Identify and record
suspected incident signals.
FINDER & PARTNERS — COMPLIANCE
Compliance is not a statement at the bottom of the page. It is a boundary around how we operate.
Finder & Partners structures its operations around the protection of personal data, accountable conduct and zero tolerance for bribery and corruption.
These commitments influence how information is handled, how authority is exercised and how concerns are escalated.
PERSONAL DATA · ACCOUNTABILITY · INTEGRITY · REPORTING
Our compliance framework brings together two important responsibilities: protecting personal data in accordance with Malaysia's Personal Data Protection Act 2010 and maintaining appropriate anti-bribery and anti-corruption controls under the Malaysian Anti-Corruption Commission Act 2009.
GOVERNANCE ARCHITECTURE
PERSONAL DATA
PDPA 2010
Controlled Information
INTEGRITY & CONDUCT
MACC ACT 2009 (SEC 17A)
Controlled Conduct
FINDER & PARTNERS
GOVERNED OPERATIONS
Common Institutional Boundary
REGIME 01 / STATUTORY FRAMEWORK
PDPA COMPLIANCE — PERSONAL DATA PROTECTION ACT 2010
CONTROLLED INFORMATION
01 — OUR ROLE IN HANDLING PERSONAL DATA
Personal data is handled within a defined purpose.
In carrying out appointed recovery activities, Finder & Partners processes personal data within the scope of the applicable client appointment and account mandate.
Appointing organisations determine the underlying purpose for which account information is provided for recovery activity. Finder & Partners uses that information only for authorised operational purposes connected with the appointment and subject to applicable contractual and legal requirements.
Depending on the particular processing activity and applicable law, the respective data-protection responsibilities of Finder & Partners and the appointing client are governed by the appointment, applicable contractual arrangements and the Personal Data Protection Act 2010.
Account information used for appointed recovery activity is principally provided by the appointing client or generated through authorised interactions connected with that appointment.
Information voluntarily provided through UnitKredit or Naya for enquiries is handled according to the purpose for which it was submitted.
APPOINTED RECOVERY STREAM
APPOINTING CLIENT
↓
DEFINED PURPOSE / MANDATE
↓
FINDER & PARTNERS
↓
AUTHORISED RECOVERY ACTIVITY
VOLUNTARY PUBLIC ENQUIRY STREAM
UNITKREDIT / NAYA ENQUIRY
↓
VOLUNTARILY PROVIDED INFORMATION
↓
ENQUIRY PURPOSE ONLY
DATA PURPOSE DOES NOT AUTOMATICALLY EXPAND
02 — INFORMATION WE MAY HANDLE
Only information relevant to the authorised purpose.
01
IDENTITY INFORMATION
Name and other identifiers necessary to distinguish the relevant account holder.
02
CONTACT INFORMATION
Authorised contact details such as address, telephone number or email address where supplied for the recovery purpose.
03
ACCOUNT INFORMATION
Relevant account identifiers, outstanding-account information, account status and other information necessary to understand the appointed matter.
04
COMMUNICATION RECORDS
Records of authorised notices, interactions, responses, disputes and relevant engagement outcomes.
05
RESOLUTION INFORMATION
Information concerning commitments, arrangements or settlement discussions conducted within client-authorised parameters.
06
CLIENT-PROVIDED PAYMENT STATUS
Where relevant, information supplied or confirmed through the appointing client's authorised systems concerning payment status or payment references.
Payment Safety Boundary
Finder & Partners does not receive, collect, hold or process customer payments. Payments must be made directly through the authorised channels of the appointing client.
SENSITIVE / VULNERABILITY INFORMATION · NOT ORDINARILY REQUESTED
Finder & Partners does not ordinarily request sensitive personal data for standard recovery activity. Where sensitive or vulnerability-related information is lawfully received and relevant to an authorised matter, it must be handled according to applicable legal requirements and appropriate access controls.
03 — WHY INFORMATION MAY BE USED
Purpose comes before processing.
Personal data connected with an appointed recovery matter may be used only for purposes relevant to the appointment and applicable legal requirements.
INPUT INFORMATION
→
AUTHORISED PURPOSE CHECK
→
APPOINTED RECOVERY ACTIVITY
AUTHORISED OPERATIONAL PURPOSES
identifying the correct account holder
communicating about an appointed account
providing accurate account information supplied or authorised by the appointing client
recording relevant interactions, disputes and commitments
supporting authorised resolution discussions
reporting recovery activity and outcomes to the appointing client
maintaining appropriate operational and audit records
meeting applicable legal or regulatory requirements
Personal data provided for an appointed recovery purpose is not repurposed for unrelated marketing.
Any analytical or operational use of account information must remain connected to the authorised recovery purpose, applicable client mandate and appropriate governance controls.
04 — DATA PROTECTION PRINCIPLES
Core data protection principles.
PURPOSE LIMITATION
Use information only for authorised and relevant purposes.
DATA MINIMISATION
Limit information handled to what is reasonably required for the applicable activity.
ACCESS CONTROL
Restrict operational access according to authorised roles and responsibilities.
