1. Who we are
MASA (the Malaysia Automotive App) is provided by the Malaysia Automotive, Robotics and IoT Institute (MARii). This policy explains how MARii (“we”, “us” or “our”) collects, uses, discloses, stores and protects personal data through the MASA mobile application, website, support services and connected MASA features.
We process personal data in accordance with Malaysia’s Personal Data Protection Act 2010 and other applicable requirements.
2. Personal data we may collect
- Account and profile data: name, mobile number, email address, gender and identification or passport number where required for identity, programme or redemption verification.
- Authentication data: verification status, one-time-password records, login activity, account tokens and security events. We do not ask you to disclose your password or OTP to support staff.
- Programme and transaction data: Auto Points activity, QR scans, rewards, vouchers, redemptions, digital passcodes, programme participation and related history.
- Device and technical data: app version, device and operating-system information, IP address, diagnostic logs, crash information and security signals.
- Communications: messages, screenshots and other information you provide when contacting support.
- Optional device permissions: approximate or precise location when you request nearby EV chargers, workshops or directions; camera access when you use QR scanning; and a notification token when you enable push notifications.
Some MASA services can be viewed without an account. Where information is required, the relevant screen or programme will identify the fields you must provide.
3. How we use personal data
- Create, authenticate, secure and administer your MASA account.
- Provide app features, including Auto Points, rewards, vouchers, digital passcodes, automotive information, events, news and participating MARii services.
- Verify eligibility, prevent duplicate or fraudulent activity, process redemptions and maintain transaction records.
- Show nearby services or pass a destination to a maps application when you request location-based features.
- Deliver service messages, security notices, programme updates and notifications you have enabled.
- Respond to support, privacy, correction and account-deletion requests.
- Monitor performance, diagnose errors, improve MASA and comply with legal, regulatory, audit and security obligations.
4. When we disclose data
We may disclose only the data reasonably needed to:
- Vendors and service providers that support hosting, authentication, messaging, analytics, security, customer support and app operations.
- MARii programmes, participating merchants or programme partners where needed to validate access, fulfil a reward or provide a service you request.
- Professional advisers, auditors, regulators, courts or law-enforcement authorities when required or permitted by law.
- A successor organisation in connection with a lawful restructuring or transfer, subject to appropriate safeguards.
MASA may open external MARii platforms, maps, websites or partner services. Information you provide directly to those services is also governed by their own privacy notices.
5. Device permissions and your choices
Location, camera and notification permissions are requested through your device when needed. You can refuse or later disable them in iOS or Android settings, although the related feature may then be unavailable. You can also manage notification preferences through your device.
6. Storage, international processing and security
We use reasonable administrative, technical and physical safeguards designed to protect personal data, including access controls and encrypted network connections where supported. No system can guarantee absolute security.
Our service providers may process data in Malaysia or other countries. Where personal data is processed outside Malaysia, we take reasonable steps to require an appropriate level of protection consistent with applicable law.
7. Retention
We retain personal data only for as long as reasonably needed for the purposes described above. Retention periods depend on the type of record and may be extended for legal, regulatory, security, fraud-prevention, audit, dispute or transaction-record obligations. Data that is no longer required will be deleted, anonymised or securely disposed of.
8. Access, correction and deletion
You may update available profile fields in MASA or request access to or correction of your personal data by emailing info@marii.my. We may verify your identity before acting on a request.
To delete your MASA account, use Delete Account in the signed-in app or follow our account-deletion instructions. Certain records may still be retained where required or permitted by law.
9. Changes and contact
We may update this policy as MASA, our practices or legal requirements change. The latest version and its updated date will be published on this page.
For privacy questions or requests, email info@marii.my or contact MARii at +603 8318 7742.