Skip to content
Finder & PartnersUnitKredit
FINDER & PARTNERS — PRIVACY POLICY

Privacy, with defined boundaries.

This policy explains how Finder & Partners handles information when you use unitkredit.com and its public digital channels, including Naya. Appointment-based recovery information is governed separately under our PDPA Compliance framework.

WEBSITE SCOPEDEFINED PURPOSECONTROLLED ACCESSHUMAN ACCOUNTABILITYPDPA GOVERNED
PRIVACY POLICY•VERSION 2.0•EFFECTIVE DATE: 5 September 2026•SCOPE: PUBLIC DIGITAL CHANNELS
INFORMATION PATHWAY MAPTWO-DOMAIN MODEL
PUBLIC DIGITAL CHANNELSGOVERNED
PURPOSE
ACCESS
HANDLING
RETENTION
SEPARATE GOVERNED BOUNDARY
CLIENT-APPOINTED OPERATIONAL DATAPDPA COMPLIANCE

Account-specific operational records remain strictly isolated under legal appointment.

SECTION 01 & 02

OUR PRIVACY BOUNDARY

UnitKredit is the digital operating identity of Finder & Partners Sdn Bhd. We enforce a fundamental legal and architectural boundary between public website interaction and client-appointed operational data.

DOMAIN APUBLIC CHANNELS

PUBLIC WEBSITE & DIGITAL CHANNELS

  • Website technical processing metadata
  • Naya public interactive enquiries
  • Corporate & partner enquiries (5 verified fields)
  • Privacy guidance & rights routing
GOVERNED BY: THIS PRIVACY POLICY
DOMAIN BOPERATIONAL DATA

CLIENT-APPOINTED OPERATIONAL DATA

  • Account-specific operational information
  • Recovery records & portfolio data
  • Appointment-based customer communications
GOVERNED SEPARATELY BY: PDPA COMPLIANCEView PDPA Compliance
"Account-specific operational information remains separated from public and corporate knowledge-access pathways."

PAYMENT BOUNDARY

Finder & Partners does not receive, collect, hold or process customer payments.

AI systems and public website channels therefore do not accept or process customer payments.

Payments must be made directly through the authorised channels of the appointing client.

Do not submit card details, banking credentials or payment authentication information through Naya.

INFORMATION PROCESSING ARCHITECTURE

Five-Stage Privacy Lifecycle

Information passing through unitkredit.com public channels follows a strictly controlled, purpose-bound flow.

01

VISIT

Website Request

Technical request metadata processed at edge for delivery & security.

02

PURPOSE

Defined Use

Processing limited strictly to specified public web purposes.

03

ACCESS

Controlled Boundary

Public guidance pathways isolated from operational recovery records.

04

HANDLING

Approved Processing

Authorised edge infrastructure and backend service handling.

05

RETENTION

Purpose-Bound Lifecycle

Information retained only as long as necessary for defined needs.

SECTIONS 03–07

Information Processed & Tracking Posture

Website Technical Information

When you access unitkredit.com, technical information necessary to deliver and secure the website may be processed by our hosting, content-delivery and security infrastructure. Depending on the request and service involved, this may include information such as IP address, request time, requested resource, user-agent information and other technical request metadata.

Processed for website delivery, security, abuse prevention, troubleshooting and service reliability.

Naya Public Channel Interactions

When interacting with Naya, you may choose to provide an optional preferred conversation name and free-text enquiries concerning UnitKredit's published governance model, corporate scope, and institutional boundaries.

Providing a preferred name does not verify your identity and does not grant access to account-specific information.

Corporate Enquiries (5 Verified Fields)

When initiating corporate contact, we collect strictly:

  • 1. Full Name
  • 2. Designation / Job Title
  • 3. Organisation / Company
  • 4. Contact Number
  • 5. Business Email

Purpose: To assess and route the corporate enquiry and support qualification for approved corporate information.

Local Theme Preferences

We store a simple key (theme: "dark" or "light") in browser localStorage solely to remember your display visual theme preference across page navigations.

The public chat interface does not intentionally persist conversation history in browser localStorage or IndexedDB.

Tracking Posture

We do not currently deploy advertising, retargeting, behavioural-tracking or session-replay technologies through the UnitKredit application.

