Data Protection Notice

DRIVEHIVE TECHNOLOGIES (BRN: 202603171493 (NS0324741-A)), trading as “DriveHive”, operates a software-as-a-service (SaaS) platform that enables car rental companies to manage bookings, payments, fleet, customer records, and business operations. We process personal data both as a data user in our own right and as a data processor on behalf of rental companies.

For questions about personal data, contact us at support@drivehive.my.

This notice applies to personal data relating to:

• Platform Users — company owners, administrators, and staff who use DriveHive to manage a rental business.
• Customers — individuals who make bookings through a rental company that uses DriveHive, including those whose data is entered into the platform by rental company staff.

The PDPA applies to the processing of personal data in commercial transactions. All data processing described in this notice occurs in connection with such transactions.

DriveHive as Data User

DriveHive is a data user under the PDPA in relation to personal data of Platform Users (company accounts, staff members, company owners). We determine the purposes and means of processing that data to provide, maintain, and improve the platform.

DriveHive as Data Processor

For personal data of customers that rental companies enter into the platform (names, contact details, identity documents, booking records), DriveHive acts as a data processor. The rental company is the data user for that data and is responsible for obtaining proper consent and complying with the PDPA in relation to their customers.

Rental Companies as Data Users

Each rental company that uses DriveHive is a data user for the personal data of their customers. They must comply with the PDPA independently. DriveHive provides technical infrastructure and processing capability; it does not determine how rental companies use customer data beyond what is necessary to operate the platform.

Platform User Data

When you register or manage a company account on DriveHive, we process:

• Name, email address, and password (hashed).
• Company name, business email, company slug, and subscription details.
• Roles and permissions within the platform (owner, admin, staff).
• Login activity, audit log entries, and session information.
• Payment method information (tokenised; full card data is processed by our payment processor and never stored by DriveHive).

Customer Data (processed on behalf of rental companies)

Rental companies enter the following data about their customers into DriveHive:

• Full name, email address, and phone number.
• Identity card (MyKad) or passport number and driving licence details.
• Copies of identity documents and driving licences (uploaded for verification).
• Booking details: rental dates, vehicle assigned, branch, booking status.
• Payment records: amounts, payment method references, deposit status.
• Vehicle inspection photos and condition notes from pickup and return.
• WhatsApp opt-in status and inbound/outbound WhatsApp message logs.

Technical and Usage Data

• IP addresses and device/browser information when accessing the platform.
• Pages visited, actions taken, and timestamps (used for security and platform improvement).
• Session tokens (necessary for authentication; not used for tracking).

Principle 1 — General

Personal data shall only be processed for lawful purposes directly related to an activity of DriveHive or the relevant rental company. We process personal data to provide booking management, payment processing, fleet management, customer communication, and related SaaS services.

Principle 2 — Notice and Choice

Platform Users are notified of data processing through this notice and our Privacy Policy at the time of account registration. Rental companies are responsible for providing adequate notice and obtaining consent from their customers before entering customer data into DriveHive.

Where consent is the legal basis for processing (such as WhatsApp notifications), data subjects may withdraw consent at any time without affecting the lawfulness of prior processing.

Principle 3 — Disclosure

Personal data is not disclosed to third parties except as described in our Privacy Policy and as necessary to provide the platform services, including:

• Payment processing via the payment provider used during checkout (payment credentials are handled by the provider and never stored by DriveHive).
• WhatsApp notifications via the Meta WhatsApp Business API (phone numbers and message content).
• Cloud hosting and database providers operating under confidentiality obligations.
• Legal or regulatory authorities where required by law.

DriveHive does not sell personal data to third parties.

Principle 4 — Security

DriveHive implements appropriate technical and organisational security measures including:

• Encrypted connections (HTTPS/TLS) for all data in transit.
• Hashed and salted password storage (plaintext passwords are never stored).
• Role-based access controls limiting data access to authorised personnel.
• Audit logging of administrative actions on bookings, payments, and user accounts.
• API credentials and access tokens stored with access restricted to authorised system processes.
• Multi-tenant data isolation ensuring each company can only access its own records.

