1. Introduction

This Privacy Policy explains how BBOO SDN. BHD. (Company Registration No. 202501020616 (1622029-X)), operating under the brand "DaiJia" ("we", "us", or "our"), collects, uses, discloses, and protects your personal data when you use the DaiJia mobile applications (the DaiJia Customer App and the DaiJia Driver App), our websites, and related services (collectively, the "Services").

We are committed to protecting your privacy in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia and other applicable laws.

By using the Services, you agree to the collection and use of information in accordance with this Policy.

2. Information We Collect

2.1 Information You Provide Directly

Account Information (Customers and Drivers)

• Full name
• Mobile phone number
• Email address
• Profile photo (optional)
• Password (stored hashed; never readable by us)

Driver Verification Information (Drivers only)

• Malaysian National Registration Identity Card (NRIC) number and image
• Driver's licence (image, expiry date, licence number)
• Vehicle details where applicable (registration number, make, model, colour, vehicle photos, insurance documents)
• Selfie photo for identity matching
• Bank account details for payouts

Trip Information

• Pickup and drop-off locations
• Trip route, distance, and duration
• Time and date of trip
• Fare amount and payment method
• Driver/customer ratings and feedback

Support Information

• Messages submitted via support tickets
• Attachments you upload to support tickets
• Records of your communications with our support team

2.2 Information Collected Automatically

Location Data

• Precise GPS location — collected continuously while a trip is active (both apps) and while a driver is online and accepting trips (Driver App only).
• Location is collected in the background on the Driver App so that nearby trip requests can be matched. We request Always location permission for this purpose; you can revoke it at any time in your device settings, but doing so will prevent you from receiving trip requests when the app is backgrounded.

Device and Technical Data

• Device model, operating system version, unique device identifiers
• Firebase Cloud Messaging (FCM) push notification token
• App version, language settings, time zone
• IP address
• Crash logs and diagnostic data
• Approximate location derived from IP (used only for region detection)

Usage Data

• Screens viewed, features used, in-app actions
• Login timestamps and session duration

2.3 Information from Third Parties

• Payment processor (GKash) — confirmation of successful/failed payments, masked card details (last 4 digits), transaction IDs. We do not receive or store full card numbers, CVVs, or full bank credentials.
• Map providers (Google Maps Platform) — geocoded addresses, route calculations.

3. How We Use Your Information

We use your information for the following purposes:

Purpose	Data Used	Legal Basis (PDPA)
Provide the core ride-matching service	Account info, location, trip data	Performance of contract
Verify driver eligibility and prevent fraud	NRIC, licence, vehicle docs	Legal obligation; legitimate interest
Process payments and payouts	Payment info, bank details	Performance of contract
Send push notifications about trips, payments, support	FCM token, account info	Performance of contract; consent
Calculate fares, penalties, and referral bonuses	Trip data, account info	Performance of contract
Customer support	Support messages, account info, trip data	Performance of contract
Improve the Services and fix bugs	Diagnostic data, usage data	Legitimate interest
Comply with legal obligations	Any of the above as required	Legal obligation
Detect and prevent fraud or misuse	All categories	Legitimate interest

We do not use your data for behavioural advertising, ad targeting, or sale to data brokers.

4. How We Share Your Information

We share your information only as described below:

With other users of the Services

• Drivers see the customer's first name, phone number (during active trip), pickup/drop-off, and rating.
• Customers see the driver's first name, photo, vehicle details (if any), phone number (during active trip), and rating.

With service providers (data processors)

• Google LLC — Maps, Places, Directions APIs
• Google LLC (Firebase) — push notifications, app diagnostics
• GKash Sdn Bhd — payment processing
• BytePlus (operated by Beijing Volcano Engine Technology Co., Ltd. / ByteDance) — application and database hosting
• Twilio Inc. — OTP delivery via SMS and WhatsApp (Twilio Verify)

These processors are bound by contractual obligations to protect your data and use it only for the purposes we specify.

With law enforcement and regulators

• When required by Malaysian law, court order, or to protect the safety of users (e.g., assisting investigations of accidents, harassment, or fraud).

In a business transfer

• If we merge with, are acquired by, or sell assets to another company, your data may be transferred. We will notify you in advance.

We do not sell your personal data to third parties.

5. International Data Transfers

Some of our service providers process data on servers outside Malaysia, including:

• BytePlus (hosting) — data may be processed in BytePlus regional data centres outside Malaysia
• Google LLC (Maps, Firebase) — United States and other Google regions
• Twilio Inc. (OTP) — United States

Where data is transferred outside Malaysia, we ensure the transfer is governed by appropriate safeguards consistent with the PDPA and the receiving country's data protection regime, including contractual data-processing agreements with each provider.

6. Data Retention

We retain your data only as long as necessary:

Data Category	Retention Period
Active account data	Duration of your account + 3 years after closure
Completed trip records	7 years (for tax and legal compliance)
Payment transaction records	7 years (Bank Negara / IRB requirements)
Driver KYC documents	Duration of driver status + 7 years after deactivation
Support tickets	3 years after resolution
Marketing preferences	Until you withdraw consent
Diagnostic / crash logs	90 days

After these periods, data is deleted or anonymised.

7. Your Rights Under PDPA

You have the right to:

1. Access — request a copy of personal data we hold about you.
2. Correction — request correction of inaccurate or incomplete data.
3. Withdraw consent — for processing based on consent (e.g., marketing).
4. Limit processing — request that we stop processing for direct marketing.
5. Lodge a complaint — with the Personal Data Protection Department of Malaysia (PDP).
6. Account deletion — request deletion of your account and personal data, subject to retention obligations above.

To exercise any of these rights, email us at contact@appbaystudio.com. We will respond within 21 days as required by PDPA.

Account deletion in-app

You can request account deletion directly within the app: Settings → Account → Delete Account. We will delete your data within 30 days, except for records we are legally required to retain.

8. Security

We implement industry-standard technical and organisational measures to protect your data:

• All network traffic is encrypted with TLS 1.2 or higher (HTTPS)
• Passwords are hashed using bcrypt
• Sensitive identity documents are stored with access controls and audit logging
• Payment data is processed by GKash, a PCI-DSS compliant processor; we do not store full card numbers
• Access to production systems is restricted to authorised personnel and logged

No system is 100% secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

9. Children's Privacy

The Services are not directed to anyone under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact us at contact@appbaystudio.com and we will delete it.

10. Permissions on Your Device

The DaiJia apps request the following device permissions:

Permission	Why We Need It	Required?
Location (When in Use / Always)	Match trips, navigate routes, track active trips. Always is requested on the Driver App for background trip matching.	Yes
Camera	Photograph identity documents and (optional) profile photo	Yes for drivers
Photo Library	Upload existing photos of identity documents or profile	No (alternative to camera)
Notifications	Trip status updates, payment confirmations, support replies	Recommended

You can revoke any of these permissions at any time in your device settings.

11. Cookies and Tracking Technologies

The mobile apps do not use third-party advertising cookies or cross-app tracking. We do not show the App Tracking Transparency prompt because we do not track you across apps owned by other companies.

Our website (if any) may use essential cookies for session management. See our website cookie notice for details.

12. Changes to This Policy

We may update this Policy from time to time. Material changes will be communicated via:

• An in-app notification, and
• Email to your registered email address

The "Last Updated" date at the top reflects the latest revision. Continued use of the Services after changes take effect constitutes acceptance.

13. Contact Us

If you have questions about this Policy or our data practices:

For PDPA complaints that we cannot resolve, you may contact the Personal Data Protection Department: