MyQRContact Privacy Policy and Personal Data Protection Notice

Public URL: https://www.platehaus.my/qr/privacy-policy
Bahasa Malaysia: https://www.platehaus.my/qr/privacy-policy?lang=ms
Privacy Choices: https://www.platehaus.my/qr/privacy-choices
Operator / Data Controller: Platehaus Sdn. Bhd. (SSM: 202501045049)
Brand / Service: MyQRContact (by Platehaus)
Registered Address: CT-06-21 Subang Square Corporate Tower, Jalan SS15/4G, SS15, 47500 Subang Jaya, Selangor, Malaysia
Privacy contact: support@platehaus.my
UK representative: Appointment pending; the appointed representative's details must be published here before intentional UK launch
Effective Date: 15 August 2026
Version: v1.6

This notice is provided in English and Bahasa Malaysia. If there is any inconsistency, the English version applies unless Malaysian law requires otherwise.

Snapshot

MyQRContact is a vehicle contact and records product. It has three surfaces that collect data differently:

MyQRContact app (Apple App Store and Google Play): owner and scanner tools on your phone. No advertising SDK, no analytics SDK, no tracking, no GPS, and no IP-derived location.
MyQRContact website (www.platehaus.my/qr and related scan/contact pages): sticker landing, web contact, and web dashboard. Approximate location from network headers may be stored for web contact events only. Marketing pixels used on the Platehaus marketplace are not loaded on /qr routes.
Sticker shop (www.myqrcontact.store): physical QR sticker orders through Shopify. The store processes order, delivery, checkout, fraud-prevention, cookie, storefront analytics, and optional marketing data separately from the App and /qr website.

We do not sell your personal data. We do not use the MyQRContact app to track you across other companies’ apps or websites. Camera frames used to scan a sticker stay on the device.

This policy should be read with the MyQRContact Terms of Service.

1. Scope and roles

1.1 This Privacy Policy explains how Platehaus collects, uses, discloses, stores, protects, transfers, and retains personal data when you buy, activate, install, scan, access, or use MyQRContact, including:

physical QR windshield stickers and activation codes;
the MyQRContact Sticker Store at www.myqrcontact.store, including checkout, orders, returns, and delivery;
MyQRContact scan and owner-contact flows on web and mobile;
Car Dashboards and vehicle records;
dashboard invitations and access requests;
Telegram bot setup, test alerts, and contact alerts;
the MyQRContact mobile applications distributed through the Apple App Store and Google Play;
reports, support requests, emails, APIs, and related websites.

1.2 This policy applies to Owners, Scanners, Authorized Users, access requesters, invited users, fleet users, business customers, administrators, support users, emergency contacts, and anyone else whose personal data is processed through MyQRContact.

1.3 Platehaus Sdn. Bhd. is the data controller for personal data that Platehaus decides how and why to process for MyQRContact. Companies that process personal data on our behalf (hosting, database, email, push delivery) act as processors or service providers.

1.4 When you choose to open Phone, WhatsApp, or Telegram, those companies act as independent controllers under their own policies. We do not control their processing.

1.5 Owners, fleet operators, employers, and other users may also be responsible for personal data they enter about other people (for example an emergency contact). You must not provide another person’s personal data unless you have a lawful basis, authority, consent, or legitimate reason to do so.

2. Malaysian Personal Data Protection Notice

2.1 This policy is intended to operate as a personal data protection notice for MyQRContact under Malaysia’s Personal Data Protection Act 2010, as amended, including the Personal Data Protection (Amendment) Act 2024. We process personal data in line with the principles of consent, notice and choice, disclosure, security, retention, data integrity, and access, and with the 2024 duties on data controllers, processors, data protection officers, data breach notification, data portability, and cross-border transfers where they apply.

2.2 A Bahasa Malaysia version is available at the URL above and through the language control on this page.

2.3 Privacy and data-subject requests: support@platehaus.my. This is our published business contact for privacy enquiries, complaints, and rights requests.

3. What the MyQRContact app collects

This section is the App Store / Google Play description. “Collect” means data leaves the device and is stored long enough for us or a service provider to access it after the request is finished. Data processed only on the device is not collected.

