GTA HOLDINGS BERHAD
 

PRIVACY NOTICE
 

Effective Date: 1 September 2026
 

GTA Holdings Berhad respects the privacy of individuals whose personal data we process.

This Privacy Notice explains how GTA Holdings Berhad [Registration No. 202401026144 (1571993-V)] (“GTA Holdings”, “we”, “us” or “our”) collects, uses, processes, stores and discloses personal data obtained through this website and related interactions.

This Privacy Notice should be read together with our Website Disclaimer & Terms of Use.

GTA Holdings processes personal data in accordance with applicable Malaysian law, including the Personal Data Protection Act 2010 [Act 709], as amended by the Personal Data Protection (Amendment) Act 2024, and applicable regulations, standards and guidelines issued under it. The amended legislation adopts the term data controller for the party controlling the processing of personal data.
 

1. Personal Data We May Collect

Depending on how you interact with GTA Holdings, we may collect personal data including:

Information you provide directly

• name;

• company or organisation;

• job title;

• email address;

• telephone number;

• enquiry category;

• correspondence;

• information contained in enquiry forms;

• feedback;

• investor communication preferences; and

• other information voluntarily provided to us.

Information collected when you use our website

Subject to applicable settings and technologies used on the website, we may also process:

• Internet Protocol (IP) address;

• browser type;

• device type;

• operating system;

• access dates and times;

• pages viewed;

• referring website;

• interaction and navigation data;

• cookies and similar identifiers;

• website security logs; and

• other technical information associated with use of the website.

We encourage users not to submit passwords, classified information, export-controlled information, sensitive technical information or other confidential material through general website enquiry forms.
 

2. Sources of Personal Data

We may obtain personal data:

• directly from you;

• through enquiry, contact or investor forms;

• through correspondence with GTA Holdings;

• when you subscribe to updates;

• through website cookies and analytics technologies;

• from our related companies where appropriate;

• from publicly available information;

• from business partners, advisers or service providers where lawful; or

• where required or permitted by applicable law.
   

3. Purposes for Processing Personal Data

We may process personal data for purposes including:

• responding to enquiries;

• directing enquiries to the appropriate person or company within the Group;

• communicating with investors and stakeholders;

• managing corporate communications;

• managing business or partnership enquiries;

• administering website services;

• managing subscriptions or communications requested by you;

• maintaining corporate and business records;

• verifying or maintaining website security;

• preventing fraud, misuse and cybersecurity incidents;

• analysing website performance and usage;

• improving website functionality and user experience;

• complying with contractual requirements;

• managing legal claims or disputes;

• complying with applicable laws and regulatory requirements;

• responding to lawful requests from government or regulatory authorities; and

• protecting the rights, property and legitimate interests of GTA Holdings and its stakeholders.
   

4. Basis for Processing

Depending on the circumstances, GTA Holdings may process personal data because:

• you have provided consent;

• processing is necessary to respond to a request made by you;

• processing is necessary in connection with a contractual or business relationship;

• processing is required or permitted by applicable law;

• processing is necessary to comply with regulatory or legal obligations; or

• processing is otherwise permitted under applicable Malaysian personal data protection law.

Where consent is relied upon, you may withdraw your consent subject to applicable law and contractual considerations.
 

5. Disclosure of Personal Data

Personal data may be disclosed, where necessary and appropriate, to:

• authorised employees of GTA Holdings;

• subsidiaries and related companies within the GTA Holdings Group;

• website hosting and technology providers;

• information technology and cybersecurity providers;

• cloud service providers;

• professional advisers, including lawyers, auditors and consultants;

• corporate advisers;

• financial institutions;

• share registrars;

• service providers processing information on our behalf;

• regulators, governmental agencies or law-enforcement authorities;

• courts and tribunals;

• parties involved in a corporate transaction, restructuring or reorganisation; or

• any other person where disclosure is authorised or required by law.

We do not sell personal data to third parties.

Where third-party service providers process information on our behalf, GTA Holdings expects such processing to be subject to appropriate confidentiality and data protection requirements.
 

6. Transfer of Personal Data Outside Malaysia

Some technology, cloud, website hosting or other service providers used by GTA Holdings may operate infrastructure outside Malaysia.

Accordingly, personal data may, where necessary, be processed or stored outside Malaysia.

