Privacy Notice

1. Personal Data We Collect

Depending on your relationship and dealings with us, we may collect and process identification data, including your name, salutation, signature, National Registration Identity Card number, passport number, date of birth, age, nationality and copies of identification documents where the collection of a copy is necessary and permitted.

We may collect contact and relationship data, including your residential, correspondence and billing addresses, email address, telephone number, emergency contact, preferred language, communication preferences, marital status, household information, co-purchaser details and information about an authorised representative, attorney, nominee or next of kin.

For enquiries, bookings and property transactions, we may collect your project and unit preferences, registration-of-interest information, booking details, purchaser profile, Sale and Purchase Agreement information, financing status, bank or loan information, payment instructions, transaction history, receipts, refund details, tax information and records relating to vacant possession, key handover, defects, warranties, renovations, access and facilities.

Where necessary for a stated purpose, we may collect employment, occupation, employer, income, financing eligibility and supporting financial information. We will collect only the information reasonably required for the relevant transaction or service and will not request sensitive financial credentials such as online-banking passwords or personal identification numbers.

We may also process correspondence, enquiries, complaints, survey responses, service and defect records, call or meeting recordings where notice has been given, photographs, event images, CCTV footage, visitor logs, vehicle registration numbers, access-card records and other security or premises-related information.

When you use our website or mobile application, we may collect device and technical data, including Internet Protocol address, device identifier, operating system, browser type, application version, log-in and authentication records, cookie identifiers, diagnostic logs, pages or functions used, approximate location where enabled, and interactions with electronic communications.

We will process sensitive personal data, including health information, religious belief, alleged offences, biometric data or other legally protected categories, only where it is necessary, permitted by law and supported by the required explicit consent or another lawful condition. We will not collect personal data that is excessive or unrelated to the stated purpose.

2. Purposes for Which We Process Personal Data

We may process personal data to respond to enquiries; register interest in our developments; arrange appointments, site visits, sales-gallery visits and events; personalise communications; authenticate identity; and maintain accurate customer and stakeholder records.

We may process personal data to assess eligibility, perform identity, duplicate-purchaser, sanctions, fraud, risk, credit or conflict checks where applicable; administer property reservations and bookings; process payments and refunds; facilitate financing; prepare, execute and administer contractual, financing and legal documentation; issue invoices, statements and receipts; and communicate with banks, lawyers and other parties involved in a transaction.

We may process personal data to provide project, construction and transaction updates; administer progressive billing; coordinate inspections; deliver vacant possession; arrange key or access-card handover; manage defects, warranties and after-sales services; administer property or facility management, security, visitor access, community services, utilities and customer-support matters; and maintain records of communications and decisions.

We may process personal data to operate and secure our websites, applications, systems, sales galleries, project sites and premises; prevent unauthorised access; investigate suspected misconduct or fraud; maintain business continuity; conduct quality assurance; perform analytics, research, service improvement and customer-satisfaction surveys; and plan or administer our projects and business operations.

We may process personal data to appoint and manage vendors, agents, consultants and contractors; conduct due diligence; administer tenders, contracts, work access and payments; manage safety and security; and monitor compliance with contractual and legal requirements.

We may process personal data to comply with obligations relating to housing development, land, planning, tax, accounting, anti-money-laundering, company, court, regulatory and law-enforcement matters; respond to lawful requests; maintain statutory and business records; establish, exercise or defend legal rights and claims; and support an actual or proposed corporate transaction, joint venture, asset transfer, financing, restructuring or project transfer.

Where permitted, we may process your contact details and preferences to send information about JLG projects, launches, events, promotions, offers and related services. We will not use personal data for a materially incompatible new purpose without providing appropriate notice and obtaining consent where required.

3. Sources of Personal Data

We generally collect personal data directly from you when you complete a form, register an account, use our website or mobile application, communicate with us, visit a sales gallery, show unit, project site or premises, attend an event, make a booking or payment, enter into an agreement, submit a complaint or service request, or otherwise deal with us.

We may also receive personal data from a co-purchaser, family member, employer, emergency contact, attorney or other authorised representative; an appointed property agent, introducer or marketing partner; a bank, financier, lawyer, valuer, insurer, auditor, identity or credit-screening provider; an architect, engineer, contractor, property or facility manager, security provider or project consultant; a utility or telecommunications provider; another company within the JLG group; a joint-venture partner or landowner; a public register, government authority or regulator; and other lawful sources.