3.1 We collect in the app

Account: user ID, email address (including a Sign in with Apple Hide My Email relay address), optional name, authentication metadata, role and permission data.
Owner / driver contact setup: name, phone country code, national number, E.164 number, preferred methods (call, WhatsApp, Telegram).
Emergency contact: name and phone number you type in.
Vehicle and records: country, optional subdivision, registration, nickname, structured record types (including service, road tax, insurance, vehicle loan, and tyres), dates, reminder settings, and optional notes attached to those supported record types. The standalone General Note record type is disabled at launch.
Optional financial details in records: if you add a Vehicle Loan record, you may type only the last four digits of the loan account number, plus a monthly payment. You may also type insurer, premium, or similar Insurance-record details. We store these as your vehicle records for reminders. We do not store the full loan account number, process card payments in the app, run credit checks, or use this information for lending.
Contact events: selected reason and method, event ID, status, timestamps, and (if you are signed in) your user ID.
Push: Expo / APNs / FCM push token, optional device model name, and app version, so we can send owner alerts and reminders.
Invites and access: invited email, role, tokens, requester profile snapshot, and approval records.
Reports and support: report reason, related event details, and messages you send to support.
Security identifiers: IP address and a hashed IP used only to rate-limit abuse and correlate suspicious lookups. We do not use app requests to determine or store your location.

3.2 We do not collect in the app

Precise or coarse location, GPS, or IP-derived city / region / latitude / longitude.
Advertising identifiers (IDFA), App Tracking Transparency tracking, or advertising click IDs.
Analytics, crash, or marketing pixels. There is no Google Analytics, Google Ads, TikTok, or similar SDK in the app.
Address-book contacts. Emergency contact is typed by you, not read from your phone contacts.
Camera frames or QR images. The camera is used only to read a sticker URL on the device.
Vehicle-record photos, videos, PDFs, or other file attachments. Record attachment uploads are disabled at launch.
Microphone, health, fitness, browsing history, or precise payment card data.

3.3 App permissions

Camera: optional, to scan a windshield QR sticker. Frames are not uploaded.
Notifications: optional, for contact alerts and reminders. Refusing notifications does not block the rest of the app.

3.4 On-device data

Theme, language, and similar preferences may stay on the device. Auth tokens are stored in the device secure storage. Contact-flow resume data may remain on the device until cleared.

4. What the MyQRContact website collects

Website collection applies when someone uses the browser flows on platehaus.my (scan, contact, activate, dashboard), including a scanner who never installs the app.

4.1 Web contact and scan events

In addition to the account, vehicle, contact, and record data in section 3, a web contact or lookup may store:

approximate location from hosting network headers: country, region, city, and timezone;
IP address, user agent, referrer, and request security metadata;
hashed IP and a correlation hash of selected browser metadata for abuse detection;
scan-session identifiers, UTM parameters, and advertising click IDs if they are already present in the page URL;
browser and device metadata submitted by the web contact page (language, timezone, viewport, and similar);
privacy signals such as Global Privacy Control where the browser sends them.

We do not store latitude or longitude from network headers. Approximate city / region / country may be shown to the vehicle owner as part of a contact event so they can judge whether an approach looks genuine or abusive.

4.2 Cookies and pixels on `/qr` pages

/qr routes use a lightweight shell. Google Analytics, Google Ads, TikTok Pixel, and Vercel page analytics are not loaded on those routes. The web contact flow may still record URL parameters that a visitor already has (for example a click ID in the query string) as security and source metadata. Marketplace advertising tools on other platehaus.my pages are described in the general Platehaus Privacy Policy and Cookie Policy.

4.3 What we still do not do on the website

We do not use the MyQRContact web contact flow to build advertising profiles, to retarget scanners in other companies’ apps, or to sell lists of plate lookups.

5. Sticker Store purchase, activation, and storefront data

When you visit the Sticker Store, buy a physical Sticker, request a return, or activate a code, we may process:

name, email, phone number, billing and delivery addresses, country, and customer-account details;
items, pack choice, price, currency, taxes, discounts, order status, payment status, refunds, and support history;
checkout, fraud-prevention, IP address, browser, device, cookie, referral, storefront interaction, and marketing-consent data processed through Shopify;
delivery method, shipment status, tracking details, and delivery communications;
activation code, status, dates, and linked user ID;
vehicle registration entered at activation;
separate Terms-acceptance, privacy-notice-presentation, and optional-consent evidence records.

