Data Processing Agreement
Version 2026-10-06. Between the rental business that registers on JomSewa (the "Controller") and Miracle Mikhael Enterprise (SSM no. [to be added]), operator of JomSewa (the "Processor"). Agreed electronically when the Controller's owner accepts it in the app.
1. Scope
The Processor processes the Controller's customers' personal data (name, contact details, licence class, IC/passport and licence images, vehicle photos, booking and payment records) only to provide JomSewa and only on the Controller's instructions given through the app.
2. Controller duties
The Controller gives customers the privacy notice before collecting data, records consent, collects only what is necessary and handles customer access and correction requests. The app provides export and erase tools for this.
3. Confidentiality
Anyone at the Processor with access to the data is bound by confidentiality.
4. Security
The Processor maintains: separation between businesses, HTTPS, hashed credentials, role-based access, private file storage, rate limiting, activity logging and daily automatic deletion of expired documents.
5. Sub-processors
Cloudflare, Inc. for hosting, database and file storage, including outside Malaysia. A payment provider if the Controller enables online payments. The Processor gives notice before adding sub-processors.
6. Cross-border transfer
The Controller acknowledges that data may be processed outside Malaysia by the sub-processors above.
7. Retention and deletion
Documents are deleted per the Controller's retention setting. On termination the Processor deletes the Controller's data within 90 days (backups expire within 30 further days) unless the law requires otherwise. The Controller may export data before termination.
8. Breach notification
The Processor notifies the Controller without undue delay, and within 48 hours of becoming aware of a breach affecting the Controller's data, with the information the Controller needs to notify the Commissioner.
9. Assistance
The Processor helps the Controller respond to data subject requests and Commissioner inquiries.
10. Audit
On reasonable notice, the Processor provides information needed to show compliance.
Contact: hello@getjomsewa.com