Privacy Notice

Rivo Mobility Solutions, SSM 202603272993 (JM1051445-V), operates Rivo at rentrivo.com and is responsible as data controller for the personal data it processes. This notice applies when you browse, apply, subscribe, drive an equipped vehicle, contact us or use your account.

Contact [email protected] about personal data, your choices or this notice. Customer service is available at [email protected] or through Get in touch. An identified fleet supplier, insurer or payment provider may separately control information for its own lawful purposes; their applicable notices also explain their responsibilities.

Rivo vehicles may contain primary or backup GPS and telematics systems. Depending on the equipment fitted, they can record live and historical vehicle location, mileage and trip information, ignition status, vehicle and battery status, security and tamper events, and entry into or exit from a geofence. Location and trip records may reveal travel patterns.

Where fitted, these records may be used for fleet management, mileage calculation and verification, servicing and maintenance, vehicle security, theft prevention, vehicle recovery, fraud prevention, insurance or accident investigation, and lawful enforcement of the Vehicle Subscription Agreement. Access must be limited to authorised people and necessary service providers for these purposes.

We explain the equipment and monitoring that apply to your vehicle, the relevant provider and retention arrangements before handover. The application includes a separate acknowledgement; the vehicle agreement records the applicable arrangements. Inform every authorised driver that monitoring may be present. This notice does not mean every listed capability is installed on every vehicle.

Tracking is not permission to record cabin audio, sell journey histories or monitor unrelated private activity. If a fitted system supports remote immobilisation, its use requires lawful authority, authorised human approval and verified safe stationary conditions. It must not disable a moving vehicle or create a safety risk. Contact us about suspected inaccurate records or misuse.

We collect only information relevant to the service, verification or event involved. Some information comes directly from you; other records arise from your subscription, our systems or lawful third-party checks.

• Identity and contact: full name, date of birth, nationality, NRIC or passport details and images, driving licence and entitlement, phone number, email and residential address.
• Identity verification (KYC): document checks, selfie or live-camera identity images, verification outcomes and fraud indicators. Facial matching or biometric templates, if used, require a specific explanation and explicit consent or another applicable legal exception before processing.
• Employment and affordability: employment status, employer or business information, income and supporting evidence where required to assess an application.
• Payments and transactions: payment requests, provider references, amounts, methods, transaction status, invoices, deposit balances, refunds and disputes. Your bank, wallet or payment provider handles payment credentials and authorisation.
• Subscription records: applications, review decisions, selected vehicle and plan, agreements, authorised drivers, delivery arrangements, service history and customer requests.
• Handover and return: condition reports, photographs, odometer and fuel readings, signed acknowledgements, keys and equipment records, and assessed damage.
• GPS and telematics: the location, mileage, trip, ignition, vehicle, security, tamper and geofence information described above, where the vehicle is equipped.
• Support and incidents: correspondence, complaints, accident or theft reports, supporting photos, police or insurance references and relevant third-party details. Health or injury information is handled only when necessary and with the safeguards and consent or exceptions required by law.
• Emergency contacts and technical records: emergency contact name, relationship and phone number; account/session identifiers, device and browser information, IP addresses, security logs and browser-storage preferences. Tell your emergency contact you have supplied their details.

We use information to provide and administer Rivo services, fulfil relevant agreements, comply with legal obligations and process data with consent where required or another ground permitted by Malaysian law. We do not treat browsing as consent to optional marketing or sensitive-data processing.

• Verify identity, driving entitlement and application information; assess eligibility and affordability where needed; detect impersonation and prevent fraud.
• Process an application, communicate decisions, prepare agreements, arrange delivery and returns, administer mileage, servicing, deposits, payments and refunds.
• Keep accounts, vehicles and customers safe; investigate accidents, theft, security events and suspected agreement breaches; support insurance claims and lawful recovery.
• Handle support requests, disputes, accounting, regulatory enquiries and legal claims; maintain proportionate service and security records.
• Send requested service messages and verification codes. Optional marketing is a separate choice, and you can withdraw that choice without losing access to your subscription.

Sources include you and authorised drivers, your application and uploaded documents, account activity, payment providers, disclosed KYC partners, vehicle owners or suppliers, handover teams, repairers, roadside assistance, insurers, authorities and the GPS or telematics systems fitted to a vehicle. Third-party information is used only where collection and disclosure are lawful.

Do not supply another person’s identity documents without authority. Where you give us an emergency contact, witness or authorised driver’s details, tell them why their information is being provided and direct them to this notice.

