This Privacy Policy is issued by The Battery Shop Sdn Bhd (Company No. 893586-V), operating under the brand names "The Battery Shop" and "Carput" ("we", "us", "our"). It governs how we collect, use, disclose, and protect personal data in accordance with the Personal Data Protection Act 2010 (PDPA), as amended by the Personal Data Protection (Amendment) Act 2024.
This Policy is provided in English. A Bahasa Malaysia version is available upon request at support@carput.my, in compliance with PDPA requirements. In the event of any inconsistency between versions, the English version shall prevail.
By using our website, services, or providing us with your personal data, you consent to the collection and processing of your personal data as described in this Policy.
1. What Personal Data We Collect
We collect personal data that you provide directly when using our Platform and/or Services, including:
- Identity data: Name, NRIC or passport number (where required)
- Contact data: Phone number, email address, WhatsApp number
- Location data: Your exact location when requesting on-site services
- Vehicle data: Car make, model, year, and registration number
- Transaction data: Service history, payment records, warranty records
- Usage data: How you interact with our website, including pages visited, time spent, browser type, device type, and IP address
- Communication data: Records of calls, WhatsApp messages, and emails with us
We do not knowingly collect sensitive personal data (including biometric data, health data, or political opinions) as defined under the amended PDPA 2024. If such data is inadvertently provided, it will be deleted promptly.
2. How We Collect Personal Data
- Directly from you when you call us, WhatsApp us, or submit forms on our website
- Automatically through cookies, tracking pixels, and similar technologies when you visit our website (see Section 6 below)
- From third-party platforms such as Google and Meta when you interact with our advertisements
3. How We Use Your Personal Data
We process your personal data only for the following purposes:
- To provide, manage, and deliver our services to you
- To dispatch technicians to your location and communicate service updates
- To process payments and issue receipts and warranties
- To respond to your enquiries, complaints, and warranty claims
- To send marketing communications (only with your consent, and you may opt out at any time)
- To improve our website, services, and customer experience through analytics
- To comply with legal obligations and prevent fraud
- To run targeted advertising campaigns via Google Ads and Meta Ads
4. Disclosure of Personal Data
We may share your personal data with:
- Our technicians and operations team — to deliver services to your location
- Third-party towing operators — for outsourced towing services only, as described in our Terms of Service
- Technology service providers — including Google LLC and Meta Platforms Inc., for analytics and advertising purposes (see Section 6)
- Payment processors — for processing credit card and e-wallet transactions
- Professional advisers — auditors, lawyers, and accountants on a need-to-know basis
- Law enforcement or regulators — where required by law, court order, or to protect our rights
We do not sell, rent, or trade your personal data to any third party for their own commercial purposes.
5. Cross-Border Data Transfers
Some of our third-party service providers are based outside Malaysia, including:
- Google LLC (United States) — for Google Analytics, Google Tag Manager, and Google Ads
- Meta Platforms Inc. (United States) — for Meta Pixel and Meta Ads
- Vercel Inc. (United States) — for website hosting
By using our website and services, you consent to your personal data being transferred to these countries. We take reasonable steps to ensure these providers maintain adequate data protection standards consistent with the PDPA 2024 amendment's cross-border transfer requirements.
6. Cookies and Tracking Technologies
Our website uses the following tracking technologies:
- Google Tag Manager (GTM) — a tag management system that fires analytics and advertising scripts
- Google Analytics 4 (GA4) — collects anonymised data about website traffic and user behaviour to help us improve our site
- Google Ads Conversion Tracking — tracks when visitors complete actions (such as calling us or messaging via WhatsApp) after clicking our ads, to measure ad effectiveness
- Meta Pixel — tracks visitor behaviour on our website to measure the effectiveness of our Facebook and Instagram advertising campaigns and to enable remarketing to website visitors
These technologies may collect your IP address, browser type, pages visited, and interactions. You may opt out of interest-based advertising at aboutads.info or through your browser's cookie settings. Note that disabling cookies may affect website functionality.
7. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:
- Service and transaction records: 7 years (for accounting and warranty purposes)
- Warranty records: Duration of warranty period plus 1 year
- Marketing consent records: Until you withdraw consent or 3 years from last interaction
- Website analytics data: 26 months (Google Analytics default)
- Call and WhatsApp records: 12 months
8. Security of Your Personal Data
We implement appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, disclosure, alteration, or destruction, including:
- Secure HTTPS encryption on our website
- Access controls restricting personal data to authorised personnel only
- Secure storage on Vercel's cloud infrastructure with encryption at rest
- Regular review of our data handling practices
While we take all commercially reasonable steps to protect your data, no internet transmission is completely secure. You acknowledge and accept this risk when using our services.
9. Your Rights Under PDPA 2024
Under the Personal Data Protection Act 2010 (as amended 2024), you have the following rights:
- Right of access — to request a copy of your personal data held by us
- Right of correction — to request correction of inaccurate or incomplete personal data
- Right to withdraw consent — to withdraw your consent to processing at any time (note: this may affect our ability to provide services to you)
- Right to limit processing — to request that we restrict the use of your personal data for direct marketing purposes
- Right to data portability — (effective June 2025 under the 2024 amendment) to request transfer of your personal data to another service provider in a structured, commonly used format, subject to technical feasibility
To exercise any of these rights, contact us at support@carput.my. We will respond within 21 days.
10. Data Breach Notification
In the event of a personal data breach that is likely to cause harm to you, we will notify the Personal Data Protection Commissioner (PDPC) within 72 hours of becoming aware of the breach, and notify affected individuals within 7 days, in compliance with the PDPA 2024 amendment. We maintain a breach register for a minimum of 2 years.
11. Children's Privacy
Our services are not directed to persons under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us immediately at support@carput.my.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in law, our practices, or our services. Material changes will be notified on our website. Your continued use of our services after any update constitutes your acceptance of the revised Policy.
13. Contact Us
For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:
The Battery Shop Sdn Bhd
21 Jalan PJS 7/21, Bandar Sunway, 46150 Petaling Jaya, Selangor
Email: support@carput.my
Phone: 1800-1800-10