NO ADVERTISING
NO RETARGETING
NO TRACKING PIXELS
NO SESSION REPLAY

WHAT YOU SHOULD NOT SUBMIT THROUGH PUBLIC CHANNELS

We do not request the following information through the public Naya interface:

•NRIC, passport, or government-issued identity card numbers
•Account-specific operational information
•Banking or card credentials
•Passwords, PINs, or authentication secrets
•Unnecessary sensitive personal data

If you provide information that is unnecessary for the public website purpose, we may direct you to an appropriate authorised channel where applicable.

SECTION 09

NAYA, AI & HUMAN AUTHORITY

HUMAN OVERSIGHT MANDATE

Naya provides information and routing assistance within approved boundaries.

Material customer-impacting decisions remain subject to authorised human oversight and the applicable client mandate.

AI MODEL TRAINING BOUNDARIES

Website and Naya information is not intended to be used for unrelated general-model training.

Operational customer information must not be used to train general AI models or for unrelated model development unless a separately authorised, legally permissible and governed process has been approved.

GOVERNANCE POLICY LINKResponsible AI
PUBLIC KNOWLEDGE ZONE
APPROVED PUBLIC KNOWLEDGE
↓
NAYA
↓
INFORMATION / ROUTING
OPERATIONAL ZONE ✕ BLOCKED

Account-specific operational data has NO public Naya access.

SECTION 10

Service Providers & International Processing

CLOUDFLARE

Utilised for public website services:

Website delivery
CDN
TLS
Edge security
SUPABASE

Utilised for backend API support:

Approved backend APIs
Edge Functions
Naya support
Corporate routing

CROSS-BORDER DATA TRANSFERS

Some service providers supporting UnitKredit operate distributed or international infrastructure. As a result, personal data or technical information may be processed or made accessible outside Malaysia.

Where this occurs, Finder & Partners applies the requirements of the Personal Data Protection Act 2010 and applicable cross-border transfer requirements, together with appropriate technical, organisational or contractual safeguards where relevant.

ACCESS & SECURITY CONTROLS

We use technical and organisational controls appropriate to the nature of the website and information processed. These include encrypted transmission, security headers, access boundaries, backend security controls and service-protection measures.

Account-specific operational information remains separated from public and corporate knowledge-access pathways.

No method of transmission, processing or storage can be guaranteed to be completely secure.

SECTION 12

Retention Matrix

THEME PREFERENCE
Stored locally in browser.
Until changed, browser/site data cleared or applicable browser storage removed.
NAYA PUBLIC CONVERSATION
Conversation state may exist temporarily during active session.
No persistent browser conversation history established.
CORPORATE ENQUIRY
May be transmitted to authorised backend services.
Only as long as reasonably necessary for enquiry handling and applicable legal, security, dispute, evidential or governance requirements.
TECHNICAL / SECURITY INFORMATION
Processed by website delivery/security infrastructure.
According to operational/security need and applicable provider settings.
PRIVACY CORRESPONDENCE
Authorised privacy/governance channel.
As long as reasonably necessary to address the enquiry and applicable legal, dispute, security or evidential requirements.
SECTION 13

PRIVACY RIGHTS & ENQUIRIES

Subject to applicable Malaysian law, individuals may have rights concerning personal data processed through our public digital channels. These may include rights to request access or correction, withdraw consent where applicable, object to certain direct-marketing processing, prevent certain processing in circumstances recognised by law, and protections relating to automated decision-making.

Rights and procedures are subject to the Personal Data Protection Act 2010, applicable amendments, regulations and guidance. We will process verified requests within the timeframe required by applicable law.

Naya can provide guidance on how to raise a privacy enquiry or rights request.

SECTION 14 — CHILDREN

UnitKredit is a corporate website and is not designed or directed specifically to children. The public website does not ask visitors to provide their age or date of birth.

Information relating to a minor that may arise in an appointment-based operational matter falls outside this public website Privacy Policy and is subject to applicable operational and PDPA controls.

SECTION 15 — CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our public website services, legal requirements or governance practices. The updated version will be posted on this page with an updated effective date.

UNITKREDIT GOVERNANCE

PRIVACY BY BOUNDARY, NOT BY ASSUMPTION.

Defined purpose, controlled access and clear separation between public digital information and appointment-based operational data.

VIEW PDPA COMPLIANCERESPONSIBLE AI

Privacy & Data Protection Contact

Finder & Partners Sdn Bhd — UnitKredit

Email: privacy@unitkredit.com

Naya can also provide guidance on how to raise a privacy enquiry or rights request.