

11. Children

This website and the Fantagon business opportunity are not directed at children. You must be at least 18 years of age to register. If we become aware that we hold personal data of a person under 18 who has registered without lawful authority, we will delete that data and close the account.

12. Third-Party Websites

This website may link to sites we do not operate. We are not responsible for the content or privacy practices of those sites, and we encourage you to read their privacy notices before providing personal data to them.

13. Changes to This Notice

We may update this Notice from time to time. The current version is always published on this page, and material changes will be notified to registered members. Please review it periodically.

14. How to Contact Us

For any question about this Notice or about how we handle your personal data, contact us at support@fantagon.app, or write to FANTAGON HOLDINGS SDN. BHD. (Company No. 202201006650), No. 50-01, 50-02, Jalan Perjiranan 4/5, Bandar Dato Onn, 81100 Johor Bahru, Johor, Malaysia. You also have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia.

This Notice is published in English. If we publish a translation, the English version prevails in the event of any inconsistency.