5.1 Data Controller

Legal Name Heligenix Marketing Sdn. Bhd.

Company No. 202601022332 (1684429-H)

Registered Address 54 Jalan Horizon Perdana 1, Horizon Hills Commercial Centre,

79100 Iskandar Puteri, Johor, Malaysia

Privacy Contact legal@heligenix.com

Website http://www.peptivex.co

5.2 Personal Data We Collect

We collect the following categories of personal data:

5.2.1 Registration Data

• Full legal name and professional title/designation;

• Professional registration number (e.g. MMC number, institutional ID);

• Institutional affiliation and employer/institution name;

• Email address;

• Contact telephone number (including WhatsApp number where provided); and

• Age confirmation (date of birth or age declaration).

5.2.2 Transaction Data

• Order history, Products purchased, quantities, and amounts paid;

• Shipping address(es);

• Research Verification declarations (per-order checkout declarations); and

• Payment transaction references (note: full card details are processed directly by our

payment processor and are not stored by us).

5.2.3 Technical Data

• IP address, browser type, device type, and operating system;

• Session data and page interaction logs;

• Cookie identifiers (see Section 6 — Cookie Policy); and

• Referring URL and navigation path within the Website.

5.2.4 Communications Data

• Records of your email correspondence and WhatsApp communications with us;

• Support ticket content and resolution records; and

• Marketing communication preferences and opt-in/opt-out records.

5.3 Purposes of Processing and Legal Basis

Processing Purpose – Legal Basis (MY PDPA / SG PDPA)

To process and fulfil your Orders – Contract performance

To verify Member eligibility and maintain compliance records – Legal obligation / legitimate interests

To process payments securely – Contract performance

To send Order confirmation, dispatch, and delivery notifications – Contract performance

To respond to enquiries and provide customer support – Contract performance / legitimate interests

To send marketing emails and WhatsApp messages (with consent) – Consent (withdrawable at any time)

To maintain regulatory compliance records for 7 years – Legal obligation

To prevent fraud, misuse, and unauthorised access – Legitimate interests

To improve the Website and our services – Legitimate interests

To comply with legal proceedings, regulatory requests, or court orders – Legal obligation

5.4 Marketing Communications

With your explicit consent (captured at registration), we may contact you via email and/or

WhatsApp with:

• New product announcements and catalogue updates;

• Research library content and educational summaries; and

• Promotional offers exclusive to Peptivex Members.

You may withdraw your consent to marketing communications at any time by:

• Clicking the unsubscribe link in any marketing email;

• Replying STOP to any WhatsApp marketing message; or

• Emailing contact@heligenix.co with the subject line “Marketing Opt-Out”.

Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal, and

you will continue to receive transactional communications (order confirmations, dispatch

notices, support responses) which are not marketing.

5.5 Data Sharing & Disclosure

We do not sell, rent, or trade your personal data to any third party for commercial purposes.

We may disclose your data to:

• Payment processors and payment gateway providers, for the purpose of processing

transactions (they are bound by PCI DSS and their own privacy obligations);

• Logistics and courier partners, for the purpose of fulfilling and tracking your delivery;

• IT service providers and cloud hosting partners, who process data on our behalf

under data processing agreements;

• WhatsApp (Meta Platforms Inc.), as our authorised communication channel, where

you have opted in to WhatsApp marketing; and

• Regulatory authorities, courts, or law enforcement agencies, where required by

applicable law, court order, or to protect our legal rights.

All third-party processors are contractually required to process personal data only as

instructed by us and in accordance with applicable data protection law.

5.6 Cross-Border Data Transfers

Our website and infrastructure may involve the transfer of personal data to countries outside Malaysia and Singapore. Where such transfers occur, we ensure that appropriate
safeguards are in place in accordance with MY PDPA Section 129 and the SG PDPA’s data transfer provisions, including contractual clauses or reliance on transfer frameworks. Singapore customers specifically: We note that as a Malaysian entity selling to Singapore residents, the SG PDPA’s provisions relating to organisations outside Singapore that collect or process personal data of Singapore residents in connection with the supply of goods or services to Singapore residents will apply to our processing activities in respect of Singapore
Members.

5.7 Data Retention

We retain your personal data for the following periods:

Registration and eligibility records – Duration of membership + 7 years

Order and transaction records – 7 years from date of transaction (for tax and legal compliance)

Research Verification declarations – 7 years from date of Order

Marketing communications records – Until you withdraw consent, then promptly deleted

Technical/log data – 12 months rolling

Support communications – 3 years from resolution

5.8 Your Rights

Subject to applicable law and our legitimate interests in maintaining compliance records, you

have the following rights:

• Right of access — to request a copy of the personal data we hold about you;

• Right of correction — to request correction of inaccurate or incomplete data;

• Right to withdraw consent — for marketing processing (see Clause 5.4);

• Right to restrict processing — in certain circumstances defined by law; and

• Right to lodge a complaint — with the Personal Data Protection Commissioner

(Malaysia) or the Personal Data Protection Commission (Singapore).

To exercise any of the above rights, please contact us at legal@heligenix.com. We will

respond within 21 days of receiving a verifiable request.

5.9 Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration, including SSL/TLS
encryption of all data in transit, access controls limiting data access to authorised personnel, and secure payment processing via PCI DSS-compliant payment gateway partners. No payment card data is stored on our servers or systems.

5.10 Children

Our Website is not directed at persons under 21 years of age. We do not knowingly collect personal data from persons under 21. If we become aware that personal data has been collected from a person under 21 without appropriate verification, we will take steps to delete such data promptly.

5.11 Updates to This Policy

We may update this Privacy Policy from time to time. The effective date at the top of this document indicates when it was last revised. For material changes, we will notify Members by email. Continued use of the Website following notification constitutes acceptance.