Privacy Policy

Last updated: [DATE]. This is a starting template — have it reviewed by a Malaysian lawyer familiar with the Personal Data Protection Act 2010 (PDPA) before relying on it for real customers, then edit this page directly in /admin.

1. What this policy covers

This Privacy Policy explains how Angkut Digital Enterprise, trading as Utuh, collects, uses, and protects personal data through the Utuh Service, in line with Malaysia's Personal Data Protection Act 2010 (PDPA).

2. Data we collect

Account data: name, company name, email, phone number, for the account owner and any invited team members. Driver data: name and phone number, used to generate a driver access link; a driver's precise location is only captured, once, if they use the SOS/panic button, in order to notify the emergency contact and assist a response. Operational data: vehicle records, compliance documents, inspection checklists, maintenance logs, receipts, and photos submitted by drivers or staff. We deliberately do not collect clinical health information or the contents of criminal record checks — only whether a check was done and its expiry, where relevant to a compliance record.

3. How we use data

To provide the Service (dashboards, reminders, checklists), to send compliance-deadline and safety notifications, to respond to support requests, and to improve the product. We do not sell personal data.

4. Storage and retention

Data is stored with our infrastructure providers (currently Supabase for database records and Cloudflare for photo/document storage). Compliance documents are retained for as long as the account is active. Checklist and incident photos are retained on a tiered schedule tied to your plan; financial records (receipts) are retained for the period required under Malaysian law. [Confirm exact retention periods here before publishing.]

5. Sharing

We share data only with service providers who help us run the Service (hosting, email delivery, SMS delivery, payment processing), each bound by confidentiality obligations, and where required by law.

6. Your rights

Under the PDPA, you may request access to, correction of, or (subject to legal retention requirements) deletion of your personal data. Account owners can export or delete their account data directly from Settings. Contact us at [CONTACT EMAIL] for any other request.

7. Security

We use industry-standard measures (encrypted connections, access controls, row-level database security) to protect data, but no system is completely secure.

8. Changes to this policy

We may update this policy from time to time; material changes will be notified to account owners.

9. Contact

Questions about this policy: [CONTACT EMAIL].