1. Introduction

Railway Assets Corporation (“RAC”, “we”, “our”, or “us”) is committed to protecting and respecting your personal data in accordance with applicable data protection and financial regulatory requirements, including the Personal Data Protection Act 2010 (PDPA) of Malaysia, the General Data Protection Regulation (GDPR) where applicable, and regulatory expectations issued by Bank Negara Malaysia.

This Privacy Policy explains how we collect, use, disclose, store, and protect personal data in relation to our services, systems, platforms (including RAILS 2.0), and payment processing activities.

2. Scope of Application

This Policy applies to:

• Customers (tenants, users, payers)

• Employees and contractors

• Vendors and partners

• Users of RAC systems including RAILS 2.0 and integrated platforms (e.g., ESPI, payment gateways)

3. Definition of Personal Data

“Personal Data” means any information that relates directly or indirectly to an identifiable individual, including but not limited to:

• Name, NRIC/Passport number

• Contact information (phone, email, address)

• Financial and payment data

• Account credentials and identifiers

• Transaction history and service usage

• Device and system access data (IP address, logs)

4. Principles of Data Processing

RAC processes personal data based on the following principles:

4.1 Lawfulness, Fairness and Transparency

Data is processed lawfully and transparently.

4.2 Purpose Limitation

Collected only for specific, legitimate purposes such as:

• Customer onboarding (RAILS 2.0)

• Payment processing and reconciliation

• Regulatory compliance

• Service delivery and support

4.3 Data Minimisation

Only necessary data is collected.

4.4 Accuracy

Data is kept accurate and up to date.

4.5 Storage Limitation

Data is retained only as long as necessary.

4.6 Integrity and Confidentiality

Appropriate security controls are implemented.

5. Legal Basis for Processing

Personal data is processed under one or more of the following bases:

• Consent of the data subject

• Performance of contract (e.g., tenancy, payment services)

• Legal and regulatory obligations (e.g., Bank Negara Malaysia requirements)

• Legitimate interests (e.g., fraud prevention, system security)

6. Collection of Personal Data

Personal data may be collected through:

• RAILS 2.0 system onboarding

• Payment transactions (online payment gateways)

• Customer service interactions

• Integration with third-party systems (e.g., ESPI)

• Website and mobile applications

• Regulatory or compliance submissions

7. Use of Personal Data

Personal data is used for:

• Customer onboarding and account management

• Processing deposits and advance payments

• Integration updates to ESPI system

• Billing, invoicing, and reconciliation

• Identity verification and fraud detection

• Compliance with regulatory obligations

• System performance monitoring and analytics

8. Disclosure of Personal Data

Personal data may be disclosed to:

• Regulatory authorities and government agencies

• Financial institutions and payment gateway providers

• Technology partners and system integrators

• Auditors and legal advisors

• Service providers under strict confidentiality agreements

All disclosures comply with PDPA and applicable financial regulations.

9. Cross-Border Data Transfer

Where personal data is transferred outside Malaysia:

• Adequate protection measures will be ensured

• Transfers comply with PDPA and GDPR safeguards

• Standard contractual clauses or equivalent protections are implemented

10. Data Security Measures

RAC implements robust technical and organisational measures, including:

• Encryption (data in transit and at rest)

• Secure API integrations (RAILS 2.0 ↔ ESPI)

• Access control and role-based permissions

• Network security and firewall protection

• Audit logs and monitoring

• Secure hosting environments (cloud/on-premise)

Aligned with expectations under Bank Negara Malaysia’s Risk Management in Technology (RMiT).

11. Payment Data Protection

For payment-related data:

• RAC does not store full card details where possible

• Payment processing is handled by PCI-DSS compliant payment gateways

• Tokenisation and secure authentication mechanisms are used

• Fraud detection and transaction monitoring are implemented

12. Data Retention Policy

Personal data is retained based on:

• Legal and regulatory requirements

• Contractual obligations

• Business and operational needs

Upon expiry, data is securely deleted or anonymised.

13. Rights of Data Subjects

Subject to applicable laws, individuals have the right to:

• Access their personal data

• Request correction of inaccurate data

• Withdraw consent (where applicable)

• Request data portability (GDPR)

• Request restriction or deletion (where legally permissible)

• Object to processing for certain purposes

Requests may be submitted to RAC via official channels.

14. Cookies and Tracking Technologies

RAC systems may use cookies and similar technologies to:

• Improve user experience

• Analyse system usage

• Enhance security

Users may manage cookie preferences through browser settings.

15. Third-Party Links and Systems

RAC systems may integrate with or link to third-party systems (e.g., ESPI, payment gateways). RAC is not responsible for the privacy practices of such third parties, and users are advised to review their respective policies.

16. Data Breach Management

In the event of a data breach:

• Immediate containment and investigation will be conducted

• Affected parties and regulators will be notified as required

• Remedial actions will be implemented promptly

17. Updates to This Policy

This Privacy Policy may be updated periodically to reflect:

• Regulatory changes

• System enhancements

• Business requirements

Latest version will be made available through RAC official channels.

