XLorry SaaS Privacy Notice

1.Who we are and when this Notice applies

XLORRY SDN. BHD. (BRN 202601019593) (“XLorry”, “we”, “our” or “us”) provides XLorry SaaS, a digital business-management service for transporters and individual lorry operators. This Privacy Notice explains how we process personal data through the XLorry SaaS website, registration, transporter workspace, customer booking pages, driver pages, support channels, WhatsApp notifications and related services.

This Notice is specific to XLorry SaaS. Marketplace bookings made through the separate XLorry marketplace may be governed by a different privacy notice and service terms.

2.Our role and the transporter’s role

For transporter registration, account administration, subscription, support, platform security and our own compliance, XLorry generally acts as the data controller.

For customer, driver, vehicle, booking, POL, POD, invoice and other operational records entered or controlled by a transporter, the transporter is generally the data controller and XLorry processes that data to provide the SaaS service. Each transporter must provide its own privacy notice where required, obtain all necessary notices and consents, and use personal data lawfully.

If you are a customer, driver, employee or representative of a transporter, you may need to contact that transporter first regarding its use of your personal data. We will reasonably assist the transporter with valid requests relating to data held in XLorry SaaS.

3.Personal data we collect

• Account and registration data: legal company name, BRN/SSM number, business display name, owner or representative name, business email, registered WhatsApp number and application status.
• Customer and contact data: names, company details, mobile numbers, email addresses, billing contacts, addresses and communication preferences.
• Driver and vehicle data: driver identity and contact details, MyKad reference where required, driving licence, GDL, vehicle registration, vehicle type, road tax, insurance, permits and uploaded supporting documents.
• Booking and delivery data: pickup and delivery addresses, contact persons, dates, cargo description, route details, quotations, status timestamps, notes, complaints, POL and POD photos or acknowledgements.
• Billing and payment-information data: invoice records, payment status and payment instructions such as bank account, DuitNow or e-wallet details. XLorry SaaS does not presently process the transporter’s customer payment unless expressly stated.
• Technical and security data: IP address, browser, device information, session and login records, OTP events, audit logs, cookies and security signals.
• Communications: WhatsApp and email messages, support requests, feedback, complaints and records of consent or acceptance.

4.How we collect personal data

• Directly from you when you register, activate or use an account, complete a form or contact XLorry.
• From a transporter, its authorised users, drivers, customers or representatives when they create or update operational records.
• Automatically from devices and browsers when the service is accessed.
• From service providers used for messaging, verification, hosting, maps, payments or security, where applicable.
• From lawful public or business sources where verification is reasonably required.

5.Why we process personal data

• To review registrations, create and secure accounts, issue activation links and verify access.
• To provide booking, quotation, assignment, job-status, POL, POD, customer-record and invoice-support functions.
• To send required transactional WhatsApp, SMS and email messages concerning accounts, bookings, quotations, job updates, documents, complaints and billing.
• To provide support, investigate incidents, prevent misuse, maintain audit trails and protect the service.
• To administer subscriptions, payments and renewals when paid plans are introduced.
• To improve reliability, usability and product performance using aggregated or appropriately protected information.
• To meet legal, accounting, regulatory and enforcement obligations, establish or defend claims and respond to lawful requests.
• To send marketing only where permitted by law and subject to available opt-out choices.

6.Required information and choices

Fields marked as required are needed to review or operate the relevant account or workflow. If required information or required transactional-messaging consent is not provided, XLorry may be unable to create the account or provide parts of the service.

Service and security communications are different from marketing. You may opt out of marketing without stopping necessary account or booking messages. If you withdraw consent for a communication channel required for a customer-access workflow, that access may need to be deactivated.

7.Who may receive personal data

• The relevant transporter, its authorised users, assigned drivers and customers, according to the workflow and access permissions.
• Cloud hosting, database, storage, security, analytics, mapping, messaging, SMS, email, payment and technical-support providers acting under appropriate obligations.
• Professional advisers, auditors, insurers and business continuity providers where reasonably necessary.
• Government agencies, regulators, law-enforcement bodies or courts where required or permitted by law.
• A buyer, investor or successor in a genuine corporate transaction, subject to confidentiality and applicable law.

8.International transfers

Some technology and communication providers may process or store data outside Malaysia. Where personal data is transferred internationally, XLorry will take reasonable steps to use lawful transfer mechanisms and ensure a level of protection consistent with applicable Malaysian personal-data law.

