1. Who is responsible for your data
HEMONG DOT ASIA, 201103103176 (002037193-T), [Registered business address] ("Hemong") is the data user under the Personal Data Protection Act 2010 of Malaysia (PDPA). Contact our data protection contact, [Data protection contact name], at privacy@hemong.asia.
2. What we collect and why
| Data | When | Why |
|---|---|---|
| Email or phone number, name, profile photo | You create an account | To sign you in and to show your name to restaurants and riders |
| Sign in details from Google or Apple | You choose that sign in | To create your account. Apple may give us a private relay address |
| Precise location | Customers: while using the app. Riders and drivers: while online and during deliveries, including when the app is closed or the screen is off | Nearby restaurants, delivery addresses, routing, and showing you where your rider is |
| Delivery addresses and order notes | You place an order | To prepare and deliver your order |
| Orders, payments, receipts | You order | To fulfil, refund and account for orders |
| Messages with restaurants, riders, drivers and support | You send them | To resolve orders and issues, and to arrange rides |
| Rider and driver documents (identity, selfie, licence, vehicle grant, insurance, road tax, photos) | Riders and drivers submit them | To verify people before they deliver or offer rides. Stored privately |
| Hemong Points | You earn or use points | To run the points programme |
| Device push token | You allow notifications | To send order and ride alerts |
| Crash and diagnostic information | Only if switched on | To find and fix problems |
We do not sell your data and we do not use it for third party advertising.
3. How we use it
- To provide the service: process orders, arrange delivery, run Onway bookings and show you where things are.
- To keep people safe, prevent fraud and enforce our terms.
- To support you and answer your questions.
- To send service messages about your orders and bookings. We only send marketing if you agree, and you can say no at any time.
- To meet legal and tax duties.
4. Who we share it with
Restaurants and riders see what they need to complete your order: your name, delivery address, notes and your approximate live location during delivery. Drivers and passengers see each other's name, photo and booking details.
Service providers process data for us under contract: Supabase (database and hosting), Google (maps, address search and Google sign in), MapTiler (map tiles), Apple (Sign in with Apple), and Expo (push notifications). We may also use a crash reporting provider if it is switched on. We share data with authorities when the law requires it.
Some providers process data outside Malaysia. Where that happens we take steps to make sure your data is protected to a similar standard.
5. How long we keep it
We keep your account data until you delete your account. Orders are kept, without your name, address, notes or location, for [7] years to meet financial and tax record rules. Rider and driver documents are deleted when the account is deleted, and rejected applications are removed after [retention period].
6. Your choices and rights
Under the PDPA you can ask to see the personal data we hold about you, ask us to correct it, ask us to stop using it for certain purposes, and withdraw consent you have given. You can:
- Delete your account in the app (Account, then Delete account), or follow our delete account page.
- Turn location and notifications off in your phone settings, although some features will not work without location.
- Write to privacy@hemong.asia for anything else. We reply within [21] days.
7. Security
We protect data with encryption in transit, access controls and private storage for sensitive documents. No system is perfect. If we find a breach that affects you, we will tell you and the authorities as the law requires.
8. Children
Hemong is not for anyone under [18]. If we learn that we hold a child's data, we will delete it.
9. Cookies and tracking
This website does not use advertising or analytics cookies. See our cookie policy.
10. Changes to this policy
We will tell you in the app before important changes take effect. The date at the top of this page shows when it was last updated.
Questions? Write to privacy@hemong.asia, or to HEMONG DOT ASIA, 201103103176 (002037193-T), [Registered business address].