ACCURACY
Use reasonable processes to maintain or correct relevant information where appropriate.
SECURITY
Apply technical and organisational safeguards appropriate to the information and processing activity.
RETENTION
Retain information according to applicable legal, contractual and operational requirements rather than indefinitely.
ACCOUNTABILITY
Maintain appropriate records and controls so data-handling responsibilities can be reviewed.
PURPOSE LIMITATION
Use information only for authorised and relevant purposes.
DATA MINIMISATION
Limit information handled to what is reasonably required for the applicable activity.
ACCESS CONTROL
Restrict operational access according to authorised roles and responsibilities.
ACCURACY
Use reasonable processes to maintain or correct relevant information where appropriate.
SECURITY
Apply technical and organisational safeguards appropriate to the information and processing activity.
RETENTION
Retain information according to applicable legal, contractual and operational requirements rather than indefinitely.
ACCOUNTABILITY
Maintain appropriate records and controls so data-handling responsibilities can be reviewed.
05 — HOW INFORMATION IS PROTECTED
Access should follow responsibility.
ROLE-CONTROLLED ACCESS
Access to operational information is restricted according to authorised responsibilities.
SECURE SYSTEMS
Technical and organisational safeguards are used to protect information against unauthorised access, loss, misuse or disclosure.
CONTROLLED TRANSMISSION
Information exchanged with appointing clients or authorised systems should use appropriately protected transmission methods.
RETENTION & DISPOSAL
Information is retained according to applicable contractual, legal and operational requirements and disposed of through controlled processes when retention is no longer required.
THIRD-PARTY HANDLING
Personal data must not be sold or licensed. Any authorised service-provider access or disclosure must remain subject to applicable purpose, confidentiality, security and contractual controls.
CROSS-BORDER HANDLING
Where personal data is transferred outside Malaysia, applicable PDPA cross-border transfer requirements and relevant contractual controls must be observed.
06 — DATA INCIDENTS & ACCOUNTABILITY
A data incident requires action, not concealment.
Finder & Partners maintains processes for identifying, escalating, assessing and responding to suspected personal-data incidents.
Apply immediate containment
and limit spread.
Assess affected information,
scope and impact.
Escalate to authorised personnel
and governance leads.
Notify the appointing client
or required parties where applicable.
Implement remedial
and corrective actions.
Preserve evidence
and maintain the incident record.
01
DETECT
Identify and record
suspected incident signals.
02
CONTAIN
Apply immediate containment
and limit spread.
03
ASSESS
Assess affected information,
scope and impact.
04
ESCALATE
Escalate to authorised personnel
and governance leads.
05
NOTIFY
Notify the appointing client
or required parties where applicable.
06
CORRECT
Implement remedial
and corrective actions.
07
DOCUMENT
Preserve evidence
and maintain the incident record.
Notifications to affected parties or regulatory authorities are handled according to the applicable legal requirements, the nature of the incident and the respective responsibilities of the parties involved.
07 — YOUR PERSONAL DATA QUESTIONS
Questions about your information deserve a clear route.
If you have a question concerning personal information associated with an appointed recovery matter, Naya can help identify the appropriate enquiry pathway:
questions about how information is handled
requests concerning access or correction
privacy concerns
suspected misuse of information
data-security concerns
PUBLIC ROUTING ARCHITECTURE
YOU → ASK NAYA → PRIVACY ENQUIRY ROUTING → AUTHORISED PERSONNEL
HARD BOUNDARY · NAYA PUBLIC ROUTING ≠ ACCOUNT DATA ACCESS
Naya does not retrieve account-level or operational debtor records. Naya helps route and classify enquiries. Account-specific information remains within the separately controlled operational environment and requires the appropriate identity and account-authorisation process.
FROM CONTROLLED INFORMATION TO CONTROLLED CONDUCT
MACC COMPLIANCE — ANTI-BRIBERY & ANTI-CORRUPTION
CONTROLLED CONDUCT
08 — OUR POSITION ON CORRUPTION
Integrity is not negotiable.
Finder & Partners is committed to conducting its business in accordance with applicable Malaysian anti-bribery and anti-corruption requirements, including the Malaysian Anti-Corruption Commission Act 2009 and the corporate-liability framework under Section 17A.
Bribery and corruption are not accepted as part of obtaining business, conducting recovery activity, dealing with customers or managing relationships with clients, suppliers or other parties.
The principle applies across persons acting for or on behalf of Finder & Partners within the scope of their responsibilities.
No recovery outcome justifies corrupt conduct.
All operational actions must comply with client parameters; improper influence is strictly blocked at every stage of the decision pathway.
09 — WHAT THAT MEANS IN PRACTICE
Integrity firewall in operational practice.
NO BRIBES OR FACILITATION PAYMENTS
Improper payments must not be offered, requested or accepted to influence an action or decision.
RESOLUTIONDISCLOSE & PROHIBIT
GIFTS, HOSPITALITY & BENEFITS
Gifts, hospitality or other benefits must not be used to improperly influence business or operational decisions.
