Privacy Policy

1. Personal Data We Collect

We collect personal data only when it is necessary for the rental arrangement or for responding to your enquiry. The categories of data we may collect include:

• Full name and contact telephone number
• Email address
• Malaysian identity card number or passport number (for rental agreement purposes)
• Driving licence details
• Website usage data via analytics (if consent has been given)

Legal basis for processing: Data collected for rental arrangements is processed under the basis of contractual necessity. Data collected via website forms prior to a confirmed rental is processed under your consent. Analytics data is processed under consent where applicable.

Retention: Rental agreement data is retained for a minimum of seven years to comply with Malaysian commercial record-keeping requirements. Enquiry data for non-converted enquiries is deleted within 90 days.

2. How We Use Your Personal Data

Personal data collected by Karvelin is used for the following purposes:

• Processing and confirming vehicle rental bookings
• Communicating with you about your rental arrangement
• Compliance with Malaysian motor vehicle rental legal requirements
• Insurance administration associated with your rental period
• Responding to your enquiries submitted through the website

We do not sell your personal data to third parties. We do not use your data for unsolicited marketing communications.

Third-party disclosure: We may share rental agreement data with our motor insurance provider and, where legally required, with Malaysian regulatory or enforcement authorities. No other third-party data sharing occurs without your explicit consent.

3. Data Protection Measures

Karvelin takes reasonable technical and organisational steps to protect personal data against unauthorised access, disclosure, or loss:

• Website enquiry forms are transmitted over HTTPS
• Paper rental records are stored in a locked cabinet accessible only to authorised staff
• Digital records are held on access-controlled systems
• Staff access to customer data is limited to those whose role requires it

In the event of a personal data breach that may affect your rights, we will notify you and the relevant authority as required under PDPA 2010.

4. Cookies

Our website uses cookies to support basic functionality and, where you have consented, to collect anonymous analytics data. Cookie types used include:

• Essential cookies: Required for the website to function. Cannot be declined.
• Analytics cookies: Collect anonymous data on pages visited and session duration. Require your consent.
• Preference cookies: Remember your choices on the website. Require your consent.

For full details and to manage your preferences, see our Cookie Policy.

5. Your Rights Under PDPA 2010

Under Malaysia's Personal Data Protection Act 2010, you have the following rights in relation to your personal data:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to correct: You may request correction of inaccurate or incomplete data.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.
• Right to limit processing: You may request that we limit the processing of your data in certain circumstances.
• Right to lodge a complaint: You may direct concerns about our data handling to the Personal Data Protection Department (PDPD) of Malaysia.

To exercise any of these rights, contact us at [email protected]. We aim to respond to all data rights requests within 21 days.

6. Third-Party Links

Our website may contain links to external sites — such as charging network operator pages or mapping services. Karvelin is not responsible for the privacy practices of those sites. We encourage you to review the privacy policy of any external site before providing personal information.

7. Minimum Age

Karvelin's rental services are available only to individuals aged 18 and above who hold a valid driving licence. We do not knowingly collect personal data from persons under the age of 18. If we become aware that data has been submitted by a minor, it will be deleted promptly.

8. Changes to This Policy

We may update this policy from time to time. When changes are made, the revised policy will be published on this page with a new "Last Updated" date. Continued use of our website or services after changes have been posted constitutes your acceptance of the updated terms.

9. Contact for Data Enquiries