Effective Date: June 16, 2026 · Version 1.0

AT Series Capital Sdn. Bhd. ("Skyro", "we", "us", "our") is committed to protecting your personal data in accordance with the Personal Data Protection Act 2010 (PDPA) and its regulations. This Privacy Notice explains how we collect, use, disclose and protect your personal data when you use the Skyro app and related services.

Please read this notice carefully. By registering for or using the Skyro app, you acknowledge that you have read and understood this Privacy Notice.

This Privacy Notice forms part of, and should be read together with, our Terms and Conditions, which are available within the App/

1. Who We Are

Skyro is a digital money lender licensed by the Ministry of Housing and Local Government (KPKT) under the Moneylenders Act 1951.

2. Personal Data We Collect

We collect the following categories of personal data from you:

• Identity data - Full name, MyKad number, date of birth, gender, nationality, facial image and liveness data collected during identity verification.
• Contract data - Mobile phone number, email address, residential address.
• Financial data - Monthly income, employment details, bank account details, credit history, credit score, loan application details, repayment history.
• Technical data - Device identifiers, IP address, operating system version, app usage logs, session data.
• Communications data - Records of your enquiries, complaints and other interactions with us through the App, email or other channels.

Sensitive personal data. Your facial image and liveness data are classified as biometric data and constitute sensitive personal data under the PDPA. We collect and use this data solely to verify your identity, as authorised by your explicit consent. We do not use this data for any other purpose.

3. How We Collect Your Data

We collect personal data:

• Directly from you – when you register, complete your profile, apply for a loan or contact us.
• From third parties – from credit reference agencies and identity verification service providers in connection with assessing your application.
• Automatically – through the App, including technical and usage data generated when you interact with the App.

4. Why We Collect Your Data

We process your personal data for the following purposes:

(a) to process your loan application and manage your loan account;

(b) to verify your identity and assess your creditworthiness;

(c) to comply with our legal obligations, including anti-money laundering, counterfinancing of terrorism and regulatory reporting requirements under Malaysian law;

(d) to communicate with you regarding your account, repayment obligations, service updates and required notices;

(e) to detect, investigate and prevent fraud, money laundering and other unlawful or suspicious activities;

(f) to enforce our rights under any Loan Agreement or our Terms and Conditions;

(g) to improve, maintain and develop our App and Services; and

(h) with your separate consent, to send you marketing communications about our products and services.

Mandatory data. Provision of your identity, financial and biometric data is necessary for us to process your loan application. We cannot assess or approve your application without this information.

5. Who We Share Your Data With

We may disclose your personal data to the following categories of recipients:

(a) credit reference agencies, for the purpose of credit assessment and, where applicable, reporting your credit performance;

(b) identity verification and fraud prevention service providers;

(c) banking and payment service partners, for loan disbursement and repayment processing;

(d) regulatory authorities, law enforcement agencies and government bodies, where required or permitted by law;

(e) professional advisers, including lawyers, auditors and insurers; and

(f) service providers engaged to support the operation of our App and Services, including technology, hosting and communication providers, each bound by appropriate data processing obligations.

We do not sell your personal data to any third party.

We disclose your personal data only to the categories of recipient listed above and only for the specific purposes described in this Notice. We do not seek any broad or blanket consent to share your personal data with third parties, and we will not share your data with any other party for any unrelated purpose without first obtaining your specific consent or unless required or permitted by law.

6. Cross-Border Transfers

In the course of providing our Services, your personal data may be transferred to and processed in countries outside Malaysia, including for technology and operational support purposes. We take appropriate measures to ensure that any such transfer is subject to data protection standards equivalent to those required under Malaysian law.

7. How Long We Keep Your Data

We retain your personal data for as long as necessary to fulfil the purposes described in this notice and to comply with applicable legal and regulatory requirements. In accordance with the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA), we retain transaction and account records for a minimum of six years from the date of the last transaction or account closure, or such longer period as may be required by law.

When your data is no longer required, we will securely delete or anonymise it.

8. Your Rights

Under the PDPA, you have the following rights in relation to your personal data:

• Access - You may request a copy of the personal data we hold about you.
• Correction - You may request that we correct any inaccurate or incomplete personal data.
• Withdrawal of consent - Where processing is based on your consent (for example, for marketing communications or biometric verification), you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal. Note that withdrawal of consent for certain mandatory data may prevent us from continuing to provide our Services to you.
• Cease processing - You may request that we cease processing your personal data for direct marketing purposes at any time.

To exercise any of your rights, please contact us at legal@skyro.my. We will respond to your request within 21 days.

9. Marketing Communications

We will only send you marketing communications by SMS, email or push notification if you have given us your express consent to do so. You may withdraw your marketing consent at any time by:

(a) adjusting your notification preferences in the App;

(b) clicking the unsubscribe link in any marketing email; or

(c) contacting us at legal@skyro.my.

Withdrawal of marketing consent will not affect your ability to receive transactional or service communications relating to your account and active loan obligations.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, disclosure or destruction. These measures include encryption of data in transit and at rest, access controls, and regular security reviews. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant regulatory authority in accordance with our obligations under the PDPA.

You are responsible for maintaining the security of your own device and login credentials. We will never ask you to share your PIN or password with us.

11. Cookies and Tracking Technologies

The App may use software development kits (SDKs) and similar tracking technologies to collect technical and usage data for the purposes described in this notice. These technologies help us to improve App performance, diagnose technical issues and understand how users interact with the App.

Where such technologies involve the transfer of data outside Malaysia, such transfer is subject to appropriate safeguards as described in Section 6.

12. Children

Our Services are not directed at or intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe that a minor has provided us with personal data, please contact us at legal@skyro.my. and we will take prompt steps to delete such data.

13. Updates to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our practices, technology or legal requirements. The current version, together with its effective date and version number, will always be available within the App. We encourage you to review this notice periodically.

14. Complaints

If you have a concern about how we handle your personal data, please contact us in the first instance at legal@skyro.my. We will investigate and respond within 21 days.