Privacy Notice
Last updated 7 October 2026
Draft: this text is waiting for review by a Malaysian lawyer and may change before Hirevia launches.
What personal data Hirevia collects, why, who we share it with, how long we keep it, and your rights under the Personal Data Protection Act 2010.
1. Who we are
[company name] Sdn. Bhd. (registration no. [to be added]), [registered address], runs Hirevia and is responsible for your personal data. This notice is given under the Personal Data Protection Act 2010 ("PDPA") and is available in English, Bahasa Melayu and Chinese.
2. What we collect
- Account details: name, email address, phone number, password (stored only in scrambled form), and sign-in details from Google or Apple if you use them.
- Profile details: photo, headline, bio, city and service area, languages, skills, packages, prices, portfolio and availability.
- Bookings and payments: what you booked, dates, amounts, payment status and reference numbers. Card and bank details are handled by our payment partner; we do not see or store your full card number.
- Payout details: the bank account you withdraw to.
- Messages and files you send through Hirevia, including translations of them.
- Reviews, problem reports and the evidence attached to them (descriptions, photos, videos, documents, map locations), and support tickets.
- Location: the city on your profile, the place of an on-site booking, and your location at check-in and check-out if you choose to use it.
- Tax details if you add them: legal name, tax number (TIN), MyKad or business registration number, SST number and address. ID numbers are stored encrypted.
- Identity checks: if we introduce MyKad verification, the details and images you submit for it.
- Device and security data: IP address, browser and device type, sign-in times, and two-factor authentication settings.
3. Why we use it
- To create and run your account and show your public profile.
- To arrange bookings, take payments, hold money in escrow, pay freelancers and handle refunds.
- To send messages, reminders and notifications by app, email, WhatsApp, SMS and push.
- To translate messages, suggest replies, understand searches and sort support requests (AI features).
- To check reviews and posts for abusive language, prevent fraud and keep accounts secure.
- To handle problem reports, disputes, strikes and appeals.
- To meet legal duties, including tax records and e-invoicing with the Inland Revenue Board (LHDN).
- To improve Hirevia, and with your consent, to send you news and offers.
4. What you must give us
Your name and an email address or phone number are needed to open an account. Payment, booking and location details are needed to make or fulfil a booking, and bank details to withdraw earnings. Identity details may be required before withdrawals. If you don't give these, we can't provide that part of the service.
Everything else, such as a profile photo, tax details (unless you ask for an e-invoice), check-in location and marketing consent, is optional.
6. Transfers outside Malaysia
Some of our service providers store or process data outside Malaysia (for example in Singapore and the United States). We only transfer data where the PDPA allows it: where the country has comparable protection, or where the provider is bound by contract to protect it to the PDPA standard.
7. How we protect it
We use encrypted connections, encrypt sensitive fields such as ID numbers, store passwords only in scrambled form, require two-factor authentication for staff, limit staff access by role and log what staff do. Staff only read private chats when handling a problem report or dispute, and each time is recorded.
If a data breach is likely to cause you significant harm, we will tell you and the Personal Data Protection Commissioner as the law requires.
8. How long we keep it
- Account and profile details: while your account is open. When you close your account, your profile is hidden at once and you can reopen it by signing in within 30 days; after that your details are deleted or anonymised, except for what we must keep below. Reviews you wrote stay up under the name "Deleted user".
- Booking, payment, payout and tax records: 7 years after the end of the financial year they belong to, as tax and company law require. Then they are deleted.
- Problem reports, support tickets and their evidence: 2 years after they are closed.
- Strike records: 12 months active; a ban record for severe breaches is kept to stop repeat sign-ups.
9. Your rights
- Access a copy of your personal data.
- Correct data that is wrong or out of date (most of it you can edit yourself in Settings).
- Ask us to send your data to you or another service in a common format (data portability).
- Withdraw consent, or ask us to stop processing that causes you damage or distress.
- Stop marketing at any time.
- Close your account yourself at any time on the Account health page.
Send requests through the help centre or to [support email]. We reply within 21 days. We may charge the fee allowed by the regulations for an access request, and we may need to confirm your identity first. You can also complain to the Personal Data Protection Commissioner.
10. Marketing
We only send news and offers if you agree. Every marketing email has an unsubscribe link, and you can change your choices in notification settings. Messages about your bookings, payments and account security are not marketing and will still be sent.
12. Children
Hirevia is for people aged 18 and over. We do not knowingly collect data from children; if we learn we have, we will delete it.
13. Changes to this notice
We may update this notice. For important changes we will tell you by email or in the app before they apply. If the English and other versions differ, the English version applies.
14. Contact us
Our Data Protection Officer can be reached at [support email], or by post at [company name] Sdn. Bhd., [registered address].
See also: Terms of Service