We collect technical information through cookies, software development kits, pixels, analytics tools, mobile-application permissions, server logs, CCTV, access-control systems and similar technologies. Where we obtain personal data from a third party, we will process it only for a lawful and relevant purpose and will take reasonable steps to provide notice where required.

If you provide personal data about another individual, you confirm that you are authorised to do so, that the information is accurate, and that you have provided that individual with this Privacy Notice or otherwise informed the individual about the processing described in it. You must not disclose another person’s personal data to us without the required authority or consent.

4. Disclosure of Personal Data

We may disclose personal data, on a need-to-know basis and for the purposes described in this Privacy Notice, to companies within the JLG group; appointed sales and marketing agents; banks, financiers, payment providers, lawyers, valuers, insurers, auditors, tax advisers and other professional advisers; architects, engineers, contractors, defect-management teams, project managers and consultants; property and facility managers; security, CCTV and access-control providers; and utility and telecommunications providers.

We may also disclose personal data to providers of hosting, cloud, information technology, cybersecurity, customer-relationship management, document management, payment, communication, messaging, analytics, survey, event, printing, delivery, call-centre and customer-support services; joint-venture partners, landowners, project stakeholders, funders and prospective or actual purchasers or transferees of a project, business or asset; courts, tribunals, regulators, government departments, local authorities, law-enforcement bodies and other persons authorised by law; and any person whom you authorise.

We will limit disclosures to information reasonably required for the relevant purpose and will take reasonable steps to ensure that personal data is handled confidentially and securely. Certain recipients, such as banks, lawyers, government authorities and joint-venture partners, may act as independent data controllers and will process personal data under their own legal obligations and privacy notices.

5. Transfer of Personal Data Outside Malaysia

JLG primarily processes personal data in Malaysia. However, personal data may be stored, backed up, accessed, supported or otherwise processed outside Malaysia when we use regional or global cloud, software, communications, analytics, security, professional or other service providers, or when a relevant company, recipient or support team is located outside Malaysia.

Before transferring personal data outside Malaysia, we will identify and document an applicable condition permitted under Malaysian law and will take all reasonable precautions and exercise due diligence to ensure that the personal data will not be processed in a manner that would contravene Malaysian data-protection requirements.

Depending on the transfer, safeguards may include due diligence, data-minimisation, access restrictions, security requirements, contractual protection, confidentiality obligations, transfer-risk assessment, monitoring and requirements governing sub-processors, breach notification, retention and deletion.

Information about material transfer destinations, recipient categories and relevant safeguards may be obtained by contacting us using the details in Section 20. Where consent is the applicable condition for a transfer, we will provide the information required for an informed decision and obtain the necessary consent before the transfer.

6. Direct Marketing and Promotional Communications

With your consent where required, or as otherwise permitted by law, JLG and the JLG group companies identified at the point of collection may contact you about property projects, launches, previews, events, promotions, offers, surveys and related products or services through email, SMS, telephone calls, messaging applications, mobile-application notifications, social-media or advertising platforms and physical mail.

Marketing consent is optional and is separate from communications that are necessary to respond to an enquiry, administer a booking or contract, process a payment, provide project or construction updates, manage vacant possession, defects, facilities, security or customer service, or comply with legal obligations. Declining marketing will not prevent you from receiving such service or transactional communications.

You may withdraw marketing consent or change your marketing preferences at any time by using the unsubscribe or preference function in the relevant communication, changing your application settings where available, or contacting us using the details in Section 20. We will implement your request within a reasonable period and maintain a suppression record to prevent further marketing through the selected channel, although you may receive communications already in progress before the request is completed.

7. Your Responsibility to Provide Accurate Data

You are responsible for ensuring that personal data supplied to us is accurate, complete, current and not misleading. You should promptly notify us of any change to your contact details, identity information, authorised representative, ownership, financing, payment or other information relevant to your dealings with JLG.

