This notice explains how HEROLAH GROUP SDN. BHD. ("Sewalah", "we") collects and uses your personal data when you use sewalah.my, the rental-company websites on sewalah.my, and related services. It is issued under the Personal Data Protection Act 2010 (PDPA). A Bahasa Melayu version is available; if the versions differ, the English version prevails.
1. Who we are and our role
Sewalah is a marketplace. Independent rental companies list their cars and decide whether to rent to you. For a rental, the rental company you book with also uses your data to review your application and provide the car, and is responsible for its own use of that data. Sewalah operates the platform, processes payments and keeps the records.
2. Personal data we collect
- Account details: name, email address, phone number, date of birth, language preference and password (stored only in encrypted form).
- Rental application: identity document type, images of your MyKad (front and back) or passport, driving licence images, driver details, pickup and return addresses, and your answers to the rental company's policies.
- Agreement and signature: your signature, the agreement version you signed, the time, your IP address and browser information.
- Payments and refunds: amounts, payment references and status from our payment provider. We do not receive your online banking login or card details. For refunds by bank transfer we may ask for your bank account details.
- Rental records: bookings, handover and return inspections, photos, deposit deductions, messages, reports and support cases.
- Usage and device data: IP address, browser type, pages viewed, and a visitor cookie used to count car-page views (kept for up to 180 days). Our network provider, Cloudflare, also measures site performance.
- Rental companies: business registration details, staff names and contact details, and payout bank account details.
We collect this data from you, from the rental company handling your rental, and from our payment provider.
3. Why we use it
- To create and secure your account, including two-step verification for staff.
- To let the rental company review your identity and driving licence for each new rental, prepare the agreement and provide the car.
- To take payments, issue refunds, release deposits and pay rental companies.
- To send booking, payment and account messages.
- To prevent fraud and misuse, handle reports, appeals and disputes, and keep audit records.
- To measure and improve the platform, including car-page statistics shown to rental companies in aggregate form only.
- To send offers and news, only if you agreed. You can withdraw this consent at any time.
- To meet legal, tax and accounting obligations.
4. Is it compulsory?
Account details and, for each rental, identity and driving licence evidence and a signature are required. Without them we cannot open an account or submit your rental application. Marketing consent is optional.
5. Who we share it with
- The rental company you apply to. Only that company's authorised staff can open your documents, through links that expire.
- Our payment provider, ToyyibPay, to process payments.
- Service providers who host and protect the platform and send email: our hosting provider (Contabo) and Cloudflare.
- Professional advisers, auditors, and authorities when the law requires it or to protect rights and safety.
We do not sell your personal data.
6. Transfers outside Malaysia
Our servers and backups are located in Singapore, so your data, including document images, is stored outside Malaysia. We transfer it only to providers that protect it to a standard comparable to the PDPA. Singapore has a personal data protection law, the Personal Data Protection Act 2012, which gives protection substantially similar to the PDPA. We also require our hosting and service providers by contract to keep your data confidential and secure and to use it only to provide their services to us. Where a transfer is necessary to perform your rental contract, we also rely on that ground under the PDPA.
7. How long we keep it
We keep personal data only as long as needed for the purposes above and to meet legal requirements. Unless a longer period is needed for an open dispute, claim, investigation or legal requirement:
- MyKad, passport and driving licence images: deleted 90 days after the rental ends, or after the application is rejected, withdrawn or cancelled.
- Signed agreements and signatures: 7 years after the rental ends.
- Payment, refund and payout records: 7 years, as required for tax and accounting.
- Handover and return photos and deposit evidence: 1 year after the rental ends.
- Reports, support cases and appeals: 3 years after they are closed.
- Account details: while your account is open, then up to 2 years after it is closed.
- Security and audit logs: 2 years. Visitor cookie: up to 180 days; car-page statistics are kept only as anonymous totals.
- Backups: overwritten within 30 days.
8. Security
Documents and signatures are kept in private storage that is not publicly accessible. Bank details and two-step verification secrets are encrypted. Access is limited by role, sensitive actions require the password to be re-entered, and access to documents and bank details is logged.
9. Your rights
You may ask to access or correct your personal data, ask for a copy of it in a commonly used format where the law provides, withdraw consent, or limit how we process it, including for direct marketing. You can update most account details yourself. Send requests to [email protected]. We may need to verify your identity and may charge a fee permitted by law for access requests. We will reply within the time the PDPA allows.
10. Contact and complaints
For questions or complaints about your personal data, contact our Data Protection Officer at [email protected], HEROLAH GROUP SDN. BHD., Registration No. 202601036469 (1698564-U), Unit 16-08, Plaza Azalea, Persiaran Bandaraya, Seksyen 14, 40100 Shah Alam, Selangor, Malaysia.
11. Changes
We will post any update here with a new version and date, and tell you about material changes before they apply.