Privacy notice
How we collect, protect and use your information.
01Who is responsible for your data
Rent Rivo operates the Rivo platform at rentrivo.com. This notice explains how personal data is handled when you browse, apply, subscribe, contact us or register as a fleet partner.
Contact [email protected] for privacy requests. A vehicle supplier named in your agreement may separately control information required for its own insurance, servicing and legal obligations. We identify that supplier before you commit.
02Information we collect
The information needed depends on the service you use. We collect data you provide, information generated while delivering the service and relevant information received from approved verification and service partners.
- Identity and contact: name, date of birth, nationality, IC or passport, driving licence, address, email and phone number.
- Verification: document images, licence validity, selfie or live-camera capture and verification results. Biometric templates, if introduced, require a specific explanation and explicit consent before processing.
- Affordability and application: employment, income evidence, emergency contact and application decisions. Please tell your emergency contact that you have provided their details; we use them for genuine emergencies and appropriate contact escalation, not marketing.
- Subscription and payments: vehicle, term, mileage plan, agreements, invoices, deposit records and payment transaction references. Payment providers handle card credentials; any future saved-card or recurring-payment mandate will be explained separately.
- Vehicle and support: handover and return photos, odometer, fuel, damage, service, incident reports, correspondence and any disclosed telematics information.
- Website use: session identifiers, browser and device details, security logs and preferences.
03How and why we use information
We use personal data for the purposes explained when it is collected, with consent where required and other grounds permitted by Malaysian law. We do not treat visiting this page as consent to sensitive-data processing or optional marketing.
- Provide searches, applications, identity and licence checks, eligibility review and fraud prevention.
- Arrange subscriptions, agreements, delivery, servicing, insurance claims, invoices, refunds and support.
- Protect vehicles and accounts, investigate incidents, resolve disputes and fulfil legal or regulatory requirements.
- Improve reliability and the customer experience using proportionate operational information. Optional marketing and non-essential analytics require separate choices where applicable.
04Required information and your choices
Identity, valid driving entitlement, contact details and information necessary to assess and administer a subscription are required for an application. If you do not provide essential information, or withdraw consent necessary for a lawful verification process, we may be unable to proceed. Browsing does not require an application.
Optional marketing is separate from applying. You may unsubscribe without affecting your subscription. Camera access is requested when you choose selfie verification; we do not continuously access your camera. Additional sensitive or biometric processing will have a specific consent request.
05Who may receive information
Access is limited to the people and organisations that need information for the stated purpose. A fleet owner receives the operational information needed for its vehicle, not unrestricted access to your identity or income documents. We do not sell personal data.
- Authorised Rivo staff and contracted hosting, storage, security, communications and support providers.
- Verification and payment providers, insurers, roadside assistance, authorised workshops, delivery teams and the identified vehicle supplier.
- Professional advisers, auditors, authorities or parties involved in a genuine dispute, when disclosure is lawful and necessary.
- A successor to the business, subject to appropriate safeguards and notice of material changes.
06Storage and international transfers
Some service providers may process information outside Malaysia. Before using them, we assess the destination, applicable protections and contractual and security safeguards required by Malaysian law. Ask [email protected] for information about current providers and relevant transfer safeguards.
The current website loads fonts through Google Fonts. Your browser contacts that service to retrieve font files and sends connection information such as your IP address. Google's privacy policies apply to that service. Proposed infrastructure or a future integration is not evidence that your data has already been transferred to that provider. The notice and provider records must reflect services actually in use.
07Security and retention
Personal information should be protected through appropriate access controls, secure transmission and storage, limited staff access and oversight of service providers. Identity and income documents must not be placed in publicly accessible media storage. No system can promise absolute security.
Records are retained only as needed for the relevant purpose, legal obligations, accounting, insurance, fraud investigation or active disputes, then securely deleted or anonymised. Retention periods depend on the type of record and its purpose. A request for deletion does not override records that must lawfully be retained.
Where a personal-data breach triggers notification duties, we notify the Commissioner and affected people within the applicable requirements and provide relevant protective guidance.
08GPS, telematics and vehicle protection
Where equipped and disclosed before agreement, a vehicle may have primary or backup GPS, odometer and trip information, ignition or online status, battery and tamper alerts, geofencing and remote immobilisation capability. This can reveal location and travel patterns. It is used for fleet safety, recovery, maintenance, mileage administration and investigation of genuine incidents or agreement breaches.
We explain the equipment, purposes, access, retention and any third-party provider before activating it for your subscription. Tracking access is restricted and logged. It is not permission to monitor unrelated private activity, record cabin audio or sell journey histories. Inform authorised drivers that tracking is present.
Immobilisation, if supported, is subject to law, the agreement, authorised human approval and verified safe conditions. A vehicle must never be remotely disabled while moving or where doing so creates a safety risk. Do not remove or interfere with protective equipment.
09Cookies and browser storage
Essential browser storage can remember your selected plan and application progress and support basic security. Your application progress is stored in your browser session; shared-device users should close the session or clear stored data after use.
If optional analytics, advertising or profiling tools are introduced, we identify them and offer the required choices before they run. A privacy notice alone is not an analytics consent mechanism. You can manage browser storage through your browser, although some features may stop working.
10Your privacy rights
Subject to applicable requirements and exceptions, you may request access to and correction of personal data, withdraw consent, object to direct marketing, request applicable data portability and ask about retention or deletion. We may reasonably verify your identity and explain any lawful fee, exception or inability to comply.
Email [email protected] with your request and enough information to identify your account. Do not send identity documents unless we provide a secure method. If a decision significantly affects your application, you may ask for an explanation and human review; we do not authorise unexplained automated risk decisions through this notice.
You may also raise a complaint with Malaysia’s Personal Data Protection Commissioner through the official channels at pdp.gov.my.
11Changes to this notice
The update date identifies the current version of this notice. Material changes in collection, purpose, recipients or tracking will be communicated through an appropriate channel; new consent is obtained when required. An updated notice does not retrospectively authorise unrelated use of previously collected data.
