Privacy Policy

1. Introduction

Skygen Network Sdn. Bhd. ("Skygen", "we", "us" or "our") respects the privacy and personal data of customers, website visitors, purchasers, attendees, participants and other individuals who interact with Mega Touring Festival Jiwa 2 Roda ("J2R").

This Privacy Policy ("Policy") explains how we collect, record, hold, store, use, process, disclose, transfer, secure, retain and otherwise handle personal data in connection with:

1. The official J2R website;
2. Admission-pass and e-ticket purchases;
3. QR-code registration and event admission;
4. Event packages and merchandise;
5. Online payments;
6. Merchandise shipping and collection;
7. Promotions, contests and lucky draws;
8. Customer-support enquiries;
9. Marketing communications;
10. Event operations, photography, videography and CCTV; and
11. Any other J2R product, service, platform or authorised sales channel.

Skygen acts as the data controller for personal data processed for its own purposes in connection with J2R.

This Policy is prepared in accordance with the Personal Data Protection Act 2010, the Personal Data Protection (Amendment) Act 2024, applicable regulations, standards, guidelines and other Malaysian laws relating to personal data protection.

2. Acceptance of This Policy

By accessing the J2R website, creating an account, registering for the event, completing a purchase, submitting information, communicating with us or attending J2R, you acknowledge that you have read and understood this Policy.

Where consent is required by law, we will request consent through an appropriate method, which may include:

1. Selecting an acknowledgement or consent box;
2. Submitting a registration or order form;
3. Providing written or electronic consent;
4. Adjusting cookie preferences; or
5. Any other clear affirmative action.

Consent for direct marketing will, where appropriate, be requested separately from consent required to process an order or provide an event service.

3. Meaning of Personal Data

"Personal data" means information relating directly or indirectly to an identifiable individual and includes information that can identify an individual on its own or when combined with other information.

Personal data may include information recorded electronically, digitally, visually, in writing or through another form.

"Sensitive personal data" includes categories of information treated as sensitive under applicable Malaysian law, including health information, biometric information, financial information and other legally protected information.

4. Personal Data We May Collect

Depending on how you interact with J2R, we may collect the following categories of personal data.

4.1) Identity Information

1. Full name;
2. Identification type and partial or full identification number where reasonably required;
3. Date of birth or age;
4. Gender, where voluntarily provided or operationally required;
5. Nationality;
6. Photograph;
7. Signature; and
8. Identity-verification information.

4.2) Contact Information

1. Email address;
2. Telephone or mobile number;
3. WhatsApp contact details;
4. Residential, billing or delivery address;
5. Postcode, city, state and country; and
6. Emergency-contact information.

4.3) Account and Registration Information

1. Username or account identifier;
2. Encrypted password or authentication information;
3. Admission category;
4. Package selection;
5. Registered-attendee information;
6. E-ticket and QR-code details;
7. Registration status;
8. Check-in, scan and redemption records;
9. Event preferences; and
10. Account communications and settings.

4.4) Motorcycle and Vehicle Information

Where required for event registration, parking, access, activities or statistical purposes, we may collect:

1. Motorcycle brand;
2. Motorcycle category;
3. Motorcycle model, where requested;
4. Vehicle registration number, where required;
5. Motorcycle club or community affiliation;
6. Parking category or allocation;
7. Riding-group information; and
8. Other relevant vehicle or participation information.

4.5) Purchase and Transaction Information

1. Order number;
2. Products, packages and merchandise purchased;
3. Size, colour, design and quantity selections;
4. Purchase date and amount;
5. Billing details;
6. Payment method;
7. Transaction reference;
8. Payment status;
9. Refund, dispute or chargeback information;
10. Receipt and invoice information;
11. Delivery or collection method; and
12. Courier and fulfilment records.

4.6) Payment Information

Online payments may be processed through NTT DATA Payment Services, participating banks, card issuers, e-wallet providers, buy-now-pay-later providers or other authorised payment service providers.

Depending on the payment method, the payment provider may collect:

1. Cardholder name;
2. Payment-card information;
3. Bank-account information;
4. E-wallet information;
5. Authentication information;
6. Billing address;
7. Transaction details; and
8. Fraud-prevention information.

Complete payment-card credentials and authentication information may be collected directly by the relevant payment provider and may not be accessible to or stored directly by Skygen.

Payment providers process personal data according to their own privacy notices, security requirements and legal obligations.

4.7) Shipping and Fulfilment Information

1. Recipient name;
2. Delivery address;
3. Contact number;
4. Courier tracking number;
5. Delivery status;
6. Proof of delivery;
7. Delivery photographs or electronic signatures;
8. Collection location;
9. Collection QR code or voucher; and
10. Merchandise collection records.

