Last updated: 29 September 2026
Universal X Sdn. Bhd. ("Universal X", "we", "us") is the data controller responsible for the personal data described in this notice. This notice is issued under the Personal Data Protection Act 2010, as amended by the Personal Data Protection (Amendment) Act 2024. Privacy enquiries should be sent to hello@universalx.shop.
This notice explains how we collect, use, disclose and protect your personal data when you visit the Universal X Members' Portal (the "Portal"), register as a member, or use your member account.
When you register: your name, email address, phone number, country, the member who introduced you, and the package you choose.
When you pay for a package: the payment reference and the payment receipt you upload.
When you verify your identity and withdraw: your identity document (KYC), your bank name, account holder name and account number, and the details of each withdrawal request.
When you use your account: your package history, your position in the member team structure, your bonuses, your Cash Points and Product Points balances and transactions, and records of your consent to our agreements.
When you use the contact form: your name, email address and whatever you choose to write in your message.
Automatically, when you browse: your IP address, browser type, device type, the pages you view, the time of your visit, and sign-in records.
We do not ask you for health information, and you should not send it to us.
Directly from you, when you register, complete a form or contact us. From the member who introduced you, where they register you on your behalf. From the Universal X E-Mall, when you redeem products there with your points. Automatically from your device and browser when you visit.
To create and manage your member account. To verify your payments and credit your package. To calculate, record and pay bonuses under the compensation plan. To verify your identity and pay withdrawals to your bank account. To show your points balances to you and to the E-Mall so you can redeem products. To answer your enquiries and provide support. To keep records for accounting, tax, audit and dispute resolution. To operate and secure the Portal and to prevent fraud and abuse. To comply with our legal and regulatory obligations.
We do not sell your personal data. We do not use it for automated decision-making that produces legal effects for you.
Providing your personal data is voluntary. But if you do not provide it, we cannot open or manage a member account for you, verify your payments, pay you bonuses or process withdrawals.
We may disclose your personal data to the following classes of third party: our hosting and server-management providers, for running the Portal; the Universal X E-Mall and its service providers, for verifying your membership and points balances when you redeem; our email delivery provider, for sending account emails; Google, whose reCAPTCHA service protects our registration and sign-in forms and whose fonts are used on the Portal, which makes your IP address visible to Google; banks, for paying withdrawals; the member who introduced you and your upline, who can see limited information about you in their team view, such as your name and member ID; our professional advisers in legal, accounting and audit roles, where reasonably required; and regulators, law enforcement and courts, where we are required or permitted by law.
We do not disclose your personal data to anyone else without your consent, unless the Act permits or requires it.
The Portal is hosted on servers in Singapore, and some of our service providers are based outside Malaysia. Where we transfer your personal data outside Malaysia we do so in accordance with the Act's cross-border transfer requirements, and we take reasonable steps to satisfy ourselves that the recipient affords protections comparable to those under Malaysian law.
We take practical steps to protect personal data against loss, misuse, unauthorised access, alteration and disclosure, having regard to the nature of the data and the harm that would result. These include restricting access to those who need it and serving the Portal over an encrypted connection.
No system is completely secure. If a personal data breach occurs, we will notify the Personal Data Protection Commissioner as soon as practicable, and we will notify you without unnecessary delay where the breach is likely to cause you significant harm.
We keep personal data only for as long as it is needed for the purpose it was collected for, and longer only where the law requires it, for example where accounting or tax rules set a minimum retention period for transaction records. Once personal data is no longer needed, we delete it or permanently anonymise it.
Under the Act you have the right to access the personal data we hold about you and be told how it is being processed; to correct personal data that is inaccurate, incomplete, misleading or out of date; to withdraw your consent to our processing of your personal data; to limit processing, including asking us to stop processing your data for direct marketing; to ask us to transmit your personal data directly to another data controller, where this is technically feasible and the formats are compatible; and to complain to us, and to the Personal Data Protection Commissioner.
Email hello@universalx.shop with your request. We may ask you to confirm your identity before we act, so that we do not disclose your data to someone else. We will respond within the period required by the Act. A fee may apply to an access request, as the Act permits. If we cannot comply with a request, we will tell you why.
If you are not satisfied with our response you may complain to the Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi), Ministry of Digital, Malaysia, at www.pdp.gov.my.
The Portal uses only cookies that are necessary for it to function and to keep your session secure: a session cookie that keeps you signed in, and a security token that protects forms. We do not use analytics cookies, advertising cookies or tracking pixels on the Portal. If that changes, we will update this notice and ask for your consent where consent is required.
The Portal is intended for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.
We may update this notice from time to time. The current version will always be published on this page with the date it was last updated. Where a change is significant we will take reasonable steps to bring it to your attention.
Universal X Sdn. Bhd. Email hello@universalx.shop
