Reference

How carta4 Handles Your Personal Information

Your account data, payment activity and browsing behaviour on carta4 are handled with a clear set of rules — what we collect, why we collect it, and how long we keep it.

Account data protectionPayment privacy — Touch 'n Go eWallet, Boost, GrabPayCookie and session controlsYour right to access or delete data
carta4 How carta4 Handles Your Personal Information
HOW WE PROTECT IT

Data Handling, Cookies and Account Security

Protecting your account details is not a policy checkbox — it is part of how the platform runs day to day. From SSL-encrypted sessions to strict internal access controls, the steps below outline what we do to keep your information secure and how you stay in control of it.

Encrypted Connections

Every session on carta4 runs over SSL encryption. Your login credentials, payment references and personal details travel through a secured connection — not an open channel.

Cookie Controls

We use session cookies to keep you logged in and analytics cookies to understand how sections are used. You can adjust cookie preferences from the settings panel in your account at any time.

Data Retention Period

Account data is held for as long as your account remains active, plus any period required by applicable law. Once a deletion request is verified, we remove personal records from live systems within a reasonable processing window.

Internal Access Controls

Staff access to your account data is restricted by role. Only the teams that need your information to process payments or verify identity can view it — and those accesses are logged.

PRIVACY CONTACT PATHS

Reach Us About Your Data Rights

Have a question about how we handle your data, or want to request a copy of what we hold? Our account support team handles data enquiries directly — not through a third-party form. Raise a data request through live chat, email or your account dashboard and we will respond through the same channel you used.

Team online

Live Chat

Start a live chat session from your account dashboard to raise a data access or deletion request. Our team picks up active chat sessions as they come in.

Email Support

Send your data enquiry to our support address listed in the account help section. Include your registered email and the nature of your request for faster handling.

Account Dashboard

Log in, head to Account Settings, and use the Privacy Request option to submit changes or access requests directly — no need to contact support for basic data reviews.

Common Questions About Your Privacy on carta4

These are the questions we get most often about data rights, account privacy and how we handle the information tied to your account and payment activity.

We collect your name, contact details, date of birth and RM currency preference at registration. Payment method references — such as Touch 'n Go eWallet transaction IDs — are logged separately when you transact.

No. We log transaction references and timestamps for settlement purposes, but your full wallet credentials are processed by the payment provider and never stored on our systems.

Yes. Submit a data access request via live chat or the Privacy Request option in Account Settings. We will compile and share the data we hold against your registered profile.

Contact us through live chat or email with your registered account details and a deletion request. After identity verification, we process the removal from live systems within the required window.

We do not sell your data. We share it only with payment processors — such as those handling Boost or GrabPay settlements — and only where required by applicable law or to complete your transaction.

Retention after account closure follows the period required under applicable law. Once that period lapses and a verified deletion request is on file, personal records are removed from our active databases.
Reference

Privacy Policy

Service availability depends on eligible regions and local law. Users should check local rules before opening an account.

Access may be available only where local law permits.