BigPlan Privacy Policy

YES Production is the data controller for personal data processed for BigPlan's own purposes, including account administration, identity, marketplace operation, security, rewards, payments, Campaign administration, analytics, compliance and customer support.

A Merchant may separately act as a data controller for personal data it processes for its own CRM, marketing, customer-service and business purposes.

Where BigPlan processes personal data solely on documented instructions of another data controller, BigPlan may act as a data processor.

BigPlan does not authorise a Merchant to use personal data beyond the permissions and lawful purposes applicable to that Merchant.

Depending on how you use BigPlan, we may process information including:

Account and identity data: name, username, email address, telephone number, date of birth or age confirmation, account identifiers, authentication information and profile image.

Merchant data: business name, registration details, business address, locations, contact details, authorised representatives, staff roles, business category, products or services, subscriptions and account verification information.

Creator data: creator profile, social handles, connected channels, portfolio, content niche, rates, follower or audience metrics, performance information, availability, Campaign records, submissions, ratings and payout information.

KYC and verification data: identity-document information, verification status, age, authority to represent a business, bank or payout verification and related compliance results.

Customer activity data: participating Merchant, outlet, visit or QR interaction, Contribution history, reward qualification, XP, Points, Stamps, Coupons, Wallet activity, redemption history and related timestamps.

Social data: connected account identifiers, public profile information, authorised social account data, public or submitted post URLs, content, status, timestamps and verification results.

Campaign data: proposals, invitations, deliverables, briefs, messages, submissions, revisions, approvals, disputes, appeals, Campaign rights and payment records.

Payment and commercial data: transaction identifiers, prices, fees, subscription status, payment status, settlement status, refund, chargeback, payout and reconciliation information. Full card or payment credentials may be collected directly by a Payment Provider rather than by BigPlan.

Communications: support enquiries, complaints, Merchant-Customer communications made through supported functions, Campaign messages and other communications with BigPlan.

Technical and security data: IP address, device information, browser, operating system, session information, access logs, security events, approximate location where relevant to a feature, cookies and similar identifiers.

Media and AI data: photographs, videos, audio, captions, editing instructions, Edit Plans and generated outputs where you use supported media or AI features.

Consent and legal records: Terms acceptance, Privacy acknowledgement, marketing choices, content permissions, licence selections, suppression/opt-out records and other compliance evidence.

We may obtain personal data directly from you; from a Merchant or authorised business representative; from another user involved in a Campaign; from authorised social-platform APIs; from Payment Providers or KYC providers; from QR and Platform interactions; from publicly accessible social content where used for authorised verification; and from service providers acting on our behalf.

We do not treat the mere public availability of information as permission to use it for every purpose.

Some personal data is mandatory for particular BigPlan features.

For example, we may require account information to create an account, business information to operate a Merchant account, identity and bank verification for Creator payouts, and transaction information to process Campaign payments.

If required information is not provided, BigPlan may be unable to provide the relevant feature or transaction.

Optional information will be identified or apparent from the relevant context.

We may process personal data to:

• create and secure accounts;
• verify identity, age, business authority and social-account ownership;
• operate Merchant, Customer and Creator experiences;
• connect Merchants and Creators;
• create and administer Campaigns;
• verify Contributions and reward eligibility;
• issue and administer XP, Points, Stamps, Coupons and Credits;
• process subscriptions, payments, settlements, payouts, refunds and chargebacks;
• detect fraud, abuse and security threats;
• provide Customer support and resolve disputes;
• enable consented Merchant CRM functionality;
• send transactional communications;
• send marketing where the required permission exists;
• moderate content and enforce Platform rules;
• operate analytics and improve BigPlan;
• provide media and AI functions requested by users;
• maintain audit, accounting and compliance records;
• meet legal, tax, regulatory or law-enforcement obligations; and
• establish, exercise or defend legal rights.

We process personal data with consent where consent is required and otherwise where processing is permitted by applicable Malaysian law.

BigPlan is designed so that Creators do not receive Customer identity or contact information merely because a Customer interacted with a Creator Code or Campaign.

A Merchant may receive Customer data only where the applicable Platform function and recorded permission allow it.

Marketing permission is separate from ordinary use of BigPlan where required.

A Customer may use available controls to opt out of Merchant marketing, withdraw applicable CRM permissions, hide certain social information or request deletion or anonymisation, subject to records BigPlan or the Merchant is legally entitled or required to retain.

