Privacy Policy

1. Introduction

Carviste ("we", "us", "our") is committed to protecting the personal data of our customers and website visitors. This Privacy Policy describes how we collect, use, store, and protect personal information in connection with our weekly car rental services, operated from 22 Jalan Mamanda 7, Taman Dato Ahmad Razali, 68000 Ampang, Selangor, Malaysia.

This Policy is made in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA). By using our website or services, you acknowledge that you have read and understood this Policy.

For questions about this Policy or your personal data, contact us at: [email protected]

2. Data We Collect

We collect the following types of personal data:

• Identity data: Full name, copy of identification document (NRIC or passport) collected at rental confirmation
• Contact data: Email address, phone number submitted via our enquiry form or provided at booking
• Driving licence data: Licence number, class, and expiry date for rental eligibility verification
• Transactional data: Rental plan selected, rental dates, deposit amount, and payment records
• Usage data: IP address, browser type, pages visited, collected automatically via cookies and analytics tools

Legal basis for processing:

• Contract performance (processing your rental booking and managing the rental agreement)
• Legal obligation (compliance with Malaysian road transport and identity verification requirements)
• Legitimate interests (website analytics and service improvement)
• Consent (marketing communications, where applicable)

Retention: Rental records are retained for seven (7) years to comply with Malaysian tax and business record requirements. Website enquiry data is retained for two (2) years unless a rental agreement is formed.

3. How We Use Your Data

• To process and confirm rental bookings and prepare rental agreements
• To communicate booking details, reminders, and any updates during the rental period
• To verify driving eligibility and identity as required under Malaysian law
• To administer deposits and process refunds at rental completion
• To respond to enquiries submitted through our contact form
• To improve our website and services through aggregated analytics
• To send service-related communications (not marketing) where there is a legitimate interest

We do not sell your personal data to third parties. We do not use your data for automated decision-making or profiling.

4. Data Sharing

We may share your data with the following parties, only as necessary:

• Insurance providers: Sharing of rental and driver details as required for vehicle insurance coverage
• Analytics providers: Anonymised/aggregated website usage data (e.g. Google Analytics)
• Malaysian authorities: Where required by law, regulation, or court order under Malaysian jurisdiction

We do not transfer personal data outside of Malaysia except where strictly necessary and with appropriate safeguards in place.

5. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include:

• Access controls limiting data access to authorised team members only
• Secure storage of physical rental documentation
• SSL/TLS encryption for data transmitted through our website
• Regular review of data handling procedures

In the event of a data breach affecting your rights, we will notify affected individuals and the relevant Malaysian authority in accordance with applicable regulations.

6. Cookies

Our website uses cookies to operate correctly and to understand how visitors use the site. Essential cookies are required for basic site functionality. Optional analytics and preference cookies are only placed with your consent. For full details, see our Cookie Policy.

7. Your Rights

Under the Personal Data Protection Act 2010 and related Malaysian data protection principles, you have the following rights:

• Right to access: You may request a copy of the personal data we hold about you
• Right to correction: You may request correction of inaccurate or incomplete data
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time
• Right to limit processing: You may object to certain uses of your data in defined circumstances

To exercise any of these rights, contact us at [email protected]. We will respond within 21 days. If you believe we have not handled your data appropriately, you may contact the Department of Personal Data Protection Malaysia (JPDP).

8. Third-Party Links

Our website may contain links to external services (for example, Google Maps). We are not responsible for the privacy practices of third-party websites. We encourage you to review their privacy policies before providing personal information.

9. Children's Privacy

Our services are intended for individuals aged 18 and above. We do not knowingly collect personal data from minors. If you believe a minor has submitted personal data to us, please contact us immediately at [email protected] and we will remove it promptly.

10. Policy Updates

We may update this Privacy Policy from time to time. When we do, the revised date at the top of this page will be updated. Continued use of our website or services after any update constitutes your acknowledgement of the revised Policy. For material changes, we will notify customers directly where we hold contact details.

11. Contact Us

For any privacy-related enquiries, requests, or concerns:

• Business Name: Carviste
• Address: 22 Jalan Mamanda 7, Taman Dato Ahmad Razali, 68000 Ampang, Selangor, Malaysia
• Email: [email protected]
• Phone: +60 14-826 3517