Full payment-card details are entered into Shopify's checkout or the selected payment provider and are not stored by MyQRContact as card numbers. Shopify, a payment provider, a fraud-prevention provider, and a delivery carrier may process data under their own notices where they decide their own purposes and means.

The Sticker Store may use Shopify's essential, preference, analytics, and marketing technologies. Optional technologies are subject to the consent and opt-out controls made available for the visitor's region. Storefront analytics and advertising measurement do not change the App and /qr statements in sections 3 and 4.

6. Telegram bot data

If you connect Telegram, we may collect Telegram chat ID, user ID, username, first and last name, connection and delivery status, test-alert timestamps, hashed connect tokens, message IDs, and webhook metadata needed to operate the bot. Telegram processes that data under Telegram’s terms. The Telegram contact flow is designed not to reveal your phone number to the scanner through MyQRContact.

7. Sources of personal data

We collect personal data:

directly from you;
automatically from the browser on web requests, as described in section 4;
from the app as described in section 3 (including a hashed IP for abuse control, not for location);
from authentication, hosting, database, email, Telegram, and push providers acting for us;
from other users (invites, access requests, emergency contact details you or they enter); and
from abuse reports and support investigations.

If another user gives us your information — for example as an emergency contact, driver, employee, family member, invitee, or requested dashboard user — we may not have collected it from you. The categories are usually identity/contact details, relationship or role, vehicle/dashboard association, invitation or access status, and related communications. When we first contact you, our message should link to this notice or an equivalent concise notice. If we do not contact you directly, we assess when and how the information must be provided under applicable law, including UK GDPR Article 14, rather than assuming the other user has completed Platehaus's transparency duty.

8. Purposes of processing

We process personal data to:

sell, deliver, replace, support, and manage stickers;
activate vehicles and prevent duplicate or unauthorized activation;
create Contact Events and let scanners choose a reason and method;
provide enabled contact methods;
send Telegram and push alerts, including setup test alerts;
maintain dashboard records and reminders;
manage roles, invitations, and access requests;
detect, prevent, investigate, and respond to harassment, scams, stalking, spam, false reports, scraping, fraud, and security incidents;
keep consent, audit, and evidential logs;
provide customer support;
operate, debug, and secure the service;
comply with law and enforce the Terms; and
send service messages (security, legal, activation, alerts). We do not use app-collected email addresses for advertising or marketing unless you opt in.

We do not sell your personal data. We do not use MyQRContact app data for third-party advertising, first-party advertising, or cross-company tracking.

9. Lawfulness, consent, necessity, and required data

9.1 A Privacy Policy is a notice, not blanket consent. Agreeing to the Terms, being shown this notice, granting an operating-system permission, and opting into an optional use are separate events. Platehaus records them separately where evidence is needed.

9.2 For people in the UK, our intended UK GDPR Article 6 bases are:

Contract: account creation and authentication, activation, dashboard access and records, requested contact routing, requested notifications, order fulfilment, and support needed to provide the product or service you request.
Legitimate interests: service security, proportionate abuse/fraud prevention, duplicate or unauthorized activation prevention, service debugging, enforcing the Terms, defending legal claims, and necessary business administration. Our interests are providing a safe and reliable vehicle-contact service and protecting users, Platehaus, vehicles and the public. We must balance those interests against your rights and may not use this basis where your rights override them.
Legal obligation: tax/accounting records, lawful regulatory or court duties, data-rights handling, and personal-data-breach duties where applicable.
Consent: optional marketing and an optional contact/notification connection where applicable law requires consent. Consent is specific and withdrawable; withdrawing it does not affect processing already lawfully completed.
Vital interests: only in a genuine life-or-death situation where the legal test is met; MyQRContact is not an emergency service and does not routinely rely on this basis.

9.3 Some data is required to provide the feature you request: an activation code and registration to activate; Terms-acceptance and notice-presentation evidence where needed; phone details if you enable call or WhatsApp; Telegram identifiers if you connect Telegram; contact-event data to route a contact; and proportionate security metadata to limit abuse. If you do not provide required data, that feature may not work.

9.4 Optional data includes dashboard records, reminders, contact methods you do not enable, Telegram connection, push permission, and marketing. A choice is not treated as optional if the product makes it a condition of an unrelated service.

