Personal Data Protection Act (PDPA) Notice

1. Introduction

This Personal Data Protection Act (PDPA) Notice ("Notice") is issued in accordance with the Personal Data Protection Act 2010 of Malaysia ("PDPA"). This Notice explains how SemutWay ("we," "our," or "us") collects, uses, discloses, and protects your personal data.

By using our services, you consent to the collection, use, and disclosure of your personal data as described in this Notice.

2. Personal Data We Collect

We may collect the following categories of personal data:

2.1 Personal Information

• Name, identification number (NRIC/Passport)
• Email address and phone number
• Date of birth and gender
• Mailing address

2.2 Account Information

• Username and password
• Profile information and preferences
• Account verification documents

2.3 Service-Specific Information

• For Drivers: License number, vehicle registration details, vehicle type and specifications
• For Agents: Business name, business registration number (SSM), business address, business phone
• For Tour Guides: Tourist guide license number, license certificate, languages spoken

2.4 Transaction Information

• Booking and reservation details
• Payment and billing information
• Transaction history

2.5 Technical Information

• Device information and identifiers
• IP address and location data
• Browser type and version
• App usage and interaction data

3. Purpose of Collection

We collect and process your personal data for the following purposes:

• To provide, maintain, and improve our transportation and tour guide booking services
• To process and manage your bookings, reservations, and transactions
• To verify your identity and account information
• To communicate with you regarding your account, bookings, and our services
• To send you service updates, notifications, and important information
• To process payments and manage billing
• To comply with legal and regulatory requirements
• To detect, prevent, and address fraud, security, or technical issues
• To conduct research, analytics, and improve our services
• To send you marketing communications (with your consent)

4. Disclosure of Personal Data

We may disclose your personal data to:

• Service Providers: Third-party service providers who assist us in operating our platform, processing payments, or providing services
• Business Partners: Partners who provide services related to transportation or tourism
• Other Users: Limited information (name, contact details) may be shared with drivers, agents, or tour guides to facilitate bookings
• Legal Authorities: When required by law, court order, or government regulation
• Business Transfers: In connection with any merger, acquisition, or sale of assets
• With Your Consent: When you explicitly authorize us to share your information

5. Your Rights Under PDPA

You have the following rights regarding your personal data:

• Right of Access: Request access to your personal data and information about how it is processed
• Right to Correction: Request correction of inaccurate or incomplete personal data
• Right to Withdraw Consent: Withdraw your consent for processing personal data (subject to legal and contractual restrictions)
• Right to Prevent Processing: Object to or restrict processing of your personal data in certain circumstances
• Right to Data Portability: Request transfer of your personal data to another service provider
• Right to Complain: Lodge a complaint with the Personal Data Protection Commissioner if you believe your rights have been violated

6. Data Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Secure servers and databases
• Access controls and authentication mechanisms
• Regular security audits and assessments
• Employee training on data protection

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security.

7. Retention of Personal Data

We will retain your personal data only for as long as necessary to fulfill the purposes outlined in this Notice, unless a longer retention period is required or permitted by law. When personal data is no longer needed, we will securely delete or anonymize it.

8. Transfer of Personal Data

Your personal data may be transferred to and stored in servers located outside Malaysia. By using our services, you consent to such transfer. We will ensure that appropriate safeguards are in place to protect your personal data in accordance with the PDPA.

9. Changes to This Notice

We may update this Notice from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the updated Notice on our website and updating the "Last updated" date. Your continued use of our services after such changes constitutes acceptance of the updated Notice.

10. Contact Us

If you have any questions, concerns, or wish to exercise your rights under the PDPA regarding your personal data, please contact us:

11. Consent

By registering an account or using our services, you acknowledge that you have read and understood this PDPA Notice and consent to the collection, use, and disclosure of your personal data as described herein.