If a Merchant exports permitted Customer information from BigPlan, the Merchant is separately responsible for its subsequent use and protection.

Creator profiles may display information intended to help Merchants evaluate potential collaborations.

BigPlan may also generate or display verified performance, ratings, completion history, response information or other reputation signals.

BigPlan may use KYC, bank verification, social-account ownership and fraud checks to determine access to Creator Marketplace functionality.

Sensitive identity or payout information is not intended to be publicly displayed.

Where you connect a social account, BigPlan will request the permissions presented through the applicable OAuth or authorisation process.

BigPlan may use authorised data to verify account ownership, retrieve permitted profile or content information, confirm Campaign performance or Contributions, monitor eligibility or operate the feature for which you connected the account.

You may disconnect a supported social account, although doing so may prevent BigPlan from verifying future Contributions or Campaign obligations.

BigPlan's access remains subject to the policies, API permissions and technical availability of the relevant social platform.

BigPlan may use third-party providers to collect payments, perform business or identity verification, transfer funds, process payouts and administer refunds or chargebacks.

Those providers may collect information directly from you under their own privacy notices and regulatory obligations.

BigPlan will normally receive the information reasonably required to administer the transaction, such as verification status, transaction identifier, payment status, payout status, relevant account identifier or compliance result.

BigPlan does not need to receive or store full payment-card credentials where the Payment Provider handles those credentials directly.

BigPlan may send service communications necessary to operate your account or transactions.

Promotional communications will be sent only where BigPlan has the required permission or another lawful basis.

Where a Customer separately agrees to Merchant marketing, BigPlan may enable the relevant Merchant to communicate within the scope of that permission.

You may withdraw marketing consent or use an unsubscribe mechanism at any time.

Withdrawal from marketing does not prevent BigPlan from sending essential transactional, security, legal or account communications.

BigPlan records content permissions separately from ordinary account consent where appropriate.

Campaign approval does not automatically create paid-advertising or unlimited marketing rights.

Creator and Customer commercial reuse permissions may include restrictions concerning purpose, channel, duration, territory, editing and paid advertising.

BigPlan may retain evidence of a historical permission even after the permission expires, where reasonably necessary to establish what use was previously authorised.

BigPlan may use automated systems to support functions such as eligibility checks, social verification, matching, fraud detection, risk signals, moderation, recommendations and analytics.

Automated outputs may assist BigPlan staff or users but do not automatically override mandatory human review required by law or BigPlan's dispute processes.

Material financial disputes and appeal decisions are not intended to be resolved solely through generative AI.

Where BigPlan's AI media workspace is used, the current product design provides for approximately seven-day retention of source materials, Edit Plans and generated outputs unless longer retention is necessary for a requested function, transaction record, legal requirement or separately disclosed purpose.

BigPlan does not use user media submitted to the AI workspace to train AI models unless separate explicit permission is obtained.

BigPlan may disclose personal data, to the extent reasonably necessary, to:

Merchants, where required to operate a Customer relationship, reward, Campaign or consented CRM function.

Creators, where required to administer a Campaign, but without exposing Customer identity merely for Creator attribution.

Payment, payout and KYC providers, for financial processing and verification.

Social platforms, when you initiate a connection or Platform operation involving that service.

Cloud, hosting, database, storage, email, messaging, security, analytics and technical providers, where they process information for BigPlan.

AI or media-processing providers, where needed to perform a feature you request and subject to applicable safeguards.

Professional advisers, including lawyers, accountants, auditors and insurers where reasonably necessary.

Regulators, courts, law-enforcement bodies or governmental authorities, where disclosure is legally required or reasonably necessary to protect legal rights.

A purchaser, successor, affiliate or restructuring party, where BigPlan or relevant assets are reorganised, financed, sold or transferred, subject to applicable privacy obligations.

We do not sell personal data to advertisers as a standalone data product.

Some BigPlan service providers or infrastructure may process personal data outside Malaysia.

Where personal data is transferred internationally, BigPlan will take steps required under Malaysian data-protection law to ensure that the transfer is permitted and subject to appropriate protection.

We may use contractual protections, provider due diligence, security controls and other permitted transfer mechanisms.