4.8) Communications and Customer-Support Information

1. Emails, messages and correspondence;
2. Enquiries, complaints and feedback;
3. Telephone or customer-support records;
4. Survey responses;
5. Return, refund or fulfilment requests;
6. Supporting photographs, videos and documents;
7. Social-media interactions; and
8. Records of resolutions or assistance provided.

4.9) Website, Device and Technical Information

When you use the J2R website, we may automatically collect:

1. Internet Protocol address;
2. Browser type and version;
3. Device type and operating system;
4. Device identifiers;
5. Language and time-zone settings;
6. Login and session information;
7. Pages viewed and links selected;
8. Date, time and duration of website activity;
9. Referring website or source;
10. Approximate location derived from an IP address;
11. Cookie identifiers;
12. Error, diagnostic and security logs; and
13. Website usage and interaction information.

4.10) Event Photography, Videography and CCTV

J2R may use photography, videography, live streaming and CCTV at the event venue.

This may capture:

1. Your image;
2. Voice;
3. Appearance;
4. Activities;
5. Motorcycle or vehicle;
6. Vehicle registration number; and
7. Interactions at the event.

CCTV may be used for safety, security, incident investigation, access control and crime prevention.

Official event photography and videography may be used to document, report on and promote J2R and future Skygen events, subject to applicable law.

4.11) Sensitive Personal Data

Where reasonably necessary, we may collect sensitive personal data, including:

1. Health or medical information voluntarily provided for accessibility, safety or emergency purposes;
2. Allergy or mobility information;
3. Financial information relating to payments, refunds or disputes;
4. Biometric information where legally implemented for identity or access verification; and
5. Other information classified as sensitive under applicable Malaysian law.

We will process sensitive personal data with explicit consent where required, or where another legally permitted ground applies.

5. Sources of Personal Data

We may collect personal data from:

1. You directly;
2. A person purchasing or registering on your behalf;
3. Your parent, guardian or authorised representative;
4. The J2R website or Customer account;
5. Order, registration and enquiry forms;
6. Payment gateways, banks and financial institutions;
7. Courier, delivery and fulfilment providers;
8. Event registration, access-control and QR-code systems;
9. Event partners, contractors and authorised service providers;
10. Social-media platforms;
11. Cookies and similar technologies;
12. CCTV, photography and videography systems;
13. Publicly available sources; and
14. Government, regulatory or law-enforcement authorities where permitted by law.

If you provide another person's personal data to us, you confirm that you are authorised to do so and that the person has been informed about the processing described in this Policy.

6. Purposes for Processing Personal Data

We may process personal data for the following purposes:

1. Creating and managing Customer accounts;
2. Processing event registrations;
3. Processing admission-pass, package and merchandise purchases;
4. Issuing e-tickets and QR codes;
5. Confirming and verifying payments;
6. Generating receipts, invoices and transaction records;
7. Managing admission, check-in and event access;
8. Verifying identity and preventing admission-pass misuse;
9. Fulfilling, shipping and delivering merchandise;
10. Managing event-site and designated-point collection;
11. Providing Customer support;
12. Responding to enquiries, complaints and disputes;
13. Processing legally valid returns, replacements or refunds;
14. Managing payment disputes and chargebacks;
15. Preventing fraud, unauthorised transactions and other illegal activity;
16. Managing event operations, attendance and capacity;
17. Allocating parking and managing traffic or motorcycle participation;
18. Supporting safety, security, crowd control and emergency response;
19. Administering lucky draws, contests, promotions and giveaways;
20. Conducting surveys and obtaining Customer feedback;
21. Improving the website, products, packages and event experience;
22. Conducting statistical, analytical and business reporting;
23. Sending operational announcements and event updates;
24. Sending promotional or marketing communications where permitted;
25. Managing cookies and website preferences;
26. Protecting Skygen's legal rights, systems and property;
27. Complying with contractual, accounting, audit, tax and insurance requirements;
28. Responding to Government, regulatory, court or law-enforcement requests;
29. Investigating accidents, incidents, security concerns or complaints;
30. Maintaining appropriate business and transaction records; and
31. Complying with applicable Malaysian laws.

7. Mandatory and Optional Personal Data

Personal data marked as required during registration, checkout, payment or fulfilment is necessary for us to provide the relevant product or service.

If required personal data is not provided, we may be unable to:

1. Create an account;
2. Process or verify payment;
3. Complete a purchase;
4. Issue an admission pass or QR code;
5. Deliver or release merchandise;
6. Verify identity;
7. Grant event admission;
8. Provide Customer support; or
9. Comply with legal requirements.