9.5 If you withdraw consent, we stop the relevant consent-based processing where required. We may still process data under another identified basis, including contract, legal obligation, security, legal claims, or abuse prevention. We will not switch bases merely to defeat a valid withdrawal.

10. Data about other people

10.1 Do not provide another person’s personal data unless you have a lawful basis, authority, consent, or legitimate reason.

10.2 If you add an emergency contact, employee, fleet, family, or driver details, you are responsible for informing those people where required and for keeping the information accurate.

10.3 Do not enter identity-document contents, payment credentials, medical information, biometric data, children’s data, or other unnecessary sensitive information in records, notes, reports, or support messages.

11. Who can see or receive data

11.1 Owners and authorized users

Owners and authorized dashboard users may see records, contact events, and (for web contact events) approximate city / region / country, plus invitations and access requests, according to role.

11.2 Scanners

Scanners see only the contact flow needed to complete the selected method. If call or WhatsApp is enabled, a scanner who is allowed to proceed may be redirected to the owner’s number. Telegram does not reveal the owner’s number through MyQRContact.

11.3 Service providers and commerce partners

We disclose personal data to providers that help us operate MyQRContact and the Sticker Store. Where a provider acts as our processor, it may use data only to provide the contracted services and must apply appropriate contractual, organizational, and security safeguards. Some commerce partners may act as independent controllers for parts of payment, fraud prevention, delivery, or platform-security processing under their own notices.

Named providers used for MyQRContact today:

Supabase — authentication and database services. Primary region: Singapore.
Vercel — website and API hosting. Singapore plus a global edge network.
Cloudflare — DNS, CDN, WAF, and (on web) Turnstile bot checks. Global edge.
Twilio SendGrid — transactional email.
Expo and Apple Push Notification service / Firebase Cloud Messaging — app push delivery.
Apple — Sign in with Apple.
Google — Google Sign-In on Android; not used as an advertising SDK in the app.
Shopify — Sticker Store hosting, customer accounts, checkout, order administration, platform security, storefront analytics, and commerce infrastructure.
Payment providers and delivery carriers shown at checkout or in an order confirmation — payment authorization, fraud checks, refunds, shipping, tracking, and delivery.

We do not place Google Analytics, Google Ads, or TikTok SDKs in the MyQRContact app. Those tools may run on other platehaus.my marketplace pages, not on /qr routes.

11.4 Independent services you open

Phone networks, WhatsApp, and Telegram process data under their own terms when you choose those methods. We are not their processor, and they are not required to follow this policy except where the law says otherwise.

11.5 Authorities, safety, legal claims, and business transfers

We may disclose data if reasonably necessary to comply with law, protect safety, prevent crime or abuse, enforce the Terms, or support a merger or sale of the MyQRContact business with appropriate continuity protections.

12. Direct phone, WhatsApp, and Telegram visibility

12.1 If you enable call or WhatsApp, your phone number may be disclosed to a scanner and to the phone, WhatsApp, or network they use.

12.2 If you enable Telegram, Telegram will process your Telegram account under Telegram’s policies. MyQRContact is designed not to show your phone number to the scanner in that flow.

12.3 We use confirmation prompts, warnings, test alerts, and separate confirmation/evidence records so that visibility and notification limits were explained.

13. Cross-border transfers

13.1 Providers may process data in Malaysia, Singapore, and other countries, including at a global network edge.

13.2 Where personal data is transferred outside Malaysia, we rely on bases permitted under PDPA section 129 and the 2025 cross-border guidelines, including contractual safeguards, due diligence, necessity to perform the service, legal claims, and consent where appropriate. We limit what is transferred, use encryption in transit, and require processors to apply appropriate security.

13.3 You may request a summary of key processor safeguards (commercially sensitive terms redacted) at support@platehaus.my.

13.4 For UK personal data, a transfer from a UK sender to Platehaus or another separate recipient outside the UK may be a restricted transfer. Before intentional UK launch, Platehaus must verify each transfer route and use applicable UK adequacy regulations, the UK International Data Transfer Agreement or UK Addendum with a transfer risk assessment, or another lawful UK GDPR mechanism. This paragraph describes the required control; it does not claim that an unverified provider contract is already complete.

14. Security

14.1 Current controls include account authentication, role-based dashboard access, database row-level security, service-role restricted server operations, hashed Telegram connect tokens, webhook verification, rate limits, separate legal-event evidence, contact-event reporting, and audit logs for sensitive actions. Vehicle-record attachment upload requests are rejected by the service.

