Privacy Notice
Last Updated Date: 1st July 2026
The entity responsible for the processing of personal data referred to below is Chery Auto Malaysia Sdn. Bhd. (hereinafter referred to as “LEPAS”, “we” or “us”), a private limited company incorporated under the laws of Malaysia having its business address at 6-01 & 6-02, Level 6, Guoco Tower, Damansara City, No. 6, Jalan Damanlela, Bukit Damansara, 50490 Kuala Lumpur, Malaysia, which acts as the data controller for the purposes of the Personal Data Protection Act 2010 (“PDPA”).
We give top priority to the protection of your personal data and process your personal data in accordance with the PDPA and other applicable data protection laws. This Privacy Notice provides comprehensive information about the processing of your personal data.
This Privacy Notice applies to all personal data that you have provided, or may in the future provide, to us, and supplements any other applicable privacy notices. However, it may not apply to certain products and services that are governed by separate privacy notices (unless such notices expressly incorporate or otherwise refer to this Privacy Notice), including but not limited to those listed below:
- The processing of personal data through your use of our vehicle;
- The processing of personal data when you interact with our authorised distributors, dealers or service centres (including when you purchase, service or repair your vehicle);
- Your use of third-party services available through our website. Such services are subject to the respective third party’s privacy policies, which we strongly advise you to read carefully;
- Our employees’ personal data and recruitment process, which are subject to separate privacy notices.
In this Privacy Notice, we will explain to you:
- What personal data we collect and how we use it?
- What third-party services we use?
- With whom will we share this personal data?
- How do we transfer your personal data outside your region?
- What rights do you have in relation to your personal data?
- How long do we retain your personal data?
- How do we protect your personal data?
- Privacy of children
- How can you contact us and make a request?
- How will we update this Privacy Notice?
1. What personal data we collect and how do we use it?
We collect and use personal data when you visit our website to manage and meet with your service and information requests, to make our products and services as effective as possible, and to protect our IT systems from attacks and other illegal activities.
To communicate with you:
| Data Processing Purpose | Type of Personal Data | Legal Basis for Processing |
|---|---|---|
| To fulfil requests or service appointments you make to us, including test drives, service and event appointments | Your contact information, including your name, phone number and email address (Note: We may contact you to confirm your booking or request) | Performance of a contract with you or necessary in order to take steps at your request prior to entering into a contract |
| To respond to any feedback, requests, questions or complaints you may have regarding our products and services (in person, online, telephone, email, etc.) | Your contact information, including your name, phone number and email address. Communication and interactions information, including your request details | Performance of a contract with you or necessary in order to take steps at your request prior to entering into a contract. Where you have provided your consent, to administer customer inquiries and requests |
| To participate in surveys or offline events about your experience with our products and services | Account information and your contact information, including your name and survey or feedback details | Where you have provided your consent |
| Sign up for marketing communications | Your basic information, including contact information and order information | Where you have provided your consent |
To realise our product functions and services:
| Data Processing Purpose | Type of Personal Data | Legal Basis for Processing |
|---|---|---|
| To fulfil and complete your reservations, orders and other transactions entered into with us | Your contact information, including your name, phone number, email address, delivery address, order information and financial information | Performance of a contract with you |
| To identify and provide assistance with product updates or safety related recalls | Vehicle Identification Number (VIN) and engine number | Necessary for our legal obligations, such as conducting safety-related recalls |
To ensure information security, and to understand and improve our products and services:
| Data Processing Purpose | Type of Personal Data | Legal Basis for Processing |
|---|---|---|
| To detect and defend against unauthorised access to data, and to enhance information security | 1) Device information 2) Network activity information |
Necessary for our legitimate interests, including protecting the confidentiality, integrity and availability of IT systems |
| To upload crash logs for troubleshooting | Account information and relevant crash logs | Where you have provided your consent |
| To understand and analyse website UI behaviour and usage, so as to improve our services | Analytics data (aggregated data on UI behaviour, usage and website analytics) | 1) Necessary for our legitimate interests, including to understand, analyse and improve customer experience 2) Where you have provided your consent (website cookies) |
2. What third-party services do we use?
On our websites, we incorporate social plugins from popular social networks such as Instagram, Facebook, TikTok and YouTube. Here is how they work:
- When you visit our websites, social media plugins are initially deactivated. This means no information is transmitted to the network operators. If you want to use any of these networks, simply click on the respective plugin to establish a direct connection to their servers.
- If you are logged into your user account on a social network when you activate the plugin, the network can recognise your visit to our websites and associate it with your account. To prevent this, please log out of the network before activating the social plugin. The social network cannot detect your visits to other websites of ours unless you activate its social plugin on those sites too.
- When you activate a social plugin, the network directly transfers the available content to your browser, which integrates it into our websites. During this process, data transfers controlled by the respective social network may occur. Your connection to a social network, the data transfers between the network and your system, and your interactions on the platform are governed solely by the network’s data protection provisions.
- The social plugin remains active until you deactivate it or delete your cookies. For more information about cookie settings, please read our Cookies Notice.
Please note that our website may feature links to external websites beyond our control, and this Privacy Notice does not apply to them. If you access these websites through the provided links, the operators of those websites may collect information from you according to their own privacy policies, which may differ from ours.
3. With whom will we share this data?
3.1 Affiliates and subsidiaries
To assist, operate, enhance and fulfil services on our behalf based on our legitimate interests to outsource certain operations, we may share personal data with our affiliates and subsidiaries, whether located within Malaysia or outside of Malaysia.
