Last updated: 9 September 2026
Bangsa Bertauhid Sdn Bhd, the operator of Misi Delivery (“Misi”, “we”, “us” or “the Company”), is responsible for the processing of personal data described in this policy.
This policy explains how we collect, use, retain and share personal data through the Misi application and Misi Partners application for Misi Delivery services. “Personal data” means information that can identify an individual, on its own or when combined with other information.
Our data collection practices differ depending on whether you are a customer, vendor or rider/driver. Customers are not tracked in the background. The background location access described in this policy is for riders/drivers to track the delivery process.
We collect and retain the following customer information:
Customer location is accessed while the application is open or in use, with location permission on your device. We do not track customer location in the background or continuously.
GPS location used to identify your current area is distinct from the delivery address you provide for an order. You should ensure that the delivery address for your order is correct.
We request a customer’s bank account number only when needed to process a refund.
To verify vendors wishing to sell through the application, we request Companies Commission of Malaysia (SSM) registration documents or an identification card (IC). These documents are used to verify the vendor’s participation as a merchant.
We also retain the following vendor information:
Vendor bank account numbers are retained for payment of sales proceeds.
We collect and retain the following rider/driver information:
We collect rider/driver location, including through background location access, to track the delivery process. Background access allows location to be obtained when the application is not displayed in the foreground, subject to device permissions.
Background location tracking starts when a rider/driver is online and stops when their status is changed to offline. While online, location may be accessed when the application is not displayed in the foreground. The tracking period depends on online status, rather than only on whether a delivery order is active.
This tracking relates to your role as a rider/driver. It does not apply to use of the application as a customer.
We obtain information from you during registration, vendor or rider/driver verification, address entry, payment arrangements and use of our services. Location is obtained from your device when the relevant permission is granted.
Information requested to identify customers, contact you and complete delivery is required for order handling. Vendor and rider/driver verification documents are required for their respective verification processes. Vendor and rider/driver bank account numbers are required for payments by bank transfer.
A customer’s bank account number is requested only when needed for a refund by bank transfer. If required information is not provided, the related transaction or process may not be completed. This does not mean that every party must provide every category of data in this policy.
You can manage location permissions through your device settings. Without location permission, customer area detection or rider/driver delivery tracking may not function. The permission required depends on your role and the function you use.
We process data for the specific purposes explained for each category above, including order management, partner verification, delivery, refunds and payment of sales proceeds or earnings.
We may also process relevant data to address complaints, prevent fraud, resolve disputes and meet legal obligations. Processing is based on your consent or another basis permitted by law, including where necessary to perform a contract or comply with a legal obligation. Specific consent will be obtained where required.
We share data to the extent necessary for the purposes explained in this policy with the following categories of parties:
Parties processing data on our behalf may use it only for the specified purposes and are subject to confidentiality and data protection obligations. We do not sell personal data.
Banks or third parties processing data independently may be subject to their own privacy policies. Processing carried out by Misi remains subject to this policy.
We retain personal data only for as long as necessary for the purpose of collection, provision of services, legal obligations and resolution of disputes.
Retention depends on the category and purpose of the data. Retention of account data, verification documents, payment records and location data is determined by the purpose of the data, service requirements, legal obligations and resolution of disputes. Saved location data is not retained indefinitely merely because it has been collected.
When data is no longer required, we take reasonable steps to delete it securely or make it no longer identifiable with an individual.
You may request account closure or data deletion using the contact details in Section 14. Account closure does not necessarily result in immediate deletion of every record; data still needed for legal reasons or disputes may be retained to the extent necessary. We will explain any limitations relevant to your request.
We take appropriate security measures to protect data against loss, misuse, alteration and unauthorised access or disclosure. These measures include controls on access to data and protection of connections during data transmission.
If a data breach occurs, we will assess the incident, take appropriate action and notify the Personal Data Protection Commissioner and affected individuals where required, in accordance with the conditions and timeframes prescribed by law.
If your data is transferred, stored or processed outside Malaysia through our service providers, the transfer will comply with applicable data protection requirements. We will use appropriate safeguards and provide notice or obtain consent where required.
Subject to applicable law, you may:
Send requests to support@misirakyat.com, stating your request and relevant account information. We may request reasonable information to verify your identity before processing a request.
Withdrawal of consent may affect functions that depend on that processing. It does not automatically delete all records or prevent other processing that remains permitted or required by law. We will explain the implications where applicable.
If your privacy complaint cannot be resolved, you may refer it to the Personal Data Protection Commissioner of Malaysia.
Our services are not intended for children under 13. We do not knowingly collect personal data from children below that age.
Where processing of personal data relating to an individual under 18 requires consent, that consent must be provided by a parent, guardian or person with parental responsibility. This provision does not change the age eligibility requirements for any Misi role or service.
We may update this policy when our services, data processing practices or legal requirements change. The latest version will be made available through the application or Misi’s official website with its updated date.
We will communicate material changes through appropriate channels. If a change requires additional consent, we will obtain it before the relevant processing begins.
For questions, privacy complaints or requests for access, correction or deletion of data, contact:
Misi Delivery Privacy Enquiries
Bangsa Bertauhid Sdn Bhd
Email: support@misirakyat.com
No. 32-34, Jalan Niaga Bestari 1
Puncak Bestari
42300 Puncak Alam
Selangor, Malaysia