Privacy Policy

KSSK Car Rental rents cars in Seri Kembangan and across Malaysia. This policy explains what personal information we collect when you book with us, why we need it, who we share it with, how long we keep it and what you can ask us to do with it. It is written to meet our obligations under Malaysia’s Personal Data Protection Act 2010, as amended in 2024.

Who is responsible for your information

KSSK Car Rental is the data controller for everything described here. To reach us about your personal information, or about anything on this page:

Email: sales@ksskcarrental.com
WhatsApp: 016-316 9969

What we collect, and why

When you book a car

• Your name, phone number and email address, so we can confirm the booking and reach you about it.
• Your identity card number, and photographs of your identity card and driving licence, front and back. We need these to confirm that you are licensed to drive and to meet the requirements of our insurance. We cannot rent you a car without them.
• Your delivery and return addresses, and the dates and times of your rental, so we know where and when to bring the car and collect it.
• The driver’s age, where you give it, because insurance terms depend on it.

The front of a Malaysian identity card shows the holder’s religion. That makes a photograph of it sensitive personal data under the Act, so we ask for your explicit agreement before you upload it, we use it only to verify you as the driver, and we never record or act on what it shows.

When you pay

Payments are processed by Billplz, a Malaysian payment gateway. We pass them your name, email address, phone number and the amount due. We never see or store your card or online banking details: those are handled entirely by Billplz and your bank.

When you ask for a corporate quotation

Your name, company, email address, phone number and what you need, so that we can quote for it.

When you use our website

• If you type an address into one of our booking forms, we use Google Places to suggest matching addresses, which means what you type into those fields is sent to Google.
• Our homepage displays our Google rating and reviews, which are loaded from Google.
• We use Google Analytics to understand how the site is used: which pages people visit, which cars they look at, and where they leave the booking process. Before any page address reaches Google we take out anything that identifies you, so a link carrying your phone number or your booking reference is reported as the plain page address instead.
• We use the Meta pixel, which tells Facebook and Instagram that a visit happened here, so that we can measure our advertising and show it to people like you. It is not loaded on the pages where you enter your details, upload your documents or pay, and we have turned off the setting that would let it read what you type into our forms.
• When you make a booking, we also send Meta and Google a record of that booking from our own server. It includes your email address and your phone number, and on a completed booking your name and the country of the rental. Each one is scrambled into a code before it leaves us, by a one-way method: nobody who intercepts it can turn it back into your details, though it does let Meta and Google recognise you if they already hold the same details. This is how we tell which advertisement led to a booking. Your IC number and your documents are never sent.
• Either of these can be stopped at your end with an ad or tracking blocker, or through your browser’s own privacy settings. Nothing on this site stops working if you do.

How we ask for your consent

Before you upload any identity document, you are shown what we will do with it and you have to tick a box to agree. We record the moment you agreed and the version of this policy you agreed to, so that neither of us has to remember. You can withdraw your agreement at any time by writing to us, and we will stop using the information and delete what we are not required by law to keep. Withdrawing it means we can no longer rent you the car, because the insurance requires the documents.

How we protect it

Our website runs over an encrypted connection (HTTPS) throughout. Photographs of your identity card and driving licence are treated as the sensitive documents they are: they are stored outside the website’s public media library, in a location blocked from direct web access, with unpredictable file names and file permissions that keep them private to us, and they can be opened only by authorised KSSK staff who are signed in, through a link that is checked on every single request. They are never published, never indexed by search engines and never used for marketing of any kind.

If personal information we hold is ever lost or exposed in a way that is likely to cause you harm, we will notify the Personal Data Protection Commissioner and tell you directly, as the Act requires.

Who we share it with

We do not sell your personal information. We share only what is necessary, with:

• Billplz, to take your payment.
• Google, for the address suggestions, the reviews and the site statistics described above, and, when you make a booking, your email address and phone number in the scrambled form described above.
• Meta, the company behind Facebook and Instagram, which is told that a visit to this website happened, and, when you make a booking, your email address, phone number, name and the country of the rental in the scrambled form described above, so that we can measure our advertising. It is never told your IC number, or anything about the documents you have given us.
• Our email provider, to deliver your booking confirmation, invoice and receipt to you.
• Our insurer, or the authorities, where the law requires it or where it is necessary to deal with an accident, a traffic offence, damage or a claim involving the car you rented.
• Our legal representatives, a debt recovery agency, and credit reporting agencies including CTOS, but only where money is still owed to us after a rental has ended and we have not been able to recover it from you directly.

Some of these providers process information outside Malaysia. Google, Meta and our email provider operate globally, and our website is hosted on servers outside the country. Where that happens we rely on providers that are contractually bound to protect your information to a standard consistent with the Act.

How long we keep it

Two different periods, because two different things are being kept.

• Photographs of your identity card and driving licence are deleted 90 days after your booking ends, counted from the day the car comes back, or from the day the booking was cancelled if it never went ahead. Ninety days covers the period in which a traffic summons, a damage claim or a deposit question can still reach us. The deletion is automatic and runs daily, and it removes the files themselves, not just the link to them.
• The booking record is kept for seven years. That is your name, the dates, the car and the amounts, and we keep it because Malaysian law requires business and tax records to be retained for that long. After ninety days it no longer has your identity documents attached to it.

If you want your photographs removed sooner than 90 days, write to us and we will do it, provided the rental has finished and there is no open claim.

Your rights

Under the Act you may ask us to:

• give you a copy of the personal information we hold about you;
• correct anything that is wrong or out of date;
• stop using your information for a particular purpose;
• send your information to you, or to another provider, in a portable form; and
• delete it, where we are not required by law to keep it.

Write to sales@ksskcarrental.com or message us on WhatsApp. We will respond within 21 days, which is the period the Act allows us. If you are not satisfied with how we have handled your information, you may complain to the Personal Data Protection Commissioner.

Changes to this policy

If we change how we handle personal information, we will update this page and change the date at the top. Where the change affects information you have already given us, we will tell you rather than relying on you to check.