Privacy Notice

1. Personal data we collect

• Account details: name, mobile number, email address, and the Google or Apple account identifier if you sign in that way.
• Order details: pickup and drop-off addresses and map points, recipient names and phone numbers you give us, descriptions and photos of goods, notes, delivery codes, declared values and cash-on-delivery amounts.
• Proof of delivery: photos, signatures, the name of the person who received the goods, and the time and location of the hand-over.
• Payment details: payment method, amounts, refunds and transaction references. Card and bank details are entered on our payment processor's pages; we do not store full card numbers.
• Communications: in-app chat with drivers, support tickets, emails, WhatsApp messages and call records with our support team, and your ratings and feedback.
• Business details: company name, registration and tax numbers, billing address, team members and API usage.
• Driver details: identity card or passport details, date of birth, photo, driving licence, vehicle registration and photos, permits (such as GDL or PSV), bank account for payouts, earnings, ratings, training results and, while online or on a job, location (see section 4).
• Device and usage data: device type, app version, IP address, push notification tokens, pages and screens used and crash reports.

2. Why we use it

• To quote, match, carry out, track and prove deliveries, and to let senders, recipients and drivers contact each other about an order.
• To take payments, issue receipts, invoices and e-invoices, process refunds and pay drivers.
• To verify drivers' identity, eligibility and documents, and to keep the platform safe: preventing fraud, multiple accounts and misuse, and investigating incidents, no-shows and claims.
• To provide customer support and handle complaints and disputes.
• To improve routing, pricing, delivery time estimates and the service generally, using aggregated or de-identified data where we can.
• To send service messages (order updates by SMS, WhatsApp, push or email) and, where you have not opted out, news and offers about Blink.
• To meet legal obligations, including tax, accounting, e-invoicing and lawful requests from authorities.

Providing your mobile number and order details is necessary to use the service. If you do not provide them we cannot deliver for you. Other data is optional unless we say otherwise when we ask for it.

3. Who we share it with

Drivers see the pickup and drop-off details and the contact details needed for the delivery they accept, and lose access to them after the delivery. Recipients see the driver's first name, vehicle and live location while the order is on its way. Businesses see the details of their own orders.

We use the following service providers (data processors), who act on our instructions:

We may also share data with LHDN for e-invoicing, with PERKESO for drivers' social security contributions, with insurers or loss adjusters handling a claim, with professional advisers, with a buyer of our business (under the same protections), and with the police, courts or regulators when the law requires it.

Some providers process data outside Malaysia (for example in Singapore, the United States or the European Union). Where we transfer personal data abroad we do so in line with the PDPA, using providers that are bound by contract to protect it to a standard at least equivalent to Malaysian law.

4. Driver location notice

If you drive with Blink, the driver app collects your precise GPS location while you are online and while you are on a job, including when the app is in the background or your screen is off. It does not collect location when you are offline.

We use it to offer you nearby jobs, show customers and recipients where their delivery is, calculate distance and arrival times, verify arrivals and no-shows, support you in an incident and calculate fair pay.

Raw location points are kept for 90 days, then deleted. After that we keep only aggregated, anonymised road-speed statistics that cannot identify you. Location linked to a specific delivery (for example, where proof of delivery was taken) is kept with that order record.

You can stop location collection at any time by going offline. Background location is required to receive and complete jobs.

5. Offers and marketing

We may show you sponsored offers inside Blink from Blink or from our business partners. These are first-party offers: we choose what to show you using your use of Blink (for example, your area and the kinds of deliveries you book). We do not give advertisers your personal data.

You can opt out of marketing messages and personalised offers at any time in your account settings, by using the unsubscribe link in an email, or by writing to privacy@blinkapp.asia. Service messages about your orders will still be sent.

6. How long we keep it

• Orders, receipts, invoices, payments, refunds and payouts: 7 years, as required by Malaysian tax and accounting law.
• Driver raw GPS location: 90 days (see section 4).
• Proof-of-delivery photos and chat messages: kept with the order record so disputes and claims can be handled.
• Driver identity and vehicle documents: while you drive with us and for up to 7 years after, to meet legal, insurance and safety obligations.
• Support tickets: for as long as needed to resolve the issue and then up to 7 years.

When we no longer need personal data we delete or anonymise it.

7. Deleting your account

You can delete your account in the app or on the website (Account, then Delete account). Deletion is not possible while you have a delivery in progress. When you delete your account we immediately sign you out on every device, erase your name, email address and phone number, delete your saved places and notification tokens, and for drivers, remove your vehicle from dispatch. Orders and payment records are kept in anonymised form for the statutory period described above. The same phone number can later be used to open a fresh account.

8. Your rights

Under the PDPA you have the right to:

• access the personal data we hold about you and get a copy of it;
• correct personal data that is inaccurate, incomplete or out of date;
• withdraw consent and limit processing, including for direct marketing;
• ask us to transmit your personal data to you or another organisation where the PDPA data portability right applies; and
• complain to us and, if unresolved, to the Personal Data Protection Commissioner.

Send requests to our Data Protection Officer at privacy@blinkapp.asia. We may ask you to verify your identity. We respond within 21 days, as the PDPA requires, and tell you if we need more time. We do not charge for reasonable requests.

9. Security and data breaches

We protect personal data with encryption in transit, access controls, audit logs and least-privilege access for staff. Drivers can see a customer's contact details only during an active job. If a personal data breach is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and affected individuals as the PDPA requires.

10. Children

Blink is not intended for people under 18. We do not knowingly collect personal data from children except as recipient details provided by a sender.

11. Contact and Data Protection Officer

Exodia Labs Sdn Bhd is the data controller (data user) for the personal data described in this notice. Contact our Data Protection Officer at privacy@blinkapp.asia. If there is any inconsistency between the English and other language versions of this notice, the English version prevails. We may update this notice and will publish the new version here with its effective date.