9.Security

We apply reasonable administrative, technical and organisational safeguards appropriate to the nature of the data and risks. These may include encrypted transmission, access controls, OTP authentication, limited staff access, tenant separation, audit logging, backups and security monitoring.

No internet or storage system is completely secure. Transporters must protect their tenant code, activation links, devices and accounts; restrict access to authorised users; and notify XLorry promptly of suspected unauthorised access. XLorry will assess and notify qualifying personal-data breaches in accordance with applicable law and official guidance.

10.Retention

XLorry retains personal data only for as long as reasonably necessary for the purposes described in this Notice or to meet applicable legal requirements. Where a shorter retention period applies to a particular category of data, that shorter period takes priority.

Registration and unsuccessful requests

Pending or unsuccessful registration data and unsuccessful booking-request data may be retained for up to 12 months from submission. At the end of that period, personal data in those records will be deleted or anonymised, unless continued retention is reasonably necessary for a purpose described in this Section.

Account closure, trial expiry and subscription cancellation

Personal data associated with a closed or inactive transporter account will generally be deleted or anonymised within 12 months after the effective closure or inactivity date. No separate deletion request is required.

For this purpose, an account becomes inactive when its trial or subscription ends without renewal or reactivation. Cancelling subscription renewal does not start this period before the current subscription ends. An account is not considered inactive solely because its users have not logged in while an active subscription remains in place.

This process covers personal data associated with the transporter account and its workspace, including personal data relating to its customers, drivers and bookings, subject to the exceptions below.

Transporters should export any records they need before their access ends. The retention period does not guarantee continued account access or the availability of data for restoration.

Records retained for longer

XLorry’s own billing, tax and accounting records are generally retained for seven years, or longer where required by applicable law. The applicable period is calculated according to the relevant legal requirements. Transporters remain responsible for retaining their own records as required under tax, accounting or other applicable laws.

Relevant account, security, consent, complaint and audit records may be retained for longer where reasonably necessary for service administration, fraud prevention, dispute resolution or legal compliance. This is limited to the information needed for those purposes and does not automatically extend the retention period for all account or workspace data.

Deletion and backups

When retention is no longer necessary, personal data will be deleted, anonymised or securely disposed of under XLorry’s retention procedures. Residual copies in backups may remain until they are overwritten or deleted through the applicable backup cycle and will remain protected during that period. Data subject to a lawful hold may be retained until that hold ends.

Deletion is managed through XLorry’s standard retention procedures. XLorry does not routinely issue individual deletion certificates or provide internal technical logs, and does not guarantee an exact deletion date for each record. On request, XLorry may provide written confirmation of the applicable retention process and, where reasonably available, the status of a deletion request. This does not limit any response or evidence required by applicable law.

Requests and identity verification

Account-related requests should be submitted using the account’s registered business email address or WhatsApp number. If you no longer have access to these channels, please contact XLorry so that alternative identity and authority checks can be arranged.

Individuals with requests concerning personal data controlled by a transporter within its workspace should contact that transporter first. XLorry will assist where appropriate, consistent with its role and applicable obligations.

11.Your rights

Subject to the Personal Data Protection Act 2010, as amended, and permitted exceptions, you may request access to or correction of your personal data, withdraw consent where processing depends on consent, object to certain direct marketing, ask questions about processing and exercise data-portability rights where applicable.

We may need to verify your identity and authority before acting. If the relevant transporter controls the data, we may refer the request to that transporter and assist it. Withdrawing consent does not affect processing already lawfully carried out and may affect services that require the relevant data.

Requests for deletion are handled in accordance with Section 10 and applicable law. A request does not necessarily require immediate deletion of records that XLorry is required or otherwise lawfully entitled to retain. If we cannot fulfil a request in whole or in part, we will explain the applicable reason, subject to legal restrictions. Nothing in Section 10 limits your rights under applicable data-protection law.

12.Cookies and similar technologies

XLorry SaaS may use essential cookies or similar technologies for sessions, language preferences, security and service operation. Essential cookies cannot be disabled through the service. If non-essential analytics or advertising cookies are introduced, appropriate notice and choices will be provided where required.

13.Children

XLorry SaaS is a business service intended for users aged 18 and above. It is not directed to children, and users must not submit children’s personal data unless lawful, necessary and appropriately authorised.

14.Changes and contact

We may update this Notice to reflect legal, technical or service changes. The latest version and effective date will be posted on the XLorry SaaS website. Material changes may also be notified through the service or registered contact channels.

For privacy questions, rights requests or complaints, contact XLorry using the details below. Please state “Privacy Request” and provide enough information for us to identify the relevant account and request.