18. Contact Information

For any inquiries or requests regarding personal data:

Railway Assets Corporation (RAC)

Data Protection Officer (DPO)

29-1, Sentral RAC

No. 16, Jalan Tun Sambanthan

Brickfields, 50470 Kuala Lumpur

📞 +603-7459 0200

📧 info@rac.gov.my

19. Acceptance

By using RAC services and systems (including RAILS 2.0), you acknowledge that you have read and understood this Privacy Policy and agree to the processing of your personal data as described herein.

1. Introduction

This Refund Policy outlines the terms governing refunds for payments made through Railway Assets Corporation (“RAC”, “we”, “our”, or “us”), including via the RAC website and RAILS 2.0 system.

This Policy is aligned with applicable Malaysian laws, regulatory expectations, and secure payment practices.

2. Scope of Application

This Policy applies to all payments made to RAC, including but not limited to:

• Security deposits

• Advance payments

• Rental payments

• Service-related fees

• Any other charges processed through RAC systems

3. General Refund Principles

Refunds shall be governed by the following principles:

• Refunds are not automatic and are subject to review and approval by RAC

• Refunds are processed only for valid and justifiable reasons

• RAC reserves the right to accept or reject any refund request

• All refunds must comply with applicable contractual terms, tenancy agreements, and regulatory requirements

4. Eligible Refund Scenarios

Refunds may be considered under the following circumstances:

4.1 Overpayment or Duplicate Payment

Where a user has made an excess or duplicate payment.

4.2 Erroneous Transaction

Where payment was made due to system error, technical failure, or incorrect billing.

4.3 Service Not Rendered

Where payment was made but the corresponding service was not delivered.

4.4 Termination or Cancellation

Where tenancy, service, or agreement is terminated subject to contractual terms.

4.5 Regulatory or Legal Requirement

Where refund is required by law or directive from authorities.

5. Non-Refundable Items

The following are generally non-refundable unless otherwise approved:

• Processing or transaction fees charged by payment gateways

• Services already rendered or utilised

• Late payment penalties or administrative charges

• Any fees expressly stated as non-refundable in agreements

6. Refund Request Procedure

To request a refund, users must:

1. Submit a formal request via:

       - RAC customer portal (RAILS 2.0), or

       - Official email to RAC

2. Provide supporting details:

       - Full name and identification

       - Transaction reference number

       - Payment date and amount

       - Reason for refund request

       - Supporting documents (if applicable)

RAC may request additional information for verification.

7. Review and Approval Process

• All refund requests will undergo verification and validation

• RAC reserves the right to:

       - Investigate transaction history

       - Verify against system records (RAILS 2.0, ESPI, payment gateway logs)

• Decision outcomes:

       - Approved

       - Partially approved

       - Rejected

RAC’s decision shall be final unless otherwise required by law.

8. Refund Processing Timeline

• Standard processing time: 14 to 30 working days from approval

• Actual crediting time depends on:

       - Payment method

       - Banking institution

       - Payment gateway provider

RAC shall not be liable for delays caused by third-party financial institutions.

9. Refund Method

Refunds will be processed via the original payment method, where possible:

• Credit/Debit Card → refunded to the same card

• Online Banking → refunded to originating bank account

• Other methods → alternative method as determined by RAC

Cash refunds are generally not permitted unless required by law.

10. Payment Gateway and Financial Compliance

All refund processes comply with:

• Secure payment practices and industry standards (e.g., PCI-DSS)

• Requirements and guidelines issued by Bank Negara Malaysia

• Payment gateway provider policies and procedures

11. Fraud Prevention and Risk Control

RAC reserves the right to:

• Reject refund requests suspected of fraud or abuse

• Conduct additional verification checks

• Suspend accounts pending investigation

Any fraudulent activity may be reported to relevant authorities.

12. Data Protection

All personal data collected for refund processing shall be handled in accordance with:

• Personal Data Protection Act 2010

• Applicable international standards (e.g., GDPR where relevant)

13. Limitation of Liability

RAC shall not be liable for:

• Losses arising from incorrect information provided by users

• Delays caused by banks or payment gateways

• Indirect or consequential losses related to refund processing

14. Amendments

RAC reserves the right to amend this Refund Policy at any time.

Updates will be published on RAC’s official platforms and shall take effect immediately.

15. Contact Information

For refund-related inquiries:

Railway Assets Corporation (RAC)

29-1, Sentral RAC

No. 16, Jalan Tun Sambanthan

Brickfields, 50470 Kuala Lumpur

📞 +603-7459 0200

📧 info@rac.gov.my

16. Acceptance

By making payment through RAC systems (including RAILS 2.0), you acknowledge that you have read, understood, and agreed to this Refund Policy.