In the event of a security incident affecting personal data, DriveHive will notify affected data users and, where required, the relevant regulatory authority, in accordance with applicable law.

Principle 5 — Retention

Personal data is retained only as long as necessary for the purposes for which it was collected, or as required by law:

• Platform User account and subscription data: retained for the duration of the account and up to 7 years after account closure for financial and legal compliance.
• Customer booking and payment records: retained for the duration of the rental company’s subscription and a minimum of 90 days after subscription ends, to allow data recovery on resubscription.
• Identity document uploads: retained for the duration of the rental company’s subscription plus a reasonable period thereafter.
• WhatsApp message logs: retained for up to 2 years.
• Audit logs: retained for up to 7 years.

Data is securely deleted at the end of its retention period.

Principle 6 — Data Integrity

DriveHive takes reasonable steps to ensure that personal data processed is accurate, complete, and up to date. Platform Users and rental companies are responsible for the accuracy of data they enter. Data subjects may request correction of inaccurate data as described in Section 8.

Principle 7 — Access

Data subjects have the right to request access to personal data we hold about them and to request correction of inaccurate data. See Section 8 for how to exercise these rights.

DriveHive relies on the following bases for processing personal data under the PDPA:

• Contractual necessity — processing necessary to fulfil the subscription agreement with Company Users and to operate the booking system on their behalf.
• Legal obligation — processing required to comply with Malaysian law, including tax, financial reporting, and regulatory obligations.
• Consent — for optional communications such as WhatsApp notifications. Consent may be withdrawn at any time.
• Legitimate interests — for platform security, fraud prevention, audit logging, and service improvement, where such interests are not overridden by the data subject’s rights.

DriveHive uses cloud infrastructure and third-party services that may process or store data outside Malaysia. Where data is transferred outside Malaysia, we ensure that adequate protections are in place, including contractual safeguards with service providers.

Key cross-border data flows include:

• Database and file storage hosting (data may be processed in servers outside Malaysia).
• Payment processing services used during checkout (each operating under their own applicable compliance framework).
• Meta WhatsApp Business API (phone numbers and message content transmitted to Meta Platforms, Inc.).

Under Malaysia’s PDPA 2010, you have the following rights:

• Right of access — to request a copy of personal data we hold about you (subject to applicable exceptions under the PDPA).
• Right of correction — to request that inaccurate, incomplete, misleading, or out-of-date personal data be corrected.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of prior processing.
• Right to limit processing — you may request that we cease or limit processing your personal data for direct marketing purposes.

How to Exercise Your Rights

To exercise any of these rights, submit a written request to support@drivehive.my. Include your full name, contact information, a description of your request, and proof of identity. We will respond within 21 days of receipt. A fee may be charged for access requests as permitted under the PDPA.

Customers of Rental Companies

If you are a customer of a rental company that uses DriveHive, your data is controlled by that rental company. You should direct access and correction requests to the rental company in the first instance. We will cooperate with rental companies to fulfil requests that require data held in our systems.

The PDPA affords additional protection to certain categories of sensitive personal data. In the operation of DriveHive, we process the following data that may be treated as sensitive:

• Identity documents — MyKad numbers, passport numbers, and driving licence details are collected by rental companies for customer identity verification. These are processed and stored under strict access controls.
• Payment information — complete payment credentials are not stored by DriveHive. They are handled by the payment provider selected during checkout in accordance with that provider’s applicable security and compliance standards.

Sensitive personal data is processed only to the extent necessary and is not disclosed except as required to fulfil the platform services or comply with law.

If you believe DriveHive has handled your personal data in a manner inconsistent with the PDPA, you may first contact us at support@drivehive.my to resolve the matter.

If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commissioner of Malaysia:

For all data protection enquiries, access or correction requests, or concerns about how we handle your personal data, contact us at:

We will acknowledge your request within 3 business days and respond substantively within 21 days.

We may update this Data Protection Notice to reflect changes in the law, our data practices, or our platform features. Material changes will be communicated by email or through the platform. The effective date at the top of this page indicates the most recent revision.