RESOLUTIONCONTROL & RECORD
NO MISUSE OF CLIENT INFORMATION
Information provided under a client appointment must not be exploited for personal gain or disclosed for unauthorised purposes.
RESOLUTIONCONTROL & AUDIT
NO IMPROPER PREFERENTIAL TREATMENT
Personal benefits must never determine how an account holder is treated or influence decisions outside authorised client parameters.
RESOLUTIONESCALATE & ENFORCE
ACCURATE RECORDS
Operational and business records should accurately represent the activity they document.
RESOLUTIONRECORD & AUDIT
CONFLICTS OF INTEREST
Actual or potential conflicts should be disclosed and handled through appropriate internal controls.
RESOLUTIONDISCLOSE & MANAGE
10 — SECTION 17A & T.R.U.S.T.
Prevention must be designed into the organisation.
Section 17A of the MACC Act establishes corporate-liability considerations relating to corrupt conduct associated with commercial organisations.
Finder & Partners' anti-corruption governance should be structured with reference to Malaysia's Guidelines on Adequate Procedures and the T.R.U.S.T. principles.
T
TOP-LEVEL COMMITMENT
Leadership establishes and communicates the organisation's position on integrity and anti-corruption.
R
RISK ASSESSMENT
Corruption risks should be identified and reviewed according to the nature of the organisation's activities and relationships.
U
UNDERTAKE CONTROL MEASURES
Policies, approval controls, due diligence, reporting mechanisms and other proportionate measures should address identified risks.
S
SYSTEMATIC REVIEW, MONITORING & ENFORCEMENT
Controls should be reviewed and potential breaches appropriately investigated and addressed.
T
TRAINING & COMMUNICATION
Relevant personnel should understand their responsibilities and the organisation's anti-corruption expectations.
This governance framework serves as our organizational reference point for adequate procedures and anti-corruption controls.
11 — REPORTING A CONCERN
If something does not look right, there should be a way to say so.
Employees, account holders, clients and other parties may raise genuine concerns about suspected bribery, corruption, misuse of information or other serious misconduct associated with Finder & Partners.
COMPLIANCE REPORTING PATHWAY
PERSON → NAYA (FRONT DOOR) → CATEGORY / ROUTING → CONTROLLED COMPLIANCE PATHWAY → AUTHORISED REVIEW
NAYA ROUTES APPROVED GUIDANCENAYA DOES NOT INVESTIGATE
WHISTLEBLOWER PROTECTION & INTEGRITY
Finder & Partners prohibits retaliation under its internal arrangements against persons who raise genuine concerns in good faith. Statutory protections under the Whistleblower Protection Act 2010 apply where the requirements of that Act are satisfied.
Where appropriate, individuals may also report suspected corruption directly to the Malaysian Anti-Corruption Commission through its official reporting channels.
12 — OUR COMMITMENT TO APPOINTING ORGANISATIONS
Your compliance position should not be weakened by the partner representing you.
Our appointing clients and panel organisations may themselves operate under significant governance and compliance obligations. Our objective is to conduct recovery activity in a manner that supports, rather than undermines, the integrity and compliance expectations of the organisations that appoint us.
DEFINED MANDATES
Recovery activity operates strictly within the authorised scope of appointment.
AUTHORISED RESPONSIBILITIES
Specific operational permissions and duties assigned to named roles.
CONTROLLED ACCESS
Personal and account data isolated from unauthorised internal or external access.
HUMAN OVERSIGHT
Accountable human judgement required for material customer-impacting decisions.
ACCURATE RECORDS
Operational and engagement actions faithfully documented.
ESCALATION PATHWAYS
Clear escalation mechanisms for disputes, vulnerabilities or exceptions.
CUSTOMER PROTECTION
Respectful engagement aligned with client reputation and customer care.
AUDIT VISIBILITY
Structured recording enabling post-activity compliance review.
The standard we expect from ourselves should be compatible with the standard our clients expect from their own organisations.
POLICY REVIEW CADENCE
These compliance commitments are reviewed periodically and may be updated to reflect changes in applicable law, regulatory guidance, client requirements and our operational environment. Where formal policies impose specific review schedules, those schedules remain governed by the applicable internal policy.
COMPLIANCE ENQUIRIES
A compliance concern should never depend on finding the right email address.
Ask Naya to identify the appropriate pathway for:
PERSONAL DATA
PRIVACY CONCERN
ACCESS / CORRECTION
SUSPECTED DATA MISUSE
ANTI-BRIBERY / CORRUPTION
GOVERNANCE & POLICIES
Naya is the front door, not the decision-maker. Account-specific information, investigations and restricted compliance records remain outside Naya and within their appropriate controlled environments.
Payment Safety Boundary
Finder & Partners does not receive, collect, hold or process customer payments. Payments must be made directly through the authorised channels of the appointing client.
Finder & Partners Sdn Bhd is committed to handling personal data and conducting its business in accordance with applicable Malaysian data-protection and anti-corruption requirements.
Technology supports the organisation's personnel and governance processes; it does not replace accountable human judgement.