Privacy Policy

This Policy applies to the X·ONE Care application and website, and to everyone who uses the Service — including customers, retail staff and dealers. By using the Service, you acknowledge the practices described here.

Depending on how you use the Service, we may collect:

• Account & identity data — name, email address, phone number, password, date of birth, profile photo or avatar, and your role (customer, staff or dealer).
• Profile & verification data — email and phone verification status, and any device you choose to register.
• Product & warranty data — products you register, serial numbers, warranty registrations, and warranty claims you file, including issue descriptions and photographs you upload.
• Activity & usage data — activations, check-ins, XP transactions, challenge and campaign participation, referrals and leaderboard standing; and, for staff, merit records and outlet assignments.
• Device & technical data — device type, app or browser version, IP address, identifiers and log data.
• Location data — approximate location, collected only when you use the store locator and grant permission.
• Communications — messages, enquiries and support requests you send us.

• Directly from you — when you register, complete your profile, register products, or file a claim.
• Automatically — usage, device and log data generated as you use the Service.
• From dealers and staff — for example when a staff member activates a product for you at an outlet.
• From campaign and referral interactions you take part in.

We use personal data to:

• Create and manage your account, and authenticate you;
• Register products and warranties, and verify product authenticity;
• Process, assess and track warranty claims;
• Operate the XP and rewards programme, campaigns, challenges and leaderboards;
• Attribute sales and activations to the relevant outlet and staff member;
• Detect, investigate and prevent fraud, abuse and policy violations, including integrity and merit measures;
• Send you service and claim updates and, where you have consented, promotional messages;
• Provide customer support, comply with legal obligations, and improve and secure the Service.

By providing your personal data and using the Service, you consent to our processing of it for the purposes described in this Policy. Some data is necessary to provide the Service — if you choose not to provide it, we may be unable to provide the Service or parts of it. You may withdraw your consent for non-essential processing (such as marketing) at any time, as described in “Your rights” below.

We may disclose personal data to:

• Authorised X·ONE dealers, outlets and staff involved in your product registration or warranty claim, so warranties can be honoured and sales attributed correctly;
• Service providers acting on our behalf (such as hosting, messaging and analytics providers), under confidentiality obligations;
• Campaign partners, where you take part in a campaign — limited to what the campaign requires;
• Authorities or other third parties where required by law, or to protect rights, safety and the integrity of the Service;
• A successor entity in connection with a merger, acquisition or business transfer.

We do not sell your personal data.

Some of our service providers may store or process personal data outside Malaysia. Where this happens, we take reasonable steps to ensure the data receives a standard of protection comparable to that under the PDPA.

We keep personal data for as long as your account is active and as needed for the purposes set out in this Policy. Warranty and claim records are retained for the lifecycle of the warranty or claim and for any period required by law, after which data is deleted or anonymised.

We apply reasonable technical and organisational measures to protect personal data against loss, misuse and unauthorised access. No method of transmission or storage is completely secure; please keep your password confidential and contact us if you suspect any unauthorised access to your account.

Subject to the PDPA, you may:

• Request access to the personal data we hold about you;
• Request correction of personal data that is inaccurate, incomplete or out of date;
• Withdraw consent to, or ask us to limit, processing for non-essential purposes such as marketing;
• Ask questions about how your personal data is handled.

You can update much of your information yourself in the Service (under Profile). For other requests, contact us using the details below. We may charge a prescribed fee for an access request, as permitted under the PDPA.

The Service uses cookies and local storage to keep you signed in, remember preferences (such as your chosen language), and understand usage. Some are necessary for the Service to function. You can control cookies through your browser settings, though disabling some may affect how the Service works.

The Service is not directed to children under the age of [age]. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.

The Service may link to third-party websites or services that have their own privacy practices. We are not responsible for the content or privacy practices of those third parties.

We may update this Policy from time to time. Where changes are material, we will take reasonable steps to notify you. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

For privacy enquiries or to make a PDPA request, contact us at info@xone.care, or by post to X One Holdings Sdn Bhd, Lot 2106, Marina Parkcity Commercial Center, 98000 Miri, Sarawak, Malaysia.