Privacy Policy

DUMO LOGISTIC is software that delivery and transport companies ("client companies") use to manage their drivers, vehicles, deliveries and customers.

For the data a client company puts into DUMO LOGISTIC about its own staff, drivers, vehicles and customers, that client company is the data controller: it decides why and how the data is used. We are its data processor: we handle that data only on its instructions and only to provide the service.

For the accounts of people who sign up with us, billing, and running and securing the service itself, we are the data controller.

Depending on how a client company uses DUMO LOGISTIC, we handle:

• Account data: names, email addresses and roles of company admins, office staff and drivers, given by the person or by their company. Passwords are stored only in hashed form by our sign-in provider; we cannot read them.
• Driver location: GPS position, accuracy, speed and heading from the driver app while tracking is on, and single location readings drivers share through check-in links. This comes from the driver's phone.
• Delivery data: references, pickup and delivery addresses, planned and estimated arrival times, package descriptions, delivery status and the name of the person who received it, entered by the client company.
• Customer data: the names, phone numbers, email and delivery addresses of the client company's customers, entered by the client company.
• Vehicle documents: files a client company chooses to upload, such as road tax, insurance, the registration card (geran) or permits. These may show the vehicle owner's name and identity card (IC) number.
• Messages: WhatsApp messages exchanged with drivers and customers through the business number connected to the service, and messages customers write on their tracking page.
• Feedback: delivery ratings and comments customers choose to give.
• Billing data: the plan, invoices and payment status of client companies. Card and bank details are entered on Stripe's payment page and handled by Stripe; we never see or store card numbers.
• Technical and security data: IP address, browser type, device information and sign-in events, used to keep accounts secure, block abuse and fix problems.

We use personal data only to:

• provide the service: live maps, delivery tracking, arrival estimates, check-ins, reminders, customer updates, vehicle records and support conversations;
• show customers the status of their own delivery through a private tracking link;
• take payment for the service and keep the records the law requires;
• keep accounts and data secure, and detect and prevent fraud and abuse;
• communicate with client companies about their account and the service;
• meet our legal obligations.

An email address and name are needed to create an account; without them we cannot give you access. Driver location is needed for live tracking; a driver who turns it off can still use the app, but the office will see that tracking is interrupted. Uploading vehicle documents, giving feedback and writing messages are optional.

A tracking link shows only that one delivery: its status, the destination, the arrival estimate and, depending on the client company's settings, the driver's first name and the vehicle. The driver's position is shown only while that delivery is on the way.

Tracking links use long random codes and stop working 30 days after the delivery is completed or cancelled.

Client companies are responsible for telling their drivers that their location is shared during work, and for having a lawful basis to do so. Drivers can see in the driver app when tracking is on. The office sees where each driver was last seen and how old that position is; the service never invents positions.

Vehicle documents are kept in private storage. Only the client company's office staff can open them, through a link that works for 60 seconds; drivers and customers cannot see them. We accept only PDF and image files up to 10 MB, check what each file really is, and remove hidden information that phone cameras store in photos (such as the place a photo was taken).

Client companies should upload only the documents they need. A document is deleted for good when the company removes it.

We do not sell personal data. We share it only with the client company it belongs to, with the providers below who run parts of the service for us, and with authorities when the law requires it. Our providers process data only to provide their service to us:

• Supabase: database, file storage, sign-in and live updates. Data is stored in Singapore.
• Vercel: hosting of the website and app, including protection against attacks.
• Google Maps Platform: maps, address search, area names and arrival estimates (addresses and positions are sent to Google for this).
• Cloudflare: domain name service, email forwarding, and Turnstile, the check that tells people and robots apart on sign-in forms.
• Stripe: online payments and invoices.
• Resend: sending account emails such as password resets.
• Meta (WhatsApp Business Platform): sending and receiving WhatsApp messages, once a business number is connected.

Some of these providers store or process data outside Malaysia, for example in Singapore and the United States. We transfer data only where the PDPA allows it: to places whose laws or the provider's commitments give protection comparable to the PDPA, or where the transfer is needed to provide the service you asked for. We review these transfers regularly.

We keep personal data only as long as needed for the purposes above, or as long as the law requires. Client companies can delete drivers, vehicles, documents, customers and deliveries in the app. Tracking links stop working 30 days after a delivery ends.

When a client company closes its account, we delete or anonymise its data within 90 days, except records the law requires us to keep, such as accounting records (kept for 7 years under the Companies Act 2016).

Data is encrypted in transit (HTTPS) and at rest. Each client company's data is separated in the database so other companies cannot see it. Sign-in forms are protected against automated attacks, and accounts can use two-step login with an authenticator app, including a backup phone. Files are kept in private storage. More details are on our Security page.

If a personal data breach happens that is likely to cause significant harm, we notify the Personal Data Protection Commissioner within 72 hours of becoming aware of it, and tell the people affected without unnecessary delay, as the PDPA requires. Where we act for a client company, we tell that company without undue delay so it can meet its own duties, and help it inform the people affected. We keep a record of every breach.

You can ask to access and correct your personal data, ask how it is used, limit how it is used, withdraw consent, and ask for a copy of your data in a common format that can be moved to another service, as the PDPA allows. We answer requests within 21 days.

If you are a driver or a customer of a client company, please contact that company first, because it decides how your data is used. You can also contact us and we will pass your request on.

If you are not satisfied with our answer, you can complain to the Personal Data Protection Department (www.pdp.gov.my).

We use only what the service needs to work: storage in your browser that keeps you signed in and remembers settings such as language and display, and the security check on sign-in forms. We do not use advertising or tracking cookies, so we do not ask for cookie consent. The full list is on our Cookies page (/cookies).

We may update this policy. The date at the top shows when it last changed. Important changes will be announced in the app or by email.

Questions, requests or complaints about personal data: contact our data protection officer at the contact details on our Contact page, the DUMO LOGISTIC team, Malaysia. We can help in Bahasa Melayu and English.