Privacy Policy

1. Who is responsible

Workshops that use RodaStamp decide which customer and vehicle details they record. For those records each workshop is the data controller, and RodaStamp processes the data on the workshop's behalf.

RodaStamp is the data controller for workshop accounts, workshop registrations, car-owner Passport accounts and this website.

Address: 【待填 · registered address】. Privacy contact: 【待填 · privacy contact email】. Data protection officer: 【待填 · name and contact of the data protection officer】.

2. What we collect

• Workshop details: workshop and company name, SSM registration number and SSM document, address, email, owner or person in charge, Contact Mobile Number and Customer Reminder WhatsApp Number.
• Staff accounts: name, username, role, and a protected form of the password. We never store the password itself.
• Customer and vehicle records entered by workshops: customer name, mobile number, vehicle plate and model, mileage, service dates, maintenance items, products used, next service targets, and the messages the workshop prepares.
• Car-owner Passport accounts: mobile number, optional username, email, and a protected form of the password.
• Security records: sign-in attempts, sign-in sessions, who changed what and when (audit history) and, for changes to a workshop's protected numbers, the browser and network address used.
• Cookies and browser storage: only what keeps you signed in and remembers your language. The workshop app keeps an offline copy of the workshop's data in the browser, which is removed when you sign out.

3. Why we use it

• To run the service: record maintenance, calculate next service targets, and prepare thank-you messages and reminders that workshop staff send themselves through WhatsApp Web.
• To show car owners their maintenance history from participating workshops, after the owner confirms the mobile number that received the workshop's link.
• To review workshop registrations, including a phone call to the Contact Mobile Number.
• To keep accounts and data secure, prevent misuse and look into incidents.
• To meet our legal obligations.

We do not sell personal data and we do not use it for advertising.

4. Who we share it with

• The workshop that recorded it, and that workshop's staff according to their role.
• The car owner whose mobile number matches the records, through the Passport. Records that other participating workshops made for the same vehicle and mobile number appear in the same Passport.
• Service providers that host or deliver the service for us and act only on our instructions: Cloudflare (hosting, database and file storage) and Resend (password reset emails).
• Authorities, when the law requires it.

WhatsApp messages are opened and sent by the workshop itself in WhatsApp Web. WhatsApp's own terms and privacy policy apply to those messages.

5. Transfers outside Malaysia

Our service providers run servers in several countries, so personal data may be stored or processed outside Malaysia. We use providers that protect personal data to a standard comparable to the PDPA, as the PDPA requires.

6. How long we keep it

• Service records are kept while the workshop uses RodaStamp, so that the vehicle's history stays complete. Corrections keep the earlier version, and records are voided instead of deleted.
• When a workshop stops using RodaStamp, its records are 【待填 · deleted or anonymised, and within how long】.
• Workshop registrations that are not approved are deleted 【待填 · how long after the decision】.
• Passport accounts are kept until the car owner asks us to close them.
• Sign-in sessions end after 12 hours for workshop staff and 30 days for car owners. Failed sign-in counts are cleared after a day. Encrypted backups are kept for 30 days.

7. How we protect it

Connections are encrypted (HTTPS). Passwords are stored only as salted hashes. Every person signs in with their own account, and the server checks each person's role for every change. Changes are kept in an audit history, and nightly backups are encrypted.

If a personal data breach happens, we will notify the Personal Data Protection Commissioner and, where the breach is likely to cause significant harm, the people affected, as the PDPA requires.

8. Your rights

You may ask to see the personal data we hold about you, to correct it, to receive a copy in a commonly used format, or to withdraw your consent or limit how your data is used. Workshop customers may also ask the workshop that recorded their details.

Write to 【待填 · privacy contact email】. We reply within 21 days, and may first need to confirm who you are.

You may also complain to the Personal Data Protection Commissioner of Malaysia (www.pdp.gov.my).

If you do not give the details marked as required, we cannot create the account or provide that part of the service.

9. Changes to this policy

We will publish any change on this page with a new date. If a change is significant, we will tell signed-in users before it applies.