隐私政策 Privacy Notice Notis Privasi
这份通知说明 M3 收集哪些个人资料、为什么收集、给了谁、保存多久，以及你有哪些权利。依据马来西亚《2010 年个人资料保护法令》（PDPA，经 2024 年修正案修订）。 This notice explains what personal data M3 collects, why, who it is shared with, how long it is kept, and what rights you have. Issued under Malaysia's Personal Data Protection Act 2010 (as amended by the Amendment Act 2024). —
🚨 这是草案This is a draftDraf
本页为待法务审定的草案，尚未生效。标有 [[ ]] 的部分待填。 This page is a draft pending legal review and is not yet in force. Items marked [[ ]] are still to be filled in. Halaman ini ialah draf yang belum disemak oleh penasihat undang-undang dan belum berkuat kuasa.
☠️ PDPA 第 7(3) 条要求书面通知同时以英文和马来文提供。马来文版本尚未完成 —— 上线前必须补上。切换到 BM 目前只会看到这段说明。 ☠️ Section 7(3) of the PDPA requires this written notice in both English and Bahasa Malaysia. The Malay version is not ready yet and must be added before launch. Switching to BM currently shows only this note. ☠️ Seksyen 7(3) PDPA menghendaki notis ini disediakan dalam Bahasa Malaysia dan Bahasa Inggeris. Versi Bahasa Malaysia belum siap dan mesti dilengkapkan sebelum pelancaran. Sila rujuk versi Bahasa Inggeris buat masa ini.
1. 谁是资料控制者Who is the data controllerPengawal data
[[公司主体]]（公司注册号 [[公司注册号]]）是本服务的资料控制者。 [[公司主体]] (company registration number [[公司注册号]]) is the data controller for this service. —
资料保护主任（DPO）：[[DPO 姓名与联系方式]] 🚨 [[必须任命并向个人资料保护专员通报 — 2025 年 6 月起的法定义务]] Data Protection Officer: [[DPO 姓名与联系方式]] 🚨 [[must be appointed and notified to the Commissioner — statutory since June 2025]] —
2. 我们收集什么What we collectData yang dikumpul
| 类别CategoryKategori | 具体资料DetailsButiran |
|---|---|
| 账户Account— | 邮箱、密码（加盐哈希储存，我们看不到明文）、姓名（可选）、语言偏好、推荐码与推荐关系Email, password (stored salted and hashed — we cannot read it), name (optional), language preference, referral code and referral relationship— |
| 交易与账务Transactions— | 开通与购买记录、权益点与账户流水、兑换与核销记录、提现申请与收款地址Membership and purchase records, points and account ledgers, redemptions, withdrawal requests and the addresses you give us— |
| 链上资料On-chain— | 为你派生的充值地址、交易哈希、你提供的提现地址。这些资料本身在公链上是公开的。The deposit address derived for you, transaction hashes, and the withdrawal address you provide. This information is public on the blockchain by nature.— |
| 技术Technical— | 登录会话、IP 位址（部分记录以哈希形式保存）、浏览器与设备特征、访问时间Login sessions, IP address (hashed in some records), browser and device characteristics, access times— |
| 身份验证Verification— | 在需要验证身份时收集的证件资料。🚨 [[证件类型与触发条件 — 待 KYC 方案定案]] 证件属敏感个人资料，另需明示同意。Identity documents collected where verification is required. 🚨 [[document types and triggers — pending the KYC decision]] Identity documents are sensitive personal data and require explicit consent.— |
| 购物返点 （上线后）Shopping Rewards (once launched)— |
你从 M3 点击进入商家的记录、由此产生的订单编号与金额、你提交申诉时上传的截图Records of clicks from M3 through to a merchant, the resulting order references and amounts, and screenshots you upload when raising a missing-order claim— |
☠️ 我们不收集也不持有你的私钥或助记词。任何自称 M3 向你索取私钥、助记词或密码的人都是诈骗。 ☠️ We never collect or hold your private keys or seed phrase. Anyone claiming to be M3 and asking for a private key, seed phrase or password is attempting fraud. ☠️ Kami tidak sekali-kali mengumpul atau menyimpan kunci peribadi atau frasa benih anda.
