Privacy Notice

This notice describes how POKAPOKA INTERNATIONAL GROUP SDN. BHD. (SSM 202301022313 (1516236-A); business address: 116-M, Jalan Mega Mendung, Bt5 Jalan Klang Lama, 58200 Kuala Lumpur, Malaysia; email: info@pokapokagroup.com; phone: available on request via info@pokapokagroup.com) (“we”) processes personal data for wallet-access recovery inquiries under Malaysia PDPA principles.

1. What we collect

• Contact: name/handle, email, preferred language
• Case meta: wallet type, symptom, approximate amount range
• Messages you send in the inquiry form or chat widget (after secret-guard filtering)

We never collect or store: seed phrases / mnemonics, private keys (hex, WIF, xprv/yprv/zprv), or wallet passwords / PINs. Client-side and server-side guards reject such patterns.

2. Purposes

Triage feasibility; communicate with you; coordinate with a partner technical team in Singapore; invoice a success fee in fiat if recovery succeeds.

3. Cross-border transfers (PDPA s.129)

With your separate consent, we may transfer contact and case meta (not seeds/keys) to:

• (a) Partner technical team in Singapore — for diagnosis / recovery work only. Country name only; we do not disclose a partner company name on this page.
• (b) Telegram (and optionally Slack) — for technician replies and intake. Chat message bodies you send are forwarded via Telegram (servers outside Malaysia) so a technician can reply. Name, email and phone are stripped automatically; seed phrases / private-key-like strings are blocked before send. Form ticket summaries (when used) include only: ticket ID, language, wallet type, symptom, amount range.
• Cloudflare Workers may process requests as part of delivery infrastructure.

Legal basis design: consent under s.129(3)(a) and/or contractual necessity. Group membership limited to named technicians approved by management.

4. Retention

Non-converted inquiries and chat logs: deleted within 90 days of last contact, including from our systems and the Telegram group thread for that ticket. ID / ownership verification documents: deleted within 30 days after work ends. Wallet technical data: deleted immediately at work end; our partner does the same. Contracts, invoices and accounting records: kept for 7 years under Malaysian law (e.g. Income Tax Act 1967 record-keeping), or longer where required by law.

5. Security

HTTPS; HMAC on intake; server-side secret rejection; closed Telegram group; least privilege; no screenshots of tickets shared outside the group. Processors (including overseas partners) remain subject to security obligations under PDPA as amended (Act A1727).

6. Your rights

Access, correction, and withdrawal of consent as applicable under PDPA. Complaints may be made to the Personal Data Protection Department (JPDP). Contact via info@pokapokagroup.com or the inquiry form.

7. Data Protection Officer (DPO)

DPO appointment and notice to the Commissioner under Act A1727 s.12A: Available on request via info@pokapokagroup.com.

8. Breach notification

We will follow PDPA s.12B and JPDP Data Breach Notification guidance (as amended), including notice to the Commissioner as soon as practicable and typically within the guideline timeframe.