SIFUAPP SDN. BHD.
(Registration No. 202601018593 (1680690-T))
PLEASE READ THIS BEFORE YOU USE THE APP
This Privacy Policy explains what personal data SifuApp Sdn. Bhd. collects about you when you use the SifuApp mobile application ("the App"), why we collect it, who we share it with, how long we keep it, and what rights you have over it under the Personal Data Protection Act 2010 ("PDPA").
This Policy applies to you as a customer who books, orders or pays for Works through the App. It forms part of the Terms of Use of the App and is to be read together with the Payment Terms and Conditions and the Refund, Cancellation and Rescheduling Policy. If there is a conflict between this Policy and those documents on a question of personal data, this Policy prevails.
1. PARTIES AND APPLICATION
1.1 This Policy is issued by SifuApp Sdn. Bhd. (Registration No. 202601018593 (1680690-T)), a company incorporated in Malaysia with its registered address at No. 23, Ground Floor, Jalan Lambak, 86000 Kluang, Johor, and its business address at B1-G-45, Jalan Pinggiran Putra 1/3, Taman Pinggiran Putra, 43300 Seri Kembangan, Selangor ("the Company", "we", "us" or "our").
1.2 This Policy applies to every customer who holds an account on the App, browses the App, places an Order, or makes a payment through it. It does not apply to a Sifu (service provider) acting in that capacity, or to a visitor to any website operated by the Company that is not part of the App, each of whom is or will be covered by a separate notice.、
1.3 By creating an account, browsing the App beyond the point at which this Policy is presented to you, or placing an Order, you acknowledge that you have been given the opportunity to read this Policy. Your consent to specific processing activities, where consent is the basis relied on, is dealt with in paragraph 9.
2. Definitions
2.1 In this Policy, unless the context requires otherwise, the terms "Acquirer", "App", "Order", "Payment Gateway", "Payment Instrument", "Payment Service Provider", "PDPA" and "Works" bear the meanings given to them in the Payment Terms and Conditions. In addition:
"Personal Data" any information in respect of commercial transactions that relates directly or indirectly to you, from which you are identified or identifiable, as defined in section 4 of the PDPA.
"Sensitive Personal Data" personal data relating to your physical or mental health, and any other category of personal data the PDPA from time to time treats as sensitive.
"Process / Processing" has the meaning given in the PDPA, and includes collecting, recording, holding, storing, using and disclosing personal data.
3. SCOPE OF THIS POLICY
3.1 This Policy covers personal data we process about you as a customer in connection with your account, your Orders, your payments and your use of the App. It does not cover data we hold about a Sifu, about a job applicant, or about an employee of the Company, each of which is addressed elsewhere.
3.2 Where you place an Order and provide personal data about another person (for example, an alternate contact at the site of the Works), you confirm that you have that person's permission to give us that data for the purposes described in this Policy, or another lawful basis for doing so.
4. DATA YOU GIVE US DIRECTLY
4.1 When you create an account, we collect your name, mobile number, electronic mail address, and a password or authentication credential.
4.2 When you place an Order, we collect the address or site of the Works, a description of the Works requested, your preferred date and time, and any photographs, notes or documents you choose to attach to the Order.
4.3 When you make a payment, we collect the transaction reference, the payment method selected, and the last four digits of the Payment Instrument used. We do not collect or store your full card number, expiry date, card verification value, PIN or banking credentials — these are captured directly by the Payment Service Provider, as described in paragraph 6.
4.4 When you contact customer service, lodge a complaint, or make a warranty or insurance claim, we collect the content of that communication and any supporting material you provide, including photographs of the Works.
5. DATA WE COLLECT AUTOMATICALLY
5.1 When you use the App, we collect device information (device model, operating system and version), app usage data (screens viewed, features used, crash and diagnostic logs), and, where you grant permission, your device's location, for the purpose of locating you or the site of the Works and dispatching a Sifu.
5.2 We collect this information through the App itself. The App does not currently operate a public website that uses browser cookies; if that changes, this paragraph will be updated and a separate cookie notice issued.
5.3 We do not use facial recognition or other biometric login, and we do not capture or collect images of your identification documents (such as your MyKad or passport). If this changes, we will update this Policy and obtain your separate explicit consent before doing so, as required for sensitive personal data under the PDPA.