Fields marked as mandatory, or information identified as required at the point of collection, must be provided so that we can perform the relevant purpose. If you do not provide required personal data, we may be unable to respond to an enquiry, verify identity, assess eligibility, process a booking, payment, financing or purchase, prepare or administer an agreement, provide project updates, arrange handover or premises access, resolve a defect or complaint, supply a requested service or comply with a legal obligation.

Where information is optional, we will identify it as such where practicable. You may choose not to provide optional information, but this may limit personalisation or certain non-essential features.

8. Right of Access

Subject to the Personal Data Protection Act 2010 and applicable exceptions, you may request access to personal data that JLG holds about you and information about how it has been processed. You may submit an access request using the contact details in Section 20 and should state “Personal Data Access Request” in the subject line.

To protect personal data, we may require sufficient information to verify your identity and authority, identify the relevant project, account, transaction, system or time period, and clarify the scope of the request. If a representative submits the request, we may require written authorisation and proof of the representative’s identity.

We will handle a valid request within the period required by applicable law. A fee permitted by law may be charged, and we will inform you before processing the request where a fee applies. We may refuse or limit access where permitted or required by law, including where disclosure would reveal another person’s personal data, affect legal privilege or confidentiality, or fall within a statutory exception. Where a request is refused or limited, we will provide the reason to the extent required by law and explain the available escalation or complaint route.

9. Right to Correction

You may request correction of personal data held by JLG if it is inaccurate, incomplete, misleading or not current. A correction request may be submitted using the contact details in Section 20 and should identify the information to be corrected, the proposed correction and any supporting evidence reasonably required to verify the change.

We may verify your identity and the accuracy of the proposed correction before amending our records. We will notify you of the outcome within the period required by applicable law and, where required or reasonably practicable, communicate an accepted correction to relevant recipients or service providers to whom the inaccurate information was disclosed.

If we do not agree that a correction is justified, we will explain the reason to the extent required by law and inform you of any available escalation or complaint route. You may also update certain information directly through your account or mobile-application settings where that function is available.

10. Right to Data Portability

Where the right to data portability applies under Malaysian law, you may request JLG to transmit personal data relating to you that is held under our control to another data controller of your choice. The request may be made using the contact details in Section 20 and should identify the data requested, the receiving data controller and the authorised secure destination or method of transfer.

We will verify your identity, authority and the receiving party before carrying out a transfer. A portability request is subject to the statutory requirements, technical feasibility, compatibility of data formats, security considerations, the rights of other persons and any lawful limitation or exception. The right does not require us to transmit information that we are not legally required or technically able to provide, create new information, disclose another person’s data, compromise security or reveal legally privileged or confidential material.

If we cannot fulfil all or part of a request, we will explain the reason to the extent required by law and, where appropriate, discuss a secure and technically feasible alternative.

11. Withdrawal of Consent and Prevention of Processing

Where JLG relies on your consent to process personal data, you may withdraw that consent by contacting us using the details in Section 20 or by using a preference mechanism that we provide. Your request should identify the processing activity or communication channel to which the withdrawal relates.

Withdrawal does not affect processing lawfully carried out before the withdrawal takes effect. It also does not prevent processing that is necessary or permitted without consent, including processing required to perform a contract, comply with law, respond to lawful requests, protect security, maintain required records or establish, exercise or defend legal rights.

We will explain any reasonably foreseeable consequence of withdrawal. Depending on the information and service involved, withdrawal may mean that we cannot continue an optional feature, personalise a service, send marketing, process a pending request or provide a service that depends on the relevant consent. We will implement a valid withdrawal within a reasonable period and communicate it to relevant processors where necessary.

Subject to the Act, you may require us to cease or not begin processing for direct marketing, and may give written notice to prevent processing that is likely to cause substantial damage or substantial distress to you or another person where the statutory conditions are satisfied. We will consider such a notice and respond in accordance with applicable law.

12. Retention of Personal Data

JLG retains personal data only for as long as it is necessary to fulfil the purpose for which it was collected and any compatible purpose, and to meet contractual, project, warranty, defect-liability, accounting, tax, audit, statutory, regulatory, dispute, limitation-period, legal-hold, fraud-prevention, security and business-continuity requirements.