Identity, valid driving entitlement, contact details and information necessary to assess and administer your subscription are required. Not providing essential information, or withdrawing a consent needed for a lawful check or disclosed monitoring arrangement, may prevent approval or continued provision of the affected service. We explain the practical effect and any available alternatives; withdrawal does not automatically erase contractual or statutory obligations.

Selfie capture requests camera access only when you choose that verification step. We do not continuously access your camera or use your browser’s precise location permission to enable vehicle tracking. Vehicle GPS, where fitted, operates independently of browser location permission.

You can ask questions or exercise choices through [email protected] in English or Bahasa Malaysia. Optional marketing, non-essential tracking technologies and any new sensitive-data purpose require appropriate separate choices before use.

We do not sell your personal data. Access and disclosure are limited to what the recipient needs for an explained, lawful purpose. A fleet supplier does not receive unrestricted access to your identity or income documents merely because it supplies a vehicle.

• Authorised Rivo staff and service providers for hosting, database and authentication, secure document storage, email, communications, security and customer support. Current website services include Cloudflare, Neon and Resend.
• HitPay and the bank or wallet used for a payment, for authorisation, transaction processing, reconciliation, fraud controls and refunds.
• KYC and identity-verification providers if engaged for your application; GPS or telematics providers where fitted, for the disclosed verification, monitoring and security purposes. We identify relevant vehicle-specific arrangements before handover.
• The identified vehicle supplier, authorised delivery teams, workshops, roadside assistance, insurers and claims handlers for necessary subscription, servicing, safety, recovery and incident work.
• Professional advisers, auditors, law enforcement, regulators or courts where disclosure is necessary and lawful; or a business successor subject to safeguards and appropriate notice.

Some hosting, authentication, storage, email, payment, support or other service providers may process personal data outside Malaysia. Transfers are for the same disclosed service, security, payment or operational purposes, and involve the relevant classes of recipient above.

We assess and use an applicable basis and safeguards under Malaysian cross-border transfer requirements, including appropriate contractual and security protections and consent where that is the applicable basis. Request details about current destinations, recipients and safeguards at [email protected].

The site retrieves fonts from Google Fonts; this sends connection information such as your IP address to Google. See the Cookie Notice for browser storage and external services. We update this notice when material provider or processing arrangements change.

We keep records only as long as needed for the stated purpose, contractual administration, accounting and tax, insurance, fraud prevention, legal obligations or an active dispute, then securely delete or anonymise them. Different record types have different periods.

The current routine deletion process makes unfinished application details and verification files eligible after 30 days of inactivity, declined or withdrawn applications after 90 days, and ended or cancelled subscription application details and verification files 180 days after the recorded end date. Processing is scheduled and may occur in batches. A documented legal or dispute hold pauses relevant deletion. These periods do not automatically delete invoices, signed contracts or records that must lawfully be kept longer.

Encrypted operational backups expire after seven days under the current backup lifecycle. Minimal audit, security and transaction records may remain for their necessary purposes. GPS and trip-data retention depends on the fitted service and is disclosed with the vehicle’s monitoring arrangements; it must be limited to operational need, with relevant incident extracts preserved only where justified. Ask us about the period applying to a particular record.

Safeguards include encrypted transmission, encrypted application details and verification files in storage, private document storage, account ownership checks, restricted staff access, staff verification and audit records. We limit access to people who need it and review service-provider protections.

No system can guarantee absolute security. Use a device and email account you control, keep verification codes private, sign out on shared devices and tell us promptly about suspected account misuse or data exposure. Where a breach triggers notification duties, we notify the Commissioner and affected people as required by applicable law.

Subject to applicable requirements and exceptions, you may request access to your information, correction of inaccurate data, withdrawal of consent, prevention of direct marketing or processing likely to cause damage or distress, and applicable data portability. You may also ask about retention, deletion, monitoring records and the reasons for an application decision, including human review. These requests do not automatically override information that must lawfully be retained.

Email [email protected] with your account email, the information or action requested and a safe contact method. Do not attach identity documents unless we provide a secure route. We may verify identity, seek reasonable clarification and explain any applicable fee, exception or refusal. We respond within the applicable legal timeframe and explain any permitted extension. You can make requests in English or Bahasa Malaysia.

You may complain to Malaysia’s Personal Data Protection Commissioner through the official channels at pdp.gov.my. Our service contact is [email protected]; privacy requests can also be raised through Get in touch for routing to the privacy team.

The date above identifies this notice’s current version. Material changes to collection, purposes, monitoring or sharing will be communicated through an appropriate channel. We obtain new consent where required, and do not treat an updated page as retrospective permission for an unrelated use of existing information. English and Bahasa Malaysia versions are available here; contact us if any wording needs clarification.