Privacy Policy

Bidshido ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our online auction platform ("Platform"). By using the Platform, you consent to the data practices described in this policy. This policy is in compliance with the Personal Data Protection Act 2010 (PDPA) of Malaysia.

We collect information you provide directly to us, including: • Account information: name, email address, phone number, date of birth, nationality • Identity verification (KYC): government-issued ID, selfie photo, proof of address • Financial information: bank account details for seller payouts • Profile information: profile photo, preferences • Communications: messages you send to us or other users through the Platform We also collect information automatically when you use the Platform: • Usage data: pages visited, features used, time spent, clicks • Device information: IP address, browser type, operating system, device identifiers • Cookies and similar tracking technologies (see Section 6)

We use the information we collect to: • Create and manage your account • Process transactions and send related information (receipts, confirmations) • Verify your identity and prevent fraud • Facilitate auctions, bids, and payments • Send transactional and promotional communications (you may opt out of promotional emails at any time) • Monitor and analyse usage patterns to improve the Platform • Comply with legal obligations under Malaysian law • Respond to your comments, questions, and requests • Enforce our Terms of Service and other policies

We do not sell your personal data. We may share your information with: • Other users: Limited profile information is visible to other users as necessary for auction transactions (e.g. seller name, buyer username) • Payment processors: Billplz, our payment gateway, receives payment information necessary to process transactions • Service providers: Third-party vendors who assist us in operating the Platform (hosting, analytics, email delivery) under strict confidentiality agreements • Law enforcement: When required by law, court order, or governmental authority • Business transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction We require all third parties to respect the security of your personal data and process it only for specified purposes.

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include: • Encryption of data in transit (HTTPS/TLS) • Secure storage of sensitive documents (KYC files) • Access controls limiting employee access to personal data • Regular security assessments However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data. We will notify you and relevant authorities of any data breach in accordance with Malaysian PDPA requirements.

We use cookies and similar tracking technologies to: • Keep you signed in to your account • Remember your preferences • Understand how you use the Platform (analytics) • Improve Platform performance You can control cookie settings through your browser. Disabling certain cookies may affect Platform functionality. We use the following types of cookies: • Essential cookies: Required for the Platform to function • Analytics cookies: Help us understand usage patterns (e.g. Firebase Analytics) • Preference cookies: Remember your settings and preferences

Under the Personal Data Protection Act 2010 (PDPA) and applicable law, you have the right to: • Access your personal data held by us • Correct inaccurate or incomplete personal data • Request deletion of your personal data (subject to legal obligations) • Withdraw consent to processing of your personal data • Request restriction of processing in certain circumstances • Object to processing for direct marketing purposes To exercise any of these rights, please contact us at privacy@bidshido.com. We will respond to your request within 21 days. Note: We may need to verify your identity before processing certain requests.

We retain your personal data for as long as your account is active or as needed to provide you services. We may retain certain information after account closure for legitimate business or legal purposes, including: • Transaction records: 7 years (Malaysian tax and commercial law requirements) • KYC documents: 5 years after account closure (anti-money laundering regulations) • Communication logs: 2 years You may request deletion of your account and associated data by contacting us, subject to our legal retention obligations.

Bidshido is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child without parental consent, we will take steps to delete that information promptly. If you believe we have inadvertently collected information from a minor, please contact us immediately.

We may update this Privacy Policy from time to time. We will notify you of significant changes by: • Posting the updated policy on the Platform with a revised "Last updated" date • Sending an email notification to your registered email address Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.

For questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact our Data Protection Officer: Email: privacy@bidshido.com Website: https://bidshido.com Last updated: March 2025