Rujukan Laman

How extrajosh Handles Your Personal Data

At extrajosh, we collect only the data we actually need to run your account and process your transactions — nothing more.

Data collected only when necessaryTouch 'n Go & GrabPay transaction records securedYour rights are enforceable on requestMalaysian law applies where relevantContact us any time to access your data

Explore the Lobby Read FAQ

What We Collect and Why We Collect It

extrajosh Service availability depends on jurisdiction. It is the user's responsibility to check local law before access.

When you open an account with extrajosh, we collect your name, email address, contact number, and payment identifiers — for example, your Touch 'n Go wallet reference or GrabPay account token — so that deposits and withdrawals can be matched to your account accurately. We also

1
log device identifiers and session data to detect unauthorised access attempts. Boost dan FPX transaction metadata is retained for reconciliation purposes as required under applicable Malaysian financial regulations. We do not sell, rent or share your personal data with third parties for marketing. Data shared with
2
payment processors is limited strictly to what those processors need to complete your transaction. Your eligibility to use this service depends on local law and is available where local law permits.

Service availability depends on jurisdiction. It is the user's responsibility to check local law before access.

HUBUNGI PASUKAN KAMI

Reach Us About Your Privacy Rights

Team online

Email Privacy Team

Send a written request to our dedicated privacy address at extrajosh.app. We aim to acknowledge your message within one business day and resolve data requests within 14 calendar days of verification.

Live Chat Support

Our live chat channel on extrajosh.app is open around the clock. If your query involves account data, our agents will escalate it to the privacy team on your behalf within the same session.

Formal Written Request

For deletion, correction or export requests, submit a formal written note through your logged-in account portal. We will verify your identity before actioning any changes to stored personal data.

KESELAMATAN DATA KAMI

Six Ways We Protect Your Data at extrajosh

Data security at extrajosh is handled through a combination of technical controls and clear internal policies.

Encryption in Transit and at Rest

All data flowing between your device and our servers — including Touch 'n Go and GrabPay payment tokens — is…

Cookie Management and Consent

We use session cookies to keep you logged in and analytics cookies to understand how you navigate the lobby.

Account Access Security

Two-step verification is available for all accounts. Login attempts from unrecognised devices trigger an email alert sent to your registered…

Data Retention Limits

We keep active account data for as long as your account remains open.

Third-Party Data Sharing Controls

Payment processor partners such as the Boost dan FPX network receive only the minimum data fields required to authorise a…

Your Right to Correct or Delete Data

You may request a full export of your stored personal data, ask us to correct inaccuracies, or ask us to…

Your Privacy Questions, Answered

Below are the questions we hear most often about how extrajosh manages personal data, cookie settings, and your rights as an account holder in Malaysia. If your question is not listed here, reach out via live chat or the email channel above.

We collect your name, email address, phone number and payment identifiers — such as your Touch 'n Go wallet reference or GrabPay token — along with device and session data needed to secure your account against unauthorised access.

Personal data is removed from live systems within 30 days of account closure. Transaction records may be retained longer where Malaysian financial regulations require it, and you will be informed of any such retention at the time of closure.

Yes. Submit a subject-access request through your logged-in account dashboard. We will verify your identity and deliver a structured export of your stored data within 14 calendar days of confirming who you are.

No. We do not sell or rent your personal data. Payment processors like Boost dan FPX receive only the minimum fields needed to complete a transaction and are contractually barred from using your data for any other purpose.

Log in, navigate to account settings and use the personal-details section to update your name, contact number or email address. For document-level corrections — such as identity verification records — contact our privacy team via email for manual review.

We use session cookies to maintain your login state and analytics cookies to measure navigation patterns in the lobby. Open the cookie-preference panel inside account settings at any time to adjust which categories remain active on your device.

Payment token references are stored only long enough to reconcile the transaction against your account balance. Once reconciliation is complete, raw payment tokens are replaced with anonymised transaction identifiers to limit exposure of your financial details.

How extrajosh Handles Your Personal Data

Reach Us About Your Privacy Rights

Email Privacy Team

Live Chat Support

Formal Written Request

Six Ways We Protect Your Data at extrajosh

Encryption in Transit and at Rest

Cookie Management and Consent

Account Access Security

Data Retention Limits

Third-Party Data Sharing Controls

Your Right to Correct or Delete Data

Your Privacy Questions, Answered

01 What personal data does extrajosh collect when I open an account?

02 How long does extrajosh keep my data after I close my account?

03 Can I request a full copy of the data extrajosh holds about me?

04 Does extrajosh share my data with third parties for marketing purposes?

05 How do I update or correct inaccurate personal data on my account?

06 What cookies does extrajosh use, and how can I manage them?

07 What happens to my GrabPay and Touch 'n Go payment data after a transaction?

Related Pages