6. DATA WE RECEIVE FROM THIRD PARTIES
6.1 When you pay through the Payment Gateway, the Payment Service Provider returns to us a transaction reference, an approval or decline status, and, where a payment method is stored for future use, a token representing that payment method. The Payment Service Provider, and not the Company, captures and holds your underlying card or banking credentials.
6.2 Where we are required to verify your identity or your authority to use a Payment Instrument (Payment Terms, paragraph 4.3), we may receive confirmation of that verification from the Payment Service Provider, the Acquirer, or the issuer of your Payment Instrument.
6.3 Where a Sifu records the completion of Works, we receive from the Sifu the photographs, notes, and completion record relating to your Order.
7. PURPOSES OF PROCESSING
7.1 We process your personal data for the following purposes:
(a) to create and administer your account;
(b) to process an Order, including matching it to a Sifu and coordinating the appointment;
(c ) to process a Transaction, issue a receipt, and administer a refund, chargeback or dispute, as described in the Payment Terms;
(d) to provide customer service, and to handle a complaint, a warranty claim or an insurance claim;
(e) to detect, investigate and prevent fraud, money laundering, and other unlawful or prohibited use of the App, as described in paragraph 19 of the Payment Terms;
(f) to keep the records required of us by law, including under the PDPA, the Consumer Protection (Electronic Trade Transaction) Regulations 2024, and applicable tax and accounting legislation;
(g) to maintain and improve the App, including diagnosing technical issues; and
(h) subject to paragraph 9, to send you service messages and, where you have consented, marketing communications.
8. LEGAL BASIS FOR PROCESSING
8.1 We process your personal data because it is necessary to perform the contract between us (the Terms of Use, the Payment Terms and any Order), because it is necessary to comply with a legal obligation to which we are subject, because it is necessary for our legitimate interests in operating and securing the App (and those interests do not override your own rights and interests), or because you have given your consent, in each case as is appropriate to the purpose in question.
8.2 Where consent is the basis relied on — in particular for location data and for marketing communications — you may withdraw that consent at any time in the manner described in paragraph 21, without affecting the lawfulness of processing carried out before withdrawal.
9. MARKETING COMMUNICATIONS
9.1 We will only send you marketing communications by electronic mail, SMS, WhatsApp or App notification if you have consented to receive them, or in the limited circumstances permitted by the Personal Data Protection (Class of Data Controllers) provisions and related PDPA guidance without consent being required.
9.2 You may withdraw your consent to marketing communications at any time using the unsubscribe or opt-out function provided in the communication itself, or by contacting us under paragraph 23. Withdrawing consent to marketing does not affect our sending you service messages necessary for an Order or a Transaction.
10. THE PAYMENT SERVICE PROVIDER, THE ACQUIRER, AND CARD ISSUERS
10.1 We disclose transaction data to the Payment Service Provider, to the Acquirer, and to the issuer of your Payment Instrument, to the extent necessary to process a Transaction, a refund or a chargeback, consistently with paragraph 4.4 of the Payment Terms.
11. THE SIFU ASSIGNED TO YOUR ORDER
11.1 We disclose to the Sifu assigned to your Order the information reasonably necessary for that Sifu to attend the site and carry out the Works: your name, contact number, the site address, and the particulars of the Order. We do not disclose your full payment details, your account password, or your Order history with other Sifus to the Sifu assigned to your Order.
12. REGULATORS, LAW ENFORCEMENT, AND COURTS
12.1 We disclose personal data to a regulator, an enforcement agency, or a court where we are required or permitted to do so by law, including under the Financial Services Act 2013, in connection with a report of suspected fraud, or in response to a lawful request.
13. PROFESSIONAL ADVISERS AND SERVICE PROVIDERS TO THE COMPANY
13.1 We disclose personal data to our professional advisers (including our lawyers and auditors) and to providers who process data on our behalf (including cloud hosting, customer service tooling, and analytics providers), each of whom is required by contract to process the data only on our instructions and to apply security measures consistent with paragraph 16.
14. BUSINESS TRANSFERS
14.1 If the Company is party to a merger, acquisition, restructuring or sale of the whole or part of its business, your personal data may be transferred to the party assuming that business or those assets, on terms that preserve the protections of this Policy, consistently with paragraph 25 of the Payment Terms on assignment.
15. TRANSFERS OUTSIDE MALAYSIA
15.1 We do not transfer your personal data outside Malaysia. Your personal data is hosted on servers located in Malaysia, and our developer, its staff and its sub-contractors who may access that data are also based in Malaysia. If this changes, we will update this Policy and, where required under section 129 of the PDPA, obtain your consent or rely on another permitted basis before any such transfer takes place.
