Privacy Policy – Thaleon

This Privacy Policy applies to:

• Financial advisors, planners, agents, and professionals using the Thaleon platform
• Firms and organisations deploying Thaleon under enterprise or white-label arrangements
• Individuals whose data is entered into Thaleon by advisors or firms ("Clients")
• Visitors to Thaleon websites and applications

Where required by applicable law, country- or region-specific privacy addendums may apply and shall form part of this Privacy Policy.

Data Controller and Data Processor

In most cases, advisors or firms using Thaleon act as the data controller in respect of Client data.

Thaleon acts as a data processor, processing personal data solely on documented instructions from advisors or firms.

Unless expressly stated otherwise, Thaleon does not independently determine the purposes for which Client personal data is processed.

Advisor / User Data:

• Name, email address, and contact details
• Professional information (e.g. firm name, registration or licence details)
• Account credentials (stored securely)
• Platform usage logs and audit records

Client Data (entered by Advisors or Firms):

• Identifiers such as name or reference number
• Demographic information (e.g. age or date of birth)
• Financial objectives, risk profiles, and suitability inputs
• Portfolio holdings, asset allocations, and planning-related information

Technical & Usage Data:

• IP address and device information
• Browser type and operating system
• Access timestamps and system usage analytics

Personal data is processed to:

• Provide, operate, and maintain the Thaleon platform
• Process data and generate analytics, insights, and reports requested by users
• Support governance, auditability, and record-keeping requirements
• Manage authentication, access control, and user accounts
• Respond to enquiries and provide user support
• Improve platform performance, functionality, and reliability
• Protect the security and integrity of the Services

Depending on jurisdiction and context, personal data is processed based on:

• Consent obtained by advisors or firms from their clients
• Performance of contractual obligations
• Compliance with legal or regulatory requirements
• Legitimate interests such as system security, fraud prevention, and service improvement

Advisors and firms using Thaleon are responsible for:

• Obtaining all necessary consents and authorisations from their clients
• Ensuring personal data submitted to Thaleon is accurate, relevant, and lawful
• Complying with applicable professional, regulatory, and data protection obligations

Thaleon relies on advisors and firms to ensure lawful processing of Client data.

Thaleon may use aggregated, anonymised, or de-identified data for:

• Platform improvement and optimisation
• Analytics, benchmarking, and research
• Development and enhancement of features and functionalities

Such data does not identify any individual and is not treated as personal data under applicable laws.

Certain data processed through Thaleon may originate from third-party data providers or integrations enabled by advisors or firms.

Thaleon processes such data in accordance with documented instructions and applicable agreements.

Thaleon does not sell or rent personal data.

Personal data may be disclosed only to:

• Authorised employees and contractors bound by confidentiality obligations
• Trusted third-party service providers supporting hosting, security, analytics, or system operations
• Enterprise or firm administrators, where applicable
• Regulatory or public authorities where required by law

All third parties processing personal data on behalf of Thaleon are required to implement appropriate safeguards.

Thaleon implements appropriate technical and organisational measures to protect personal data, including:

• Encryption of data in transit and at rest (where applicable)
• Role-based access controls
• Secure infrastructure and monitoring systems
• Logging and auditing of system activity

Personal data is retained only for as long as necessary to:

• Fulfil the purposes outlined in this Privacy Policy
• Comply with contractual, legal, regulatory, or audit obligations

Data may be anonymised or securely deleted when no longer required.

Personal data may be transferred to, stored in, or processed in jurisdictions outside the user’s country.

Where cross-border transfers occur, Thaleon implements appropriate safeguards in accordance with applicable data protection laws.

Subject to applicable laws, individuals may have the right to:

• Request access to their personal data
• Request correction or updating of inaccurate data
• Withdraw consent where processing is based on consent
• Request restriction or deletion of personal data

Requests may be subject to verification and legal limitations.

Thaleon may use cookies or similar technologies to:

• Enable and support platform functionality
• Analyse usage trends
• Improve user experience

Users may manage cookie preferences through their browser settings.

This Privacy Policy may be updated from time to time.

Material changes will be communicated through the platform or website.

Continued use of the Services constitutes acceptance of the updated Privacy Policy.

Data Protection Officer / Privacy Contact

Address: Suite 13A-2, Level 13A, Menara TCM. Kuala Lumpur City, Federal Territory of Kuala Lumpur, MY.