CatchACard Privacy Policy

Last updated: 20 October 2026

Personal Data Protection Notice

This Privacy Policy explains how NextRare Asia Sdn. Bhd. (Company Registration No. 1692573-D) ("CatchACard", "we", "us" or "our") collects, uses, discloses and protects your personal data when you use the CatchACard website at catcha.cards, the CatchACard mobile applications and related services (the "Services").

This notice is issued under the Personal Data Protection Act 2010 of Malaysia, as amended (the "PDPA"). We are the data controller of the personal data processed through the Services.

This Privacy Policy is available in English and Bahasa Malaysia. If there is any inconsistency between the two versions, the English version prevails.

By registering an Account, using the Services or providing your personal data to us, you consent to us processing your personal data as described in this Privacy Policy.

1. Personal Data We Collect

Account data: Name, display name, email address, phone number, date of birth, password (stored in encrypted form), social sign-in identifiers (e.g. Google, Apple) and the profile details you allow those providers to share, referral code used
Identity verification data: Full name, NRIC or passport number, nationality, date of birth, images of identity documents, selfie or liveness-check images
Transaction data: Diamond purchases and balances, Packs opened, Cards drawn, your Collection, buybacks, shipments, promotions and rewards used
Payment data: Payment method type, last four digits of your card, and transaction references. Full card details are handled by our payment providers, not stored by us
Delivery data: Recipient name, delivery address, contact number, shipment history, and evidence submitted for delivery claims
Communications: Messages to customer support, feedback, survey responses
Technical and usage data: IP address, device identifiers, device model, operating system, browser type, app version, language settings, approximate location derived from IP address, pages and features used, session activity, crash logs
Preferences: Marketing preferences, responsible play settings (such as spending limits or self-exclusion), public feed opt-outs

Sensitive personal data. If we use facial images to verify your identity (for example, matching a selfie to your ID document), this may involve biometric data, which is treated as sensitive personal data under the PDPA. We will only process it with your explicit consent and only for verification and fraud prevention.

2. How We Collect It

We collect personal data:

directly from you, when you register, complete verification, buy Diamonds, open Packs, request deliveries, contact us, or take part in promotions;
automatically, when you use the Services, through cookies, SDKs and similar technologies (see Section 11); and
from third parties, such as social sign-in providers, payment providers, identity verification and fraud prevention services, shipping carriers, users who refer you, and analytics or advertising partners.

3. Why We Use It

We process your personal data to:

(a) create and manage your Account;
(b) verify your age and identity and confirm that you are eligible to use the Services;
(c) process Diamond purchases, open Packs, allocate Cards, and manage your Collection and Diamond balance;
(d) process buybacks and refunds;
(e) store, ship and deliver Cards, and handle delivery claims;
(f) provide customer support and respond to your enquiries;
(g) send service messages, such as transaction confirmations, security alerts and changes to our Terms;
(h) run promotions, referral programmes, leaderboards and public pull feeds;
(i) detect, prevent and investigate fraud, abuse, money laundering and security incidents;
(j) provide responsible play features;
(k) analyse how the Services are used so we can improve them and develop new features;
(l) send you marketing about CatchACard, where you have agreed to receive it, and measure how effective it is;
(m) comply with legal and regulatory obligations, respond to lawful requests from authorities, and establish, exercise or defend legal claims; and
(n) any other purpose we tell you about when we collect your data, with your consent where required.

4. Is Providing Your Data Obligatory?

Information marked as required on our forms, and identity verification information when we request it, is obligatory. If you do not provide it, we may be unable to open or maintain your Account, process payments or refunds, or deliver Cards to you.

All other information, including marketing preferences, is voluntary.