Personal data requested for marketing, surveys or non-essential preferences may be optional unless otherwise stated.

8. Consent and Other Permitted Processing

Where required, we process personal data with your consent.

We may also process personal data where permitted under applicable law, including where processing is necessary:

1. To perform or prepare to enter into a contract with you;
2. To comply with a legal obligation;
3. To protect your vital interests or those of another person;
4. To administer justice or respond to a lawful authority;
5. For purposes permitted by the PDPA; or
6. For another legally recognised purpose.

Withdrawal of consent does not affect processing already carried out lawfully before the withdrawal.

9. Disclosure of Personal Data

We may disclose personal data only where reasonably necessary and permitted by law.

Recipients may include:

1. NTT DATA Payment Services and other payment service providers;
2. Banks, card issuers, e-wallet providers and financial institutions;
3. Website developers, hosting providers and IT-support providers;
4. Cloud-storage, database and cybersecurity providers;
5. QR-code, registration and access-control service providers;
6. Merchandise manufacturers, printers and fulfilment providers;
7. Courier, logistics and delivery providers;
8. Sepang International Circuit and other relevant venue operators;
9. Event contractors, security personnel and operational service providers;
10. Emergency, medical and safety service providers;
11. Marketing, communications, photography and videography service providers;
12. Professional advisers, auditors, insurers, accountants and lawyers;
13. Government departments, regulators, police, courts and law-enforcement authorities;
14. Potential business transferees in connection with a lawful corporate transaction; and
15. Other parties authorised by you or permitted by law.

Service providers are expected to process personal data only for authorised purposes and to implement appropriate confidentiality and security measures.

We do not sell or rent personal data to third parties for their independent marketing purposes.

10. Payment Processing

Payment transactions are processed through authorised third-party payment providers.

When you select a payment method, you may be redirected to, or interact with, a payment interface controlled by the payment provider.

The payment provider may independently collect and process personal data required to:

1. Authorise the payment;
2. Authenticate the payer;
3. Conduct fraud and risk screening;
4. Process instalment or deferred-payment arrangements;
5. Complete settlement;
6. Process reversals, disputes or refunds; and
7. Comply with financial, anti-money-laundering or regulatory requirements.

Skygen may receive transaction references, payment status, payer information and limited payment details necessary to confirm and manage the order.

11. Direct Marketing

Where permitted by law, and where necessary with your consent, we may send:

1. J2R event announcements;
2. Product and package promotions;
3. Merchandise offers;
4. Early-access opportunities;
5. Future-event information;
6. Sponsor or partner promotions approved by Skygen;
7. Surveys; and
8. Other marketing communications.

You may opt out at any time by:

1. Selecting the unsubscribe link in an email;
2. Adjusting your account preferences;
3. Replying "STOP" where that option is provided; or
4. Contacting us using the details in this Policy.

Opting out of marketing will not prevent us from sending essential service communications, including order confirmations, payment notices, e-tickets, event updates, safety announcements and fulfilment notifications.

12. Cookies and Similar Technologies

The J2R website may use cookies, pixels, tags, local storage and similar technologies.

These technologies may be used to:

1. Operate essential website functions;
2. Maintain login sessions;
3. Remember Customer preferences;
4. Maintain shopping-cart information;
5. Process checkout and payment;
6. Improve website performance;
7. Measure website traffic and engagement;
8. Detect fraud and security threats;
9. Conduct analytics; and
10. Deliver relevant marketing where consent has been provided.

Cookies may be classified as:

1. Strictly necessary cookies;
2. Functional cookies;
3. Performance and analytics cookies; and
4. Advertising or marketing cookies.

Where required, non-essential cookies will be activated only after the Customer provides consent through the cookie preference tool.

Disabling certain cookies may affect website functionality, account access, checkout or payment processing.

13. Analytics and Automated Processing

We may use website analytics and automated tools to identify usage patterns, improve services, detect fraud, assess transaction risk and protect website security.

Where a decision is made solely through automated processing and produces a significant effect on an individual, we will manage the process and provide applicable rights in accordance with Malaysian law.

You may contact us to request further information about applicable automated processing.

14. Event Photography and Videography

Photography, videography and live recording may take place throughout J2R.

Images and recordings may be used for:

1. Event documentation;
2. News and media coverage;
3. Corporate reporting;
4. J2R and Skygen websites;
5. Official social-media channels;
6. Advertising and promotional materials;
7. Future-event promotion; and
8. Historical and archival purposes.

