Privacy Notice

1. Who is responsible for your data

SmartDrive is used by car rental companies ("Operators") to run their rentals. Who is responsible depends on whose data it is:

• Operator accounts: we are responsible for the data of Operator owners and staff who sign up for and use SmartDrive.
• Renters and customers: the Operator you rent from is responsible for your data. They enter it into SmartDrive, and we store and process it for them, on their instructions, to provide the service. Questions about a rental should go to that Operator first.
• Customer app accounts: when you join an Operator's customer app, we keep your app account (name, phone number and how you sign in) so you can sign in. Your bookings, points and rental records with that Operator belong to that Operator.

2. What we collect

• Operator owners and staff: name, mobile number, email, Access ID, sign-in details (PIN, passkey or Google account), company name and details, plan and activation records.
• Renters, stored for Operators: name, IC or passport number, driving licence details, phone number, address, emergency contact, signed agreements and signatures, pickup and return photos and readings, booking and payment records the Operator enters, and receipt images the Operator uploads.
• Customer app users: name, phone number, passkey (the public part only; your fingerprint or face never leaves your phone), Google email if you sign in with Google, booking requests, points and ratings.
• Technical data: sign-in sessions saved in your browser, and basic server logs (such as time and IP address) kept by our hosting providers for security.

3. Why we use it

• To provide SmartDrive: bookings, agreements and signing links, pickup and return records, agent commission records, the customer app and rewards.
• To create and secure accounts, and to stop misuse.
• To manage Free Access and Full Access, including activation and renewal.
• To give support when you ask for it, and to tell you about changes to the service.
• To meet legal duties.

We do not sell personal data. We do not use renters' data for our own marketing, and we do not use one Operator's customer data for another Operator.

4. Who can see it

• Each Operator's data is only visible to that Operator's own logins. Other Operators cannot see it.
• SmartDrive support sees Operator company details, plan and usage counts, not customers, bookings or prices.
• Service providers that run SmartDrive for us: Supabase (database and sign-in, hosted in Singapore), Vercel (website hosting) and Google (Google sign-in, and the Gemini service that reads the numbers on odometer photos and payment receipts when this feature is used).
• Authorities, when the law requires it.

5. Data stored outside Malaysia

Our database is hosted in Singapore, and our service providers may process data in other countries. We use providers that protect data to a standard comparable to the PDPA, under their contractual terms.

6. How long we keep it

We keep Operator account data while the account is open. Rental records stay as long as the Operator keeps them, because Operators may need them for disputes, tax and legal reasons. When an Operator closes their account and asks us to delete their data, we delete it within 30 days, except what the law requires us to keep. Pickup and return photos may be removed automatically after a set time.

7. How we protect it

Data is sent over encrypted connections. Database rules keep each Operator's data apart. Signing links expire, identity documents are kept in private storage, and PINs are stored as hashes, not as plain text. If a data breach is likely to harm you, we will notify the Personal Data Protection Commissioner and, where required, the people affected, as the PDPA requires.

8. Your rights

• Ask for a copy of your personal data, and ask us to correct it.
• Withdraw consent or ask us to limit how we use your data. We may then be unable to provide some or all of the service.
• Ask for your data to be moved to another service, where the PDPA provides for this.
• Complain to the Personal Data Protection Commissioner.

Renters should contact the Operator they rented from first. We will help that Operator answer your request. We may charge the fee the PDPA allows for a copy of your data.

9. Is giving your data required?

To open an Operator account, the name, mobile number and sign-in details are required. Operators decide which renter details they need for a rental agreement. Without them, the Operator may not be able to rent you a car.

10. Cookies and browser storage

We use your browser's storage to keep you signed in and to remember simple settings. We do not use advertising or tracking cookies right now. If we add them, we will update this notice first.

11. Changes to this notice

We will post any changes on this page and update the date at the top. If a change is important, we will also tell Operators in the app.

12. Contact us

For questions, requests or complaints about personal data:

Company

ECA Group Travel & Tours Sdn Bhd

Personal Data Protection Commissioner registration no.

TA-SB11122024-09648