5. Who We Disclose It To

We may disclose your personal data to:

service providers who act on our behalf, including cloud hosting, payment processors and banks, identity verification and fraud prevention providers, shipping carriers and logistics partners, customer support tools, email and messaging providers, and analytics and advertising partners;
our related companies, for the purposes set out in this Privacy Policy;
professional advisers, such as lawyers, auditors and insurers;
government bodies, regulators, law enforcement and courts, where required or permitted by law;
a buyer or successor in connection with a merger, acquisition, restructuring or sale of all or part of our business;
other users and the public, limited to your display name, avatar and notable pulls shown in public feeds or leaderboards unless you opt out in your settings; and
anyone else, with your consent.

We require our service providers to protect your personal data and to use it only for the purposes we specify. We do not sell your personal data.

6. Transfers Outside Malaysia

Some of our service providers store or process data outside Malaysia, for example in Singapore or the United States. We only transfer personal data outside Malaysia where the PDPA permits it, for example where the destination has a law substantially similar to the PDPA or ensures an adequate level of protection, or where the transfer is necessary to perform our contract with you or you have consented. We take reasonable steps to make sure your data remains protected when transferred.

7. How Long We Keep It

We keep personal data only for as long as it is needed for the purposes in this Privacy Policy, or for longer where the law requires or permits it. For example, we keep transaction records needed for tax and accounting purposes for seven (7) years. When personal data is no longer needed, we delete it or anonymise it so that it no longer identifies you.

8. How We Protect It

We use administrative, technical and physical safeguards to protect personal data, including encryption in transit, access controls and restricting access to staff and providers who need it. No system is completely secure, so please use a strong, unique password and keep your login details confidential.

If a personal data breach occurs, we will notify the Personal Data Protection Commissioner and, where the breach is likely to cause you significant harm, notify you, as required by the PDPA.

9. Your Rights

Subject to the PDPA, you have the right to:

access the personal data we hold about you;
correct personal data that is inaccurate, incomplete, misleading or out of date;
withdraw your consent to our processing of your personal data (this may mean we can no longer provide some or all of the Services to you);
limit processing, including asking us to stop using your data for direct marketing;
object to processing that is likely to cause you substantial damage or distress; and
data portability, meaning you can ask us to transmit your personal data to another data controller, where technically feasible and permitted by law.

To exercise any of these rights, contact our Data Protection Officer using the details in Section 15. We may need to verify your identity before acting on your request, and may charge a fee for access requests where the law allows. We will respond within the timeframes set by the PDPA, generally within 21 days.

If you are not satisfied with how we handle your request or complaint, you may contact the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi).

10. Marketing

We will only send you marketing messages if you have agreed to receive them. You can opt out at any time by using the unsubscribe link in any message, changing your Account settings, or contacting us. We will still send you service messages about your Account and transactions.

11. Cookies and Similar Technologies

We and our partners use cookies, SDKs, pixels and similar technologies on the Services. These fall into the following groups:

Strictly necessary: needed for the Services to work, such as keeping you logged in and securing transactions.
Functional: remember your preferences, such as language settings.
Analytics: help us understand how the Services are used so we can improve them, e.g. Google Analytics, PostHog, Mixpanel.
Advertising: help us measure and show relevant ads for CatchACard on other platforms, e.g. Meta Pixel, TikTok Pixel.

Apart from strictly necessary cookies, we will ask for your consent before setting these. You can change your choices at any time through our cookie settings and your browser or device settings. Blocking some cookies may affect how the Services work.

12. Children

The Services are only for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will close the Account and delete the data, except where we must keep it by law.

13. Third-Party Links and Services

The Services may link to third-party websites and services, such as payment providers, carriers and social media platforms. We are not responsible for their privacy practices, and we encourage you to read their privacy policies.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will let you know by email or in-app notice before they take effect. The "Last updated" date at the top shows when it was last revised.

15. Contact Us

For questions, requests or complaints about this Privacy Policy or your personal data, please contact our Data Protection Officer:

Data Protection Officer: NextRare Asia Sdn. Bhd. (Company Registration No. 1692573-D)
Address: Level 8&9, Menara UAC, Jalan PJU 7/5, Mutiara Damansara, 47800, Petaling Jaya, Selangor, Malaysia
Email: [email protected]
Phone: 016-495 6927