Privacy Policy - Rider
Who is the data processor?
The data processor, i.e. the company that defines the purposes and means of the processing specified in this privacy policy is MAD Biz Solutions Sdn. Bhd., Unit No. N 6-05, Gamuda Biz Suites, 12, Jalan Anggerik Vanilla, 31/99, Kota Kemuning, 40460 Shah Alam, Selangor Malaysia, with full ownership and operation rights on the platform namely MAD Store and the rider app, namely MAD Riders and email address support@madstore.biz, (hereinafter referred to as “MADStore” “we”, “our”, “controller”). We also use the terms "rider" or "independent contractor" for your salutation.
Why and which personal data do we process?
Below you can see which of your data we need for which purposes and under which circumstances we share your data with others.
Personal data is information from which we can directly or indirectly relate to your person, such as first and last name, address, phone number, date of birth, location data or email address.
Which personal data do we process?
In order to provide our delivery service to our customers, we use various tools and systems that are absolutely necessary for the delivery of orders. We also use external and internal tools and systems to process your personal data for personnel management and business operations.
We collect, process and store the following categories of personal data within the scope of using the tools and systems:
| Data categories | Explanation |
|---|---|
| Identification data | Name, Surname, Address |
| Contact data | Email Address, Phone number |
| Account data | Nationality, gender, bank account details, identification card number, vehicle type, vehicle colour, plate number |
| Performance data | Usage time of applications, order details |
| Geolocation data | GPS data |
| Technical data | Device data |
| Contract details | Contract type |
For what purposes do we process personal data?
We only collect your personal data if this is necessary and the purpose is legal and the processing is proportionate. Below we would like to give you more information for the purposes and legal basis:
| Purpose | Why do we process data for this purpose? |
|---|---|
| Recruiting | As part of the recruitment process, we collect, process and store your personal data on the basis of the data you have made available to us. The purpose of the processing is to make a decision regarding the acceptance or refusal of an applicant. Categories of personal data: ● Identification data ● Contact data ● Account data ● Vehicle data Legal basis: Contract initiation |
| Applicant reactivation | If an applicant does not continue the application process, WhatsApp will be sent from our administrative team to remind the applicant of the steps that need to be taken to complete the application process. Categories of personal data: ● Identification data ● Contact data Legal basis: ● Contract initiation Legitimate interest to ensure a smooth application process and better experience. |
| Contract | Conclusion of an independent contractor agreement
Categories of personal data: ● Identification data ● Account data Legal basis: Performance of contract |
| Onboarding | Preparation of the first day of service, training of new riders Categories of personal data: ● Identification data ● Account data Legal basis: ● Performance of contract Remarks: Training will be done separately, informed, and conducted by our trainer via WhatsApp. |
| Presence monitoring | Assessment of the reliability of riders with regard to the fulfilment of their contractual obligations. Categories of personal data: ● Contact details Legal basis: Performance of contract |
| Accounts | Creation of required accounts for the applications used Categories of personal data: ● Identification data ● Account data Legal basis: Performance of contract |
| Working time recording | Recording of work performed by the rider Categories of personal data: ● Identification data Start and end date of shift Legal basis: Performance of contract |
| Customer communication | Communication with customers about the status of the order or delivery Categories of personal data: ● Identification data ● Contact details ● Location data ● Content of communication ● Picture (if available) Legal basis: ● Legitimate interest to ensure a smooth communication process with customers for order delivery purposes and better experience |
| Photos and videos | Taking and publishing photos and videos of riders Categories of personal data: ● Identification data ● Picture/Video Legal basis: • Consent |
| Communication | Different tools are used for communication between us and the riders. The purpose of the processing is the communication of necessary information. Categories of personal data: ● Identification data ● Contact data Legal basis: ● Performance of contract ● Legitimate interest is the purpose described above |
| Delivery | To ensure a prompt delivery of the products ordered by our customers, the coordination data of our riders is collected and the order is assigned to those riders who are in an optimal region. Categories of personal data: ● Identification data ● Contact data ● Geolocation data ● Technical data Legal basis: ● Performance of contract ● Legitimate interest is the purpose described above |
| Delivery Estimation | In order to be able to inform customers of the expected delivery time, average speed data is processed in anonymous form. Categories of personal data: ● Geolocation data (anonymized) Legal basis: ● Legitimate interest is the purpose described above |
| Payments | Preparation of statements; payment of service fees Categories of personal data: ● Identification data ● Contact data ● Bank account information Legal basis: ● Performance of contract |