Malaysia now maintains specific guidance for cross-border personal-data transfers under the amended PDPA framework. PDP

BigPlan does not retain every category of personal data indefinitely.

Retention depends on the purpose, transaction, legal requirements, fraud/security needs and contractual obligations.

Account information may generally be kept while the account is active and for an appropriate period afterward.

Campaign, financial, settlement, refund, dispute, audit and tax/accounting evidence may be retained for the period required by law or reasonably necessary to establish legal rights.

Marketplace supplier records may be retained for at least the period required by applicable electronic-trade rules.

Marketing suppression records may be retained to ensure that an opt-out continues to be respected.

Where personal data is no longer required, BigPlan will delete, anonymise or otherwise cease identifiable processing as appropriate.

Account deletion does not require BigPlan to destroy anonymised transaction evidence or records it must lawfully retain.

BigPlan uses technical and organisational measures designed to protect personal data.

These may include role-based access control, tenant isolation, encryption, masking of sensitive fields, server-side handling of tokens and credentials, audit records, access restrictions, monitoring, multi-factor authentication for sensitive operations and provider security controls.

No internet-connected service can guarantee absolute security.

Where a personal-data breach is subject to mandatory notification requirements, BigPlan will make notifications to regulators and affected persons as required by Malaysian law. Malaysia's amended PDPA framework now expressly addresses data-breach notification. PDP

Subject to applicable Malaysian law and relevant exceptions, you may have rights to:

• request access to personal data held about you;
• request correction of inaccurate or incomplete personal data;
• withdraw consent where processing depends on consent;
• prevent or limit direct marketing;
• request account deletion or anonymisation where applicable;
• request information about processing;
• request applicable data portability; and
• complain to BigPlan or the Malaysian Personal Data Protection Commissioner.

Withdrawal of consent does not invalidate processing lawfully performed before withdrawal and may prevent BigPlan from continuing a feature that requires the relevant data.

BigPlan may need to verify your identity before fulfilling a privacy request.

A deletion request initiates BigPlan's applicable deletion and anonymisation process.

BigPlan may remove or anonymise profile, CRM, social and other personal fields while retaining information that must remain for financial, tax, fraud, dispute, compliance or audit purposes.

Connected social tokens will be revoked or deleted where appropriate.

Where another independent data controller, such as a Merchant, already lawfully received personal data, you may also need to exercise your rights directly with that organisation.

BigPlan may use cookies, local storage and similar technology for authentication, security, preferences, session continuity, analytics and Platform performance.

Where optional analytics or marketing technology requires consent, BigPlan will provide the relevant choice.

Disabling essential storage may prevent parts of BigPlan from functioning.

This section forms BigPlan's cookie disclosure; BigPlan does not maintain a separate public Cookie Policy unless later required.

BigPlan accounts and transactional functionality are intended for persons aged 18 or older.

BigPlan does not knowingly permit persons under 18 to enter paid Creator Campaigns, control Merchant accounts or enter other binding transactions through the Platform.

If BigPlan becomes aware that an account was created contrary to this requirement, BigPlan may restrict the account and take appropriate steps regarding the information involved.

A Merchant that receives personal data through BigPlan must process that data lawfully and only for authorised purposes.

The Merchant must maintain appropriate security, respect marketing choices and privacy rights, and not sell, disclose or repurpose Customer information unlawfully.

BigPlan may suspend CRM or export access where a Merchant misuses Customer information.

BigPlan may update this Privacy Policy to reflect changes in functionality, providers, law or processing practices.

The current version and effective date will be published through the Platform.

Where a material change requires notice or consent, BigPlan will provide it.

BigPlan intends to make its Personal Data Protection Notice available in English and Bahasa Malaysia.

Both versions are intended to communicate the same processing practices. Any interpretation will remain subject to mandatory Malaysian law.

Questions, access/correction requests, marketing withdrawals, privacy complaints and other data-protection requests may be sent to:

BigPlan Privacy YES PRODUCTION PERKONGSIAN LIABILITI TERHAD Registration No. 202404002860 (LLP0040363-LGN) No. 2, Jalan Ekoperniagaan 1/19 Taman Ekoperniagaan 81100 Johor Bahru, Johor Malaysia

Email: bigplan.admin@gmail.com

Where BigPlan is required to appoint or register a Data Protection Officer, the applicable DPO contact details may also be published through the Platform.