By entering areas where photography or recording is taking place, attendees acknowledge that they may appear incidentally in crowd or event footage, subject to applicable law.

Where practicable, individuals with a specific privacy concern may contact an event representative for assistance. However, removal from previously distributed crowd footage or third-party media cannot be guaranteed.

Separate consent may be obtained for individual interviews, testimonials, staged promotional content or other focused commercial use where appropriate.

15. CCTV and Event Security

CCTV may operate at the event venue and surrounding controlled areas for:

1. Public and attendee safety;
2. Security monitoring;
3. Access control;
4. Crowd management;
5. Protection of property;
6. Prevention and detection of crime;
7. Incident investigation; and
8. Cooperation with emergency and law-enforcement authorities.

CCTV records will be accessed only by authorised persons and retained only for as long as reasonably necessary, unless longer retention is required for an investigation, legal claim or lawful authority request.

Some CCTV systems may be independently operated by the venue and subject to the venue operator's privacy practices.

16. Children and Minors

The J2R website and purchasing facilities are not intended to be used independently by individuals who lack the legal capacity to enter into a binding transaction.

Where personal data relating to a person under eighteen (18) years of age is provided, the parent, legal guardian or responsible adult must ensure that:

1. The information is provided lawfully;
2. Appropriate consent or authority has been obtained;
3. The information is accurate; and
4. The minor is appropriately supervised at the event.

If we become aware that a minor's personal data was provided without appropriate authority, we may delete, restrict or otherwise handle that information according to applicable law.

17. Cross-Border Transfer of Personal Data

Some service providers, cloud systems, technical-support teams or digital platforms used by Skygen may process or store personal data outside Malaysia.

Where personal data is transferred outside Malaysia, we will take reasonable steps to ensure that the transfer complies with applicable Malaysian law and that appropriate safeguards are implemented.

Safeguards may include:

1. Contractual data-protection obligations;
2. Security and confidentiality requirements;
3. Transfers to jurisdictions with comparable data-protection standards;
4. Your consent where required; or
5. Another transfer condition permitted under Malaysian law.

18. Data Security

Skygen will implement practical and reasonable administrative, physical and technical measures to protect personal data against:

1. Loss;
2. Misuse;
3. Unauthorised access;
4. Unauthorised disclosure;
5. Alteration;
6. Destruction;
7. Accidental loss; and
8. Other unlawful processing.

Security measures may include:

1. Access controls;
2. Authentication procedures;
3. Encryption where appropriate;
4. Network and system monitoring;
5. Secure payment-provider integration;
6. Data backup;
7. Staff confidentiality requirements;
8. Service-provider security obligations;
9. Incident-response procedures; and
10. Periodic review of security practices.

No internet transmission, electronic system or storage method can be guaranteed to be completely secure.

Customers are responsible for protecting their passwords, devices, accounts, e-tickets and QR codes.

19. Personal Data Breaches

If a personal data breach occurs or is reasonably suspected, Skygen will assess and respond to the incident according to its nature, scope, risks and applicable Malaysian law.

Where legally required, Skygen will notify:

1. The Personal Data Protection Commissioner; and
2. Affected data subjects.

A notification may include information about:

1. The nature of the breach;
2. The categories of information affected;
3. The likely consequences;
4. Measures taken or proposed;
5. Recommended protective actions; and
6. Contact details for further information.

Customers should notify Skygen promptly if they suspect unauthorised access to their account, e-ticket, QR code or personal data.

20. Accuracy of Personal Data

Customers must ensure that personal data provided to Skygen is accurate, complete, current and not misleading.

Customers should update their information promptly if it changes.

Skygen may request supporting information to verify a correction, prevent fraud or ensure that personal data is not disclosed to an unauthorised person.

21. Retention of Personal Data

Skygen will retain personal data only for as long as reasonably necessary to fulfil the purposes described in this Policy or to satisfy legal, accounting, audit, tax, insurance, security and dispute-resolution requirements.

Retention periods may depend on:

1. The category of personal data;
2. The purpose of processing;
3. The duration of the Customer relationship;
4. Legal and regulatory requirements;
5. Payment, refund and chargeback periods;
6. Potential or ongoing disputes;
7. Fraud-prevention and security needs; and
8. Event, insurance or incident-management requirements.

Transaction, accounting and financial records may generally be retained for at least seven (7) years where required or reasonably necessary.

When personal data is no longer required, we will take reasonable steps to securely delete, destroy, anonymise or permanently de-identify it.

22. Anonymised and Aggregated Information

We may convert personal data into aggregated, statistical or anonymised information that no longer identifies an individual.