3.2 Services providers and business partners as data processors:
We share personal data with our service providers and partners to maintain our business operations, our relationship with you, and provide you with our services:
| Categories of providers | Reason for Sharing |
|---|---|
| IT providers and their sub-processors | Personal data is transferred to IT providers who supply general business support systems to us, such as software and data storage providers |
| Marketing and advertising suppliers | To assist, operate and fulfil services related to marketing or digital advertising services |
| Authorised dealer(s) (and its sub-processors) | Personal data is transferred to authorised dealer(s) for the purpose of communication and administration of the handover of cars (if applicable) |
| Cloud service providers | To enhance vehicle function and provide cloud services |
3.3 Law enforcement and government authorities
To fulfil our legal obligations, we may be required to disclose information in response to subpoenas, court orders or lawful requests from government authorities conducting investigations. This includes compliance with law enforcement requirements, regulatory inquiries and the verification or enforcement of our policies and procedures. We may also disclose information in emergency situations to prevent or halt potentially illegal, unethical or legally actionable activities. When we receive a request for personal data from a law enforcement authority, we assess the necessity and proportionality of the requested information.
4. How do we transfer your data outside your region?
LEPAS is a global brand company, and we operate internationally. By making a purchase or otherwise submitting your personal data to us, your information may be transferred to LEPAS in countries other than your place of residence or in which the information was originally collected. For example, where we have facilities or where we engage service providers. LEPAS complies with laws on the transfer of personal data between countries to help ensure your personal data is protected as described in this Privacy Notice, wherever it may be.
We may rely on various legal grounds to collect, use and otherwise process your information, including: your consent; where the information is necessary for the performance of a contract with you; to comply with a legal obligation; to protect your or another person’s vital interests; or for a legitimate interest that is balanced against your rights and interests. These legitimate interests may include LEPAS’s interest in improving its products and services, enhancing safety and security, protecting LEPAS or its business partners against wrongful conduct, and responding to customer inquiries and claims. Where applicable, we will inform you whether and why we need certain information from you.
5. What rights do you have in relation to your personal data?
5.1 Right to withdraw consent
Where you have given consent for the processing of your personal data, you may withdraw your consent at any time, and it will take effect upon withdrawal.
5.2 Right to access your personal data
You have the right to request information about the personal data we process about you. Upon request, we will provide you with a copy of your personal data.
5.3 Right to rectification
You may request us to rectify any incorrect or incomplete personal data concerning you. We make reasonable efforts to ensure that personal data in our possession or control, which is used on an ongoing basis, is accurate, complete, current and relevant, based on the most recent information available to us.
5.4 Right to request deletion
You may request the deletion of your personal data, and we will take reasonable steps to delete or de-identify your personal data where permitted under applicable law and subject to applicable legal and regulatory retention requirements.
5.5 Right to opt-out marketing
Where processing is based on your consent, you may withdraw your consent at any time. You may also request that we cease processing your personal data for marketing purposes.
6. How long do we retain your personal data?
We retain personal data related to our provided services in accordance with legal obligations. If you are a customer, we will keep your personal data for the duration of any contractual relationship you have with us and, where permitted, beyond the end of that relationship for as long as necessary to fulfil the purposes set out in this Privacy Notice.
We retain the personal data we collect from or about you for the period necessary to fulfil the purposes outlined in this Privacy Notice, unless a longer retention period is required or permitted by law. Once the personal data is no longer necessary for these purposes, we will either delete it or retain it in an anonymised form. In determining the appropriate retention period, we take into account various criteria, including the type of services requested by or provided to you, the nature of our relationship with you, the potential impact on the services we provide to you if we delete certain personal data relating to you, and the retention periods mandated by law.
7. How do we protect your personal data?
We strive to maintain high security standards and have implemented robust technical and organisational measures to protect your personal data, in accordance with the current, general state of technology. We ensure that your personal data is adequately secured against loss, falsification or unauthorised access. However, please note that the transmission of information via the internet is not completely secure. While we do our best to protect your personal data, we cannot guarantee the absolute security of your personal data transmitted to us.
Once we have received your personal data, we implement strict procedures and security features to prevent unauthorised access. In the unfortunate event of a personal data breach, we will report it and take remedial measures in accordance with the applicable legal and regulatory requirements.
8. Privacy of children
We do not knowingly collect or use any personal data from children (defined as minors below the age of 18) without prior, verifiable consent given or authorised by the holder of parental responsibility over the child. We do not knowingly allow children to order our vehicles, communicate with us, or use any of our online services.
If you become aware that a child has provided us with personal data, please contact us at dpocam@chery.my. We will take all reasonable measures to delete the information as soon as possible and will not use such information for any purpose, except where necessary to protect the safety of the child or others, or as required by law.
9. How can you contact us and make a request？
If you have any questions about the processing of your personal data, you are advised to first review this Privacy Notice. To make a query, raise a concern, or exercise your data subject rights, please contact us at dpocam@chery.my.
We take your privacy seriously and will respond to your requests within the time period prescribed under the PDPA, after verifying your identity.
10. How will we update this Privacy Notice？
We may update this Privacy Notice from time to time to reflect changes in our business operations and data protection practices. All such changes shall take effect immediately upon publication on our website and shall apply to all processing of personal data thereafter. Your continued use of our website, products or services, or your continued interaction with us following such changes, shall constitute your acceptance of the updated Privacy Notice. You are therefore advised to review this Privacy Notice periodically to stay informed of any updates.