Where such transfers occur, GTA Holdings will take reasonable steps to ensure that transfers and processing are undertaken in accordance with applicable Malaysian personal data protection requirements and appropriate safeguards.

The Personal Data Protection Commissioner has issued specific guidance governing cross-border transfers under the amended framework.
 

7. Cookies and Similar Technologies

This website may use cookies and similar technologies for purposes including:

• essential website functionality;

• website security;

• remembering preferences;

• analytics;

• measuring website performance; and

• improving user experience.

Cookies are small data files stored on or accessed through your device.

Where required, you may manage cookie preferences through the website's cookie controls.

You may also configure your browser to block or remove cookies. However, disabling certain cookies may affect website functionality.

Third-party services embedded into or connected to this website may also use cookies subject to their own privacy policies.
 

8. Data Security

GTA Holdings takes reasonable organisational, technical and administrative measures to protect personal data from:

• loss;

• misuse;

• unauthorised access;

• unauthorised disclosure;

• alteration; and

• destruction.

However, no internet-based transmission or electronic storage system can be guaranteed to be completely secure.

Users should therefore exercise appropriate care when transmitting personal information electronically.

The amended Malaysian data-protection framework also includes specific requirements and guidance concerning personal-data breaches.
 

9. Data Retention

GTA Holdings will retain personal data only for as long as reasonably necessary to:

• fulfil the purposes for which it was collected;

• maintain relevant business records;

• respond to enquiries;

• comply with contractual requirements;

• satisfy regulatory or legal requirements;

• establish, exercise or defend legal claims; or

• meet applicable record-retention obligations.

When personal data is no longer reasonably required, GTA Holdings will take reasonable steps to delete, destroy, anonymise or otherwise appropriately dispose of it in accordance with applicable requirements.
 

10. Your Rights

Subject to the Personal Data Protection Act 2010 and applicable exceptions, you may have rights to:

• request access to personal data held about you;

• request correction of inaccurate or incomplete personal data;

• withdraw consent where processing relies on consent;

• make enquiries regarding the processing of your personal data; and

• exercise other rights available under applicable personal data protection law.

Requests may be subject to verification of identity and any limitations permitted by applicable law.

The Personal Data Protection Commissioner's published privacy-notice guidance specifically addresses informing individuals about the personal data collected, purposes of processing, disclosure and their rights.
 

11. Communications and Marketing

Where you have requested investor updates, corporate communications or other subscription-based information, GTA Holdings may use the contact details you provide to send the requested communications.

You may request to unsubscribe or withdraw from such communications at any time using any unsubscribe mechanism provided or by contacting us.

Administrative, regulatory or transactional communications may still be sent where necessary.
 

12. External Websites

This website may contain links to websites operated by third parties.

GTA Holdings is not responsible for the privacy practices, security or content of those external websites.

You should review the privacy notice or privacy policy of the relevant third party before submitting personal data through an external website.
 

13. Children

This corporate website is not intentionally directed at children.

GTA Holdings does not knowingly seek to collect personal data from children through its general corporate website unless necessary for a legitimate activity and handled in accordance with applicable law.
 

14. Data Protection Officer

Where GTA Holdings is required under applicable Malaysian law to appoint a Data Protection Officer (“DPO”), the appointment and related contact arrangements will be maintained in accordance with applicable requirements.

The Malaysian Personal Data Protection Commissioner has issued formal guidance and circulars concerning DPO appointments.

I recommend leaving it exactly this way until GTA formally determines and documents its DPO position rather than publishing an individual's name prematurely.
 

15. Changes to this Privacy Notice

GTA Holdings may revise this Privacy Notice from time to time to reflect:

• legal or regulatory developments;

• changes to our website;

• changes to business processes;

• changes to technology; or

• changes to our data-processing practices.

The latest version will be published on this webpage together with its effective date.
 

16. Contact Us Regarding Personal Data

Questions, requests or concerns regarding this Privacy Notice or the processing of personal data may be addressed to:

GTA Holdings Berhad
Registration No. 202401026144 (1571993-V)

A-12-11 & A-12-12
Menara The Met
No. 20, Jalan Dutamas 2
50480 Kuala Lumpur
Wilayah Persekutuan, Malaysia
 

Email: info@gtaholdings.com.my
Tel: +603 7859 7966

Individuals may also obtain information about Malaysia's personal-data protection regime from the Personal Data Protection Commissioner Malaysia.