Such information may be used for:

1. Attendance statistics;
2. Customer and motorcycle-brand analysis;
3. Event planning;
4. Business reporting;
5. Website and service improvement;
6. Sponsor and stakeholder reporting; and
7. Research and trend analysis.

We will not attempt to re-identify properly anonymised information except where permitted by law for security or verification purposes.

23. Your Rights

Subject to applicable Malaysian law, you may have the right to:

1. Be informed about the processing of your personal data;
2. Request confirmation of whether we hold your personal data;
3. Request access to your personal data;
4. Request correction of inaccurate, incomplete or outdated personal data;
5. Withdraw consent, where processing is based on consent;
6. Request restriction or cessation of certain processing;
7. Prevent processing likely to cause damage or distress;
8. Prevent processing for direct-marketing purposes;
9. Opt out of marketing communications;
10. Request information concerning relevant automated processing;
11. Request data portability where legally applicable; and
12. Submit a complaint to Skygen or the Personal Data Protection Commissioner.

These rights may be subject to legal exceptions, identity verification, permitted fees and reasonable administrative requirements.

24. Exercising Your Rights

To exercise a personal-data right, you must submit a request using the contact details provided in this Policy.

The request should include:

1. Full name;
2. Contact details;
3. Sufficient information to identify the relevant account or transaction;
4. Details of the request; and
5. Proof of identity or authority where reasonably required.

Skygen may refuse or limit a request where permitted by law, including where:

1. The requester's identity cannot be verified;
2. Disclosure would reveal another person's personal data;
3. The request is legally exempt;
4. The request is fraudulent, repetitive or unreasonable; or
5. Retention or processing is required by law.

Skygen will respond within the period required under applicable Malaysian law.

25. Withdrawal of Consent

You may withdraw consent by submitting a written request to Skygen.

Withdrawal of consent:

1. Will not affect processing already completed lawfully;
2. May not apply where processing is required or permitted by law;
3. May prevent Skygen from continuing to provide certain products or services;
4. May affect your account, order, admission pass, delivery or event participation; and
5. Will not prevent essential communications relating to an existing transaction or legal obligation.

26. Third-Party Websites and Services

The J2R website may contain links to:

1. Payment providers;
2. Social-media platforms;
3. Sponsors;
4. Partners;
5. Venue websites;
6. Courier tracking services; and
7. Other third-party websites or applications.

Skygen does not control third-party privacy practices and is not responsible for how independent third parties process personal data.

Customers should review the privacy notice of the relevant third party before providing personal data.

27. Corporate Transactions

If Skygen undergoes a merger, acquisition, restructuring, financing, sale of assets or transfer of business, personal data may be disclosed or transferred to relevant advisers, financiers, prospective purchasers or successor entities.

Any such disclosure or transfer will be subject to appropriate confidentiality, security and legal requirements.

28. Complaints

If you have concerns about how Skygen processes personal data, you should contact the Skygen Privacy Contact or Data Protection Officer using the information provided below.

We will review and respond to the complaint within a reasonable period.

You may also have the right to submit a complaint to the Personal Data Protection Commissioner of Malaysia.

29. Amendments to This Policy

Skygen may amend this Policy from time to time to reflect changes in:

1. Applicable laws and regulations;
2. Regulatory guidance;
3. Payment-gateway requirements;
4. Website technology;
5. Event arrangements;
6. Products and services;
7. Data-processing practices; or
8. Security requirements.

The updated Policy will be published on the official J2R website together with its latest effective or revision date.

Where a material change requires additional notice or consent, Skygen will take appropriate steps in accordance with applicable law.

30. Language

This Policy may be made available in English and Bahasa Malaysia.

If there is any inconsistency between the versions, the version expressly stated by Skygen to prevail will apply, subject to applicable Malaysian law.

31. Contact Information

For privacy enquiries, requests, consent withdrawals or complaints, please contact:

Privacy & Data Protection Officer
Skygen Network Sdn. Bhd.
Company Registration No.: 202601016004 (1678101-T)

Business Address:
1622, Level 16,
1, Jalan Stesen Sentral 5,
Kuala Lumpur Sentral,
50470 Kuala Lumpur,
Wilayah Persekutuan Kuala Lumpur, Malaysia.

Email: info.skygennetwork@gmail.com
Telephone/WhatsApp: +60 12-899 6687
Operating Hours: Monday–Friday, 9:00 a.m. – 6:00 p.m. (Malaysia Time)

When contacting us, please use the following subject line:
"Personal Data Request – Jiwa 2 Roda"