| Rider equipment | Riders receive rider equipment from us. This serves the uniform appearance of our riders as well as the protection of our riders. We manage and monitor the equipment provided to ensure that the necessary equipment is always available. Categories of personal data: ● Identification data ● Contact data Legal basis: ● Performance of contract ● Legal obligation |
| Time recording | We collect, process and store personal data of our riders for the actual exercise of deliveries. The purpose of the processing is to collect the hours worked and to create the necessary records. Categories of personal data: ● Identification data ● Contact data ● Account data ● Performance data ● Geolocation data Legal basis: ● Performance of contract ● Legitimate interest is the purpose described above |
| Performance evaluation | Evaluation of driver performance based on the quality (restaurant and customer complaints), quantity of orders delivered. It also includes but is not limited to, reliability, proper login and acceptance of orders during the shift until the end of the shift. Also the proper execution of the order. Categories of personal data: ● Identification data ● Contact data ● Performance data ● Geolocation data ● Technical data Legal basis: • Performance of contract |
| Termination | Ordinary and extraordinary terminations of contracts with riders Categories of personal data: ● Identification data ● Contact data Legal basis: • Performance of contract |
| Off-boarding | Deactivation of existing accounts; return of received clothing and equipment. Categories of personal data: ● Identification data ● Contact data Legal basis: • Performance of contract |
| Archiving | Archiving of documents subject to retention for tax purposes. Categories of personal data: ● Identification data ● Contact data ● Date of birth ● Tax information ● Working times Legal basis: • Legal obligation |
How long do we store personal data?
We generally delete your data after the purpose has been fulfilled. The exact deletion rules are defined in our regional deletion concepts. Different deletion rules apply depending on the purpose of the processing. Within our deletion concepts we have defined various data classes and assigned rule deletion periods to them. When the retention period is met, the stored data will be deleted accordingly. Under certain circumstances, any requests for deletion may be opposed by legal retention periods, which prevent us from deleting the stored data for a fixed minimum period of time. In order to comply with these legal requirements, we block the relevant data after the purpose has been fulfilled and thereby guarantee data completeness and data integrity.
With which data processors and why do we share personal data?
We never give your data to unauthorized third parties. However, as part of our work we obtain the services of selected service providers and give them limited and strictly monitored access to some of our data. However, before we forward personal data to these data processors for processing on our behalf, each individual company undergoes an audit. All data recipients must meet the legal data protection requirements and prove their data protection level with appropriate proofs.
To which third countries do we transfer personal data?
We process your data mainly within the company, in Malaysia.
All our data receivers have to measure up to certain requirements for the transfer of personal data to third countries. Before we transfer your data to a service provider in third countries, every service provider is first assessed with regard to its data protection level. Only if they can demonstrate an adequate level of data protection will they be shortlisted for service providers.
Regardless of whether our service providers are located within APAC or in third countries, each service provider must sign a contract with us, which shall contain the provisions as required by the Personal Data Protection Act 2010.
What are your rights as data subjects and how can they be asserted?
You have the right to receive explicit information from us about the personal data we have stored about you, free of charge.
In addition, you have the following rights:
▪ Right of access – Upon making a request and subject to exceptions contained under the applicable law, the right to know what data was collected and how it is processed
▪ Right to rectification – The right to request the modification of personal data if it is not up to date
▪ Right to erasure – The right to request the deletion of personal data
▪ Right to restriction of processing – The right to limit processing of personal data
▪ Right to data portability – The right to transfer personal data in a machine-readable format
▪ Right to object – The right to withdraw from given consent or object to the processing of personal data
▪ Right to lodge a complaint to the supervisory authority – The right to submit a complaint against us at a supervisory authority as named below.
If you believe that we have done something wrong with your personal data or your rights, you can complain to the appropriate supervisory authority at any time. The supervisory authority responsible for us is:
Name of authority: Personal Data Protection Commissioner
Address: Level 6, Kompleks KKMM, Lot 4G9, Persiaran Perdana, Presint 4, 62100 Putrajaya
Email address: aduan@pdp.gov.my
Hey, Local Businesses.
Go Digital With Us!
We help local businesses to digitize their ordering processes. With MAD Store, you can reach mass audience, generate more sales, and manage your businesses better. Go online by being our merchant today!