Retention periods vary according to the nature and sensitivity of the data, the purpose of processing, the project or contractual lifecycle, the risk of harm from unauthorised use or disclosure, applicable legal requirements and whether the purpose can be achieved through anonymisation. Enquiry and marketing records, purchaser and contractual files, financing and payment records, CCTV and access logs, website or application logs, complaint files and vendor records may therefore be retained for different periods.

When personal data is no longer required, we will take reasonable steps to securely delete, destroy or irreversibly anonymise it. Deletion from backup systems may occur according to the applicable backup and recovery cycle, provided that access remains restricted and the data is not restored for ordinary business use. Personal data subject to a legal hold, investigation, dispute or regulatory requirement may be retained until that matter is concluded.

13. Personal Data Breach Management

JLG maintains procedures to identify, report, contain, investigate, assess, remediate and document suspected or confirmed personal data breaches. Our personnel and relevant service providers are required to escalate suspected incidents promptly through established reporting channels.

Where a breach is notifiable under Malaysian law, JLG will notify the Personal Data Protection Commissioner within the applicable statutory period and will provide the required information. Where the breach causes or is likely to cause significant harm to affected individuals, JLG will notify those individuals in the manner and within the period required by law, unless an applicable exception applies.

Affected-person communications may describe the nature of the breach, the categories of data concerned, likely consequences, measures taken or proposed, steps the individual may take to reduce harm and a contact point for further information. The absence of an individual notification does not necessarily mean that no incident occurred; notification depends on the applicable legal threshold and assessment.

If you become aware of suspected unauthorised access, disclosure, loss, alteration or misuse involving JLG personal data, please contact Data Protection Officer promptly and provide the relevant facts without including additional sensitive information unless requested through a secure channel.

14. Changes to and Availability of This Privacy Notice

This Privacy Notice takes effect on 1 October 2026 and was last updated on 1 October 2026. It replaces the previous privacy notice applicable to the processing described here from the effective date, but it does not affect processing lawfully carried out under an earlier notice or consent.

We may update this Privacy Notice when our projects, business operations, systems, technologies, service providers, recipients, transfer arrangements, purposes or legal obligations change. The current version will be made available through https://medoraone.jland.com.my, the relevant mobile application and appropriate collection points. We may also communicate material changes through email, application notification, project communication or another appropriate channel.

JLG will retain prior versions for governance and audit purposes. This Privacy Notice should be available in Bahasa Malaysia and English, and both versions should be reviewed for consistency. If there is a discrepancy, the English version shall prevail to the extent of the discrepancy or inconsistency. Project-specific or collection-point notices may supplement this Privacy Notice and will identify any additional processing that applies.

15. Data Processors and Service Providers

JLG engages service providers to process personal data on our behalf for functions such as website and application hosting, cloud storage, customer-relationship management, document management, payment processing, electronic communications, messaging, analytics, printing and delivery, cybersecurity, CCTV and access control, facilities management, defect management, customer support, surveys and professional services.

Where a service provider acts as our data processor, it may process personal data only for the contracted purpose and in accordance with our documented instructions, except where law requires otherwise. We require appropriate contractual and operational measures concerning confidentiality, security, access control, personnel obligations, data-breach reporting, assistance with individual rights, retention and deletion, return of data, sub-processor engagement, cross-border transfers and assurance or audit rights, proportionate to the nature and risk of the processing.

We conduct reasonable due diligence and oversight of processors and require them to protect personal data in accordance with applicable Malaysian requirements. A third party that independently determines why and how it processes personal data, such as a bank, lawyer, insurer, government authority or certain joint-venture partner, acts as an independent data controller rather than as JLG’s processor and is responsible for its own processing.

16. Security Safeguards

JLG implements reasonable and practical organisational, physical and technical safeguards appropriate to the nature of the personal data, the purpose of processing, the harm that may result from a breach and the available security measures. These safeguards may include role-based access controls, authentication, encryption or other protection in transit and at rest where appropriate, secure configuration, logging and monitoring, malware protection, vulnerability and patch management, network and endpoint security, backup and recovery, secure disposal, physical security and business-continuity and incident-response arrangements.

Access to personal data is limited to personnel, agents and service providers who require it for an authorised purpose and who are subject to confidentiality and security obligations. We provide relevant training and awareness, review access, assess selected vendors and take reasonable steps to address identified risk.