3. 为什么收集Why we collect itTujuan
- 建立与维护你的账户、验证登录To create and maintain your account and verify sign-in—
- 处理开通、兑换、核销与提现To process memberships, redemptions and withdrawals—
- 计算并发放制度规定的奖金，以及维护推荐与排位关系To calculate and pay the bonuses set out in the programme, and to maintain referral and placement relationships—
- 防止作弊、重复注册、洗钱与其他滥用To prevent cheating, duplicate registration, money laundering and other abuse—
- 发送与你的账户和交易相关的通知To send notifications about your account and transactions—
- 履行法律、税务与监管要求To meet legal, tax and regulatory obligations—
4. 资料从哪里来Where it comes fromSumber
绝大部分来自你本人 —— 注册、开通、提现申请、上架申请与申诉时由你填写或上传。少部分由系统在你使用服务时自动生成（会话、IP 哈希、交易记录），或由你的推荐人在邀请你时提供（推荐码关联）。购物返点上线后，订单状态由联盟网络回传给我们。 Most of it comes from you — what you enter or upload when registering, joining, requesting a withdrawal, submitting a listing or raising a claim. Some is generated automatically as you use the service (sessions, hashed IP, transaction records), or comes from the person who referred you (the referral link). Once Shopping Rewards is live, order status is reported back to us by the affiliate network. —
5. 我们把资料给谁Who we share it withPendedahan
| 对象Recipient— | 给什么 · 为什么What and why— |
|---|---|
| 生态方Partners— | ☠️ 只有在你明示授权之后，且只给与该生态方有关的资料。所有读取推荐关系的调用都会留下审计记录。☠️ Only after you explicitly authorise it, and only data relating to that partner. Every call that reads referral relationships is logged for audit.— |
| 接入商家Merchants— | 核销时提供核销码与该次兑换的必要信息。不提供你的邮箱、姓名或账户资料。The redemption code and what is needed for that redemption. Not your email, name or account information.— |
| 联盟网络 （购物返点上线后）Affiliate network (once launched)— |
一个随机生成、无法反推出你身份的追踪标识，用于把订单对应回你的点击。提交漏单申诉时会转交你提供的订单资料。A randomly generated tracking identifier that cannot be reversed into your identity, used to match an order back to your click. If you raise a missing-order claim, the order details you provide are passed on.— |
| 技术服务商Service providers— | 主机与资料库、物件储存、邮件发送、内容分发与防护。它们按我们的指示处理资料，不得自用。🚨 [[服务商清单与所在地 — 法务确认后逐一列明]]Hosting and database, object storage, email delivery, content delivery and protection. They process data on our instructions and may not use it for their own purposes. 🚨 [[list of providers and their locations — to be itemised after legal review]]— |
| 主管机关Authorities— | 在法律要求或为保护合法权益必要时。Where required by law or necessary to protect legitimate interests.— |
☠️ 我们不出售你的个人资料，也不把它用于第三方广告投放。 ☠️ We do not sell your personal data, and we do not use it for third-party advertising. ☠️ Kami tidak menjual data peribadi anda.
6. 跨境传输Transfers outside MalaysiaPemindahan ke luar negara
部分技术服务商的伺服器位于马来西亚境外。🚨 [[具体国家/地区 · 依据的传输机制 — 法务依 2025 年跨境传输指引确认]] Some service providers operate servers outside Malaysia. 🚨 [[which countries · the transfer mechanism relied on — legal to confirm against the 2025 cross-border transfer guidelines]] —
7. 保存多久How long we keep itTempoh penyimpanan
🚨 [[各类资料的保留期限 — 法务与会计确认]] 🚨 [[retention periods per category — legal and accounting to confirm]] —
有一件事需要先说明白：交易与奖金记录不能随你的要求删除。矩阵中的点位是其他会员组织结构的一部分，账务流水也要按法律与税务要求保存。因此停用账户是状态变更，不是删除。 One thing is worth stating plainly: transaction and bonus records cannot be deleted on request. A position in the matrix forms part of other members' structure, and ledgers must be retained for legal and tax purposes. Closing an account therefore changes its status rather than erasing it. —
8. 你的权利Your rightsHak anda
- 查阅我们持有的关于你的个人资料Access the personal data we hold about you—
- 更正不准确或不完整的资料Correct data that is inaccurate or incomplete—
- 撤回同意（撤回后我们可能无法继续提供部分或全部服务）Withdraw consent (after which we may be unable to continue providing some or all of the service)—
- 限制处理，以及要求停止用于直销目的的处理Limit processing, and require us to stop processing for direct marketing—
- 资料可携 —— 在技术可行的前提下，要求把你的资料直接传送给另一个资料控制者（PDPA 2024 修正案新增）Data portability — ask us to transmit your data directly to another controller, where technically feasible (added by the 2024 amendment)—
行使权利请联系 [[DPO 联系方式]]。我们会在 [[回应时限]] 内回应。你也可以向马来西亚个人资料保护专员署投诉。 To exercise a right, contact [[DPO 联系方式]]. We will respond within [[回应时限]]. You may also complain to the Personal Data Protection Commissioner of Malaysia. —
9. 安全SecurityKeselamatan
传输全程加密；密码以加盐哈希储存；证件与申诉截图存放在非公开储存桶，仅以短时效链接调阅；后台操作留有审计记录。没有任何系统是绝对安全的 —— 请为 M3 使用独立且强度足够的密码。 Traffic is encrypted in transit; passwords are stored salted and hashed; identity documents and claim screenshots are held in non-public storage and accessed only through short-lived links; administrative actions are logged for audit. No system is perfectly secure — please use a strong password unique to M3. —
10. 资料泄露Data breachesPelanggaran data
发生个人资料泄露时，我们会依 PDPA 尽快通报个人资料保护专员；若泄露可能对你造成重大损害，我们会直接通知你。 If a personal data breach occurs we will notify the Personal Data Protection Commissioner as soon as practicable, as the PDPA requires, and will notify you directly where the breach is likely to cause you significant harm. —
11. CookieCookiesKuki
我们使用维持登录状态与语言偏好所必需的 Cookie 与本地储存。🚨 [[是否使用分析类 Cookie — 确认后据实列明]] We use cookies and local storage that are necessary to keep you signed in and to remember your language. 🚨 [[whether any analytics cookies are used — to be stated accurately once confirmed]] —
12. 本通知的变更Changes to this noticePerubahan
更新时会在本页公布并更新版本日期，重大变更另行通知会员。 Updates are published on this page with a new version date; members are separately notified of material changes. —