16. HOW WE PROTECT YOUR PERSONAL DATA
16.1 We apply technical and organisational measures appropriate to the nature of the data, including access controls restricting personal data to staff who need it to perform their role, encryption of data in transit, and contractual security obligations on our processors.
16.2 Your card number, expiry date, card verification value, PIN and banking credentials are captured by the Payment Service Provider and are not stored by the Company, consistently with paragraph 18.1 of the Payment Terms.
16.3 No method of transmission or storage is completely secure. If you have reason to believe your account has been compromised, notify us immediately under paragraph 12 of the Payment Terms and paragraph 23 of this Policy.
17. HOW LONG WE KEEP YOUR PERSONAL DATA
17.1 We keep records of your Transactions and the Orders to which they relate for not less than three years, consistently with paragraph 17.2 of the Payment Terms, or for such longer period as required by law.
17.2 We keep your account data for as long as your account remains open, and for a further period of seven (7) years after closure to deal with any residual claim, complaint or legal obligation, after which it is deleted or anonymised.
18. PERSONAL DATA BREACH NOTIFICATION
18.1 Where a personal data breach occurs that is likely to result in significant harm to you, we will notify the Personal Data Protection Commissioner without unreasonable delay and, where required, notify you directly, in each case in accordance with the PDPA's data breach notification requirements and within the time limits it prescribes.
19. RIGHT OF ACCESS
19.1 You may ask us for a copy of the personal data we hold about you. We will respond within twenty-one days of receiving a request that is properly made, or explain why we need longer, as required by section 30 of the PDPA. We may charge a reasonable fee to cover our administrative cost in complying with the request.
20. RIGHT OF CORRECTION
20.1 You may ask us to correct personal data about you that is inaccurate, incomplete, misleading or not up to date. We will correct it, or explain why we decline to, within twenty-one days as required by section 34 of the PDPA.
21. RIGHT TO WITHDRAW CONSENT
21.1 Where our processing is based on your consent, you may withdraw it at any time by contacting us under paragraph 23. Withdrawal does not affect the lawfulness of processing carried out before you withdrew it, and may mean we are no longer able to provide a feature of the App that depends on that processing — for example, a location-based feature.
22. RIGHT TO LIMIT PROCESSING
22.1 You may ask us to stop processing your personal data for direct marketing purposes at any time, free of charge, under section 43 of the PDPA. You may also ask us to stop or not begin processing your personal data where that processing is likely to cause you damage or distress, under section 42 of the PDPA, and we will comply unless an exception in that section applies.
23. HOW TO EXERCISE YOUR RIGHTS, AND HOW TO CONTACT US
23.1 You may exercise any of the rights in paragraphs 19 to 22, or raise any other question about your personal data, by:
(a) writing to SifuApp Sdn. Bhd. at B1-G-45, Jalan Pinggiran Putra 1/3, Taman Pinggiran Putra, 43300 Seri Kembangan, Selangor;
(b) electronic mail to support@sifuapp.com;
(c ) through the help function in the App.
23.2 If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commissioner of Malaysia.
24. CHILDREN
24.1 The App is directed at persons of at least 18 years of age, consistently with paragraph 3.1 of the Payment Terms. We do not knowingly collect personal data from a child. If we become aware that we have done so, we will take steps to delete it.
25. AUTOMATED DECISION-MAKING
25.1 We do not use your personal data to make a decision that produces a legal effect concerning you, or a similarly significant effect, based solely on automated processing without human involvement.
26. CHANGES TO THIS POLICY
26.1 We may amend this Policy. We will give you not less than twenty-one days' notice of a material amendment, by notification in the App and by electronic mail to the address recorded in your account, consistently with the notice period for the Payment Terms.
27. LANGUAGE
27.1 This Policy is issued in English and, for convenience, in the national language (Bahasa Malaysia). In the event of any inconsistency between the two texts, the English text prevails.
28. GOVERNING LAW AND JURISDICTION
28.1 This Policy is governed by and construed in accordance with the laws of Malaysia, including the PDPA. The courts of Malaysia have jurisdiction to determine any dispute arising out of or in connection with this Policy, without prejudice to your right to complain to the Personal Data Protection Commissioner.
29. HOW TO CONTACT US
29.1 General and data protection enquiries: support@sifuapp.com, or through the help function in the App.