No method of electronic transmission, storage or security control can guarantee absolute security. You should protect your account credentials, use a strong and unique password, keep authentication codes confidential, sign out of shared devices and notify us promptly of suspected unauthorised use. JLG will never ask you to disclose your account password or online-banking password by email, telephone or messaging application.

17. Cookies, Analytics and Mobile Application Technologies

Our websites and mobile applications may use cookies, pixels, local storage, software development kits and similar technologies. Strictly necessary technologies support core functions such as security, authentication, load balancing, preference storage and transaction processing. Functional technologies remember choices and enable enhanced features. Analytics technologies help us understand usage, performance and errors. Advertising technologies may measure campaigns, limit repeated advertisements or support relevant marketing where permitted.

Where consent is required, non-essential technologies will not be activated until you make a choice. You may manage cookies through your device application settings. Disabling a necessary technology may cause parts of the application not to function properly.

A mobile application may request device permissions, such as notifications, camera, files, approximate or precise location, contacts or biometric authentication, only where required for a disclosed feature. You may manage permissions through your device settings, although disabling a permission may prevent that feature from operating. JLG should publish the actual list of mobile software development kits and permissions after completing its technical inventory.

18. Children, Minors and Authorised Representatives

JLG’s property-purchase services and contractual transactions are intended for adults who have legal capacity to enter into the relevant transaction. We do not knowingly solicit personal data directly from children through general marketing or registration forms unless the collection is necessary for a specific and disclosed service or activity.

We may need limited personal data about a child or minor for legitimate property-related purposes, such as recording an occupant, dependant or beneficiary, administering community or family events, processing premises access, responding to an emergency, or complying with law. In such cases, we will collect only data reasonably necessary for the stated purpose and will obtain consent or authority from a parent, legal guardian or other authorised person where required.

A parent or legal guardian may contact us to request access to or correction of a minor’s personal data, subject to verification of identity, guardianship and applicable law. If you believe that a child has provided personal data to us without the required authority, please contact us so that we can investigate and take appropriate action.

Where an agent, attorney, representative, executor, administrator or other person acts on behalf of an individual, JLG may require written authority, a power of attorney, court or estate documents and proof of identity before accepting instructions or disclosing personal data.

19. Complaints and Regulatory Contact

If you have a concern or complaint about JLG’s processing of personal data, please contact the privacy function using the details in Section 20 and state “Privacy Complaint” in the subject line. Please provide your name and contact details, the relevant project, account, transaction or service, a clear description of the concern, relevant dates and copies of supporting documents that do not contain unnecessary third-party personal data.

We will acknowledge, assess and investigate the complaint in accordance with our internal procedure, may contact you for clarification or identity verification, and will communicate the outcome and any remedial action within a reasonable period or the period required by law. Complex matters may require additional time; if so, we will provide an appropriate progress update. JLG will record complaints, review root causes and take proportionate corrective or preventive action. We will not retaliate against a person for raising a privacy concern in good faith.

You may also lodge a complaint with the Personal Data Protection Commissioner of Malaysia. Current information and complaint channels are available through the official Personal Data Protection Department website at https://www.pdp.gov.my/. You should verify the current regulatory contact details before submitting a complaint, as government addresses and procedures may change.

20. Privacy Contact

JLG will assess whether each relevant data controller or data processor is required to appoint a Data Protection Officer under applicable Malaysian laws and regulatory requirements. Where such an appointment is required, JLG will ensure that the Data Protection Officer is accessible and possesses the appropriate expertise, resources and independence to perform the role. JLG will also notify or register the appointment and relevant contact information with the appropriate regulatory authority, where required by law.

To protect your personal data and the personal data of other individuals, we may verify your identity and authority before processing a request, acting on your instructions or disclosing any personal data. If you are submitting a request on behalf of another individual, we may require written authorisation and appropriate supporting documentation. Please do not submit passwords, banking credentials or unnecessary copies of identification documents through unsecured communication channels.

You may contact us or submit any question, request or complaint regarding this Privacy Notice or JLG’s processing of your personal data or sensitive personal data using the following details. To help us understand and respond to your matter, please provide your name, contact details, relationship with JLG, the relevant project or service, and sufficient information describing your question, request or complaint: