1. Scope and data controller
Wasle Digital Solutions (JM1051299-A) is the operator of Wasle and the controller of the personal data described in this notice. This notice covers the Wasle website, delivery quote tool, rider/driver interest registration and Personal Shopper web platform, and describes relevant data uses where offered in Wasle applications.
It explains what we collect, the sources and purposes, disclosures, storage and your choices. Service-specific notices may provide more detail when a feature requests information. Contact details and privacy requests are addressed in section 10.
2. Data we receive and its sources
- Account and profile: name, email address, phone number, account identifier, role, login/session information, address, postcode, city and state that you submit. Shopper profiles may include a service area and short biography.
- Delivery quotes: address search text, selected pickup/drop-off locations and place identifiers, route distance and vehicle choice. A public quote does not require an account or create an order.
- Service activity: request items, merchant and location details, agreed fees, relevant delivery/handover information, task messages, status history, receipts, payment references, purchase photos, handover evidence and case records. Arrival evidence may include location coordinates captured in the relevant feature.
- Shopper identity review: IC front/back, selfie with IC, address proof, phone number and emergency contact details submitted through private onboarding.
- Rider/driver interest registration: name, address, telephone, age, email, role, chosen zones, experience, device, language, disability status, insurance status, vehicle arrangement and licence selections. The public registration form does not request document attachments or payment.
- Technical information: browser/device information, network or security logs, session information and language preference. Basic web analytics may be processed where enabled, as described in section 7.
Sources include information you provide, transaction participants providing relevant details or evidence, service-generated records, and the authentication or routing providers used for the feature. Provide another person's details only with appropriate authority and inform them of this notice. Disability information is sensitive; the registration declaration explains consent for its screening purpose.
3. Why we use the data and what is required
We process data to create and secure accounts; provide quotes; coordinate shopping and delivery requests; contact participants; review partner eligibility, identity and disclosed support needs; record payments, purchases and handovers; resolve disputes; prevent misuse; and meet applicable legal obligations. We use sensitive information only for the disclosed purpose with the consent or other lawful basis that applies.
Required form fields are identified in the relevant form. Without necessary account, address, transaction or verification information, we may be unable to provide the requested service or complete eligibility review. Public website browsing does not require identity documents. Optional biography information can be omitted, and you can change your language preference.
We do not use submitted identity evidence as public marketing material. Do not include unnecessary sensitive details in public profiles or task content.
4. Google account data
Draft section: the Google permissions and data handling used by the Wasle application have not yet been confirmed. The final notice must identify the actual Google data accessed, its purpose, storage, sharing and deletion before this policy is published or submitted for branding verification. The current Personal Shopper web portal uses email/password authentication.
5. Public profiles and other disclosures
Public shopper directory: active shopper identifiers, display names, online/offline status, verification indicators, service areas and biographies are public. Email, mobile number, home address, IC, identity evidence and emergency contacts are not fields in this directory. Do not place those details in your public name or biography.
Service participants: the relevant customer, shopper, sender, recipient or delivery partner receives the information needed for the particular request, including relevant contact, location, messages or evidence. Private onboarding identity records are available only to the applicant and authorised operations staff, not as public directory information.
Service providers: authentication, database and storage providers such as Supabase; hosting providers; Google Maps Platform for address and routing features; Google Analytics where enabled; and an enabled payment provider may process information needed for their function. Do not submit card credentials through messages or evidence uploads.
We may disclose information where required by law or reasonably necessary to investigate fraud, protect safety, establish or defend legal claims, or respond to a lawful authority request. Disclosures should be limited to what is necessary for the purpose. Google account data is additionally subject to the commitments in section 4.
6. Storage, security and international processing
Account and service records are stored using the configured Wasle service infrastructure. Personal Shopper access is restricted by account role and task participation. Identity and transaction evidence uses private storage and authorised access links, rather than the public shopper directory.
We use access controls and protected connections to reduce unauthorised access. Security cannot be guaranteed absolutely. Protect your account, sign out on shared devices and report suspected misuse.
If a personal data breach occurs, we assess and address the incident and notify the regulator and affected people when required by applicable law, without unnecessary delay.
Hosting, authentication, routing or other providers may process data outside Malaysia. Where that occurs, we must assess the applicable Malaysian transfer requirements and appropriate safeguards, and limit data to the provider's service purpose. This notice does not claim that all data stays in Malaysia.
7. Cookies, browser storage and analytics
The website stores your language choice locally in your browser. Personal Shopper login sessions use browser session storage, and may rely on the authentication provider's necessary session mechanisms. Clearing storage or signing out can remove local preferences or end a session. Browser permissions control location and camera access for features that request them.
Google Analytics is used only when an actual Analytics Measurement ID has been configured. The current website integration sends the page origin and path without URL query parameters or fragments, trims those details from the referrer, and disables Google signals. Analytics may still use cookies and process technical or usage information under Google's terms.
Optional analytics choices and any required consent must be provided before enabling analytics where applicable. Browser controls and Google's Analytics opt-out tool offer additional controls. Public pages do not send private shopper messages or identity evidence as analytics events through this integration.
8. Retention and deletion
Data should be retained only for as long as reasonably necessary for its service purpose, account administration, transaction records, outstanding cases, security or applicable legal obligations. Different categories can require different periods; this notice does not promise an unimplemented automatic deletion schedule.
You can request account closure or deletion of personal data using the contact in section 10. We assess the request, verify identity using a proportionate method and explain any information that must be retained and why. Records needed for an unresolved transaction, legal obligation or legitimate claim may be retained with restricted use. Account deletion is a request process, not an automatic action triggered by disconnecting Google.
9. Your choices and rights
Subject to applicable Malaysian law, you may request access to and correction of your personal data, withdraw applicable consent, raise concerns about processing, and request deletion or account closure where appropriate. You can edit supported profile fields in the portal and change your availability status.
You may also submit an electronic written request for your personal data to be transmitted to another data controller of your choice, subject to technical feasibility, format compatibility and the applicable legal requirements.
Withdrawing information or permissions necessary for a service may prevent us from providing that feature. Refusing Google permissions, where Google sign-in is offered, may prevent that sign-in method from working. You can manage or revoke connected-app access in your Google Account settings; this does not itself delete existing Wasle transaction records.
We may need reasonable identity verification before releasing or changing personal data. We will assess requests under the applicable requirements, explain any lawful limitation, and will not ask you to send a password. You may also raise an unresolved concern with Malaysia's Department of Personal Data Protection.
10. Contact, children and notice updates
For privacy enquiries, access/correction requests, withdrawal of consent or account/data deletion requests, contact Wasle below. State the request and your account email or task reference where relevant. Do not send full IC images or passwords in an initial email; a secure verification method can be arranged if needed.
Our services are intended for people who can lawfully use them and are not directed at children. If a child's data is supplied without appropriate authority, contact us so it can be assessed and addressed.
We will update this notice when data practices change and provide an appropriate notice or request new consent where required. The English and Bahasa Malaysia versions describe the same practices.
Support & privacy enquiries
Support/privacy email awaiting confirmation — draft contact details.