14.2 No method of transmission or storage is completely secure.

14.3 You are responsible for keeping your account, devices, passwords, Telegram connection, and invitations secure.

15. Data breach handling

15.1 If we have reason to believe a personal data breach has occurred, we will assess it, contain it, and notify the Malaysian Personal Data Protection Commissioner as soon as practicable and, where the applicable guidelines specify a clock, within 72 hours of becoming aware.

15.2 If the breach is likely to cause significant harm, we will also notify affected individuals without unnecessary delay and, where the guidelines specify a clock, within 7 days after notifying the Commissioner.

15.3 We may provide information in phases, verify identity before discussing an account, and take steps such as credential resets, access restrictions, or disabling a contact method.

16. Retention

We keep personal data only as long as reasonably necessary for the purposes in this policy, or longer if required for legal, tax, security, dispute, or backup reasons.

Account and profile: while the account is active, then up to 7 years where needed for legal, dispute, abuse, tax, or audit records.
Sticker purchase and delivery: up to 7 years, or longer if required by law, tax, accounting, dispute, or warranty.
Activation records: for the life of the activated sticker or dashboard, then up to 7 years where needed.
Owner, driver, emergency contact, and method settings: while the dashboard is active or until updated or deleted, subject to backups and legal retention.
Contact events that result in a contact attempt: usually up to 24 months for safety, abuse prevention, reports, and legal claims, unless longer retention is needed.
Web scan / lookup security metadata without a completed contact: usually 90 to 365 days, unless linked to abuse, reports, or legal needs.
Telegram tokens: short setup life; expired or consumed tokens may be kept as security records.
Dashboard records: until deleted by an authorized user or dashboard closure, subject to backups and legal retention.
Invitations and access requests: while pending or active, and as needed for audit and abuse prevention.
Reports and abuse records: as long as needed to investigate and prevent repeated abuse; serious cases may be kept up to 7 years or longer if required.
Server and security logs: usually 90 to 365 days.
Consent records: as long as needed to prove notice, consent, and legal claims.
Backups: rolling provider cycles.

When data is no longer required, we take reasonable steps to delete, destroy, anonymize, or restrict it, subject to backups and the law.

17. Your choices

You may choose whether to activate a sticker; which contact methods to enable; whether to add dashboard records or an emergency contact; whom to invite; whether to connect Telegram; whether to report an event; and whether to opt in to any marketing.

Manage choices at:

In the app: Settings and each car’s contact / privacy setup. Delete account is Account → Delete account.
On the web: your dashboard and Platehaus Account settings.
Privacy Choices page: https://www.platehaus.my/qr/privacy-choices

If you enable call or WhatsApp, your number may be disclosed through those flows.

18. Your rights and how to request deletion

18.1 Subject to applicable law and proportionate identity verification, you may request access, correction, withdrawal of consent, limitation or restriction of certain processing, objection (including to direct marketing), deletion where applicable, a copy or export of certain data (including portability where applicable), and information about our practices.

18.2 We aim to acknowledge or provide an initial response within 14 days as an operational target. This does not shorten or replace a statutory deadline. For UK GDPR rights requests, we respond without undue delay and normally within one calendar month, subject to lawful identity/clarification pauses and extensions. We may refuse or limit a request only where the law allows, including to protect other people's rights, safety, legal claims, or applicable exemptions. A fee is charged only where applicable law permits it.

18.3 Your right to object: If we rely on legitimate interests, you may object to that processing based on your situation. We will stop unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. You may object to direct marketing at any time and we will stop using your data for that purpose.

18.4 How to delete your MyQRContact account

Sign in with the same email or Sign in with Apple / Google method.
In the app, open Account → Delete account. On the website, open Platehaus Account settings and choose Delete account.
Confirm the warning and complete any verification step.

You can also email support@platehaus.my or use https://www.platehaus.my/qr/support#account-deletion.

18.5 After deletion, MyQRContact vehicle data for that account is removed from active systems subject to backup cycles. We may retain sticker purchase / tax records, security and abuse logs, and other records the law requires. Sign in with Apple Hide My Email addresses are included in deletion of the Platehaus account.

18.6 Make a request or data-protection complaint at https://www.platehaus.my/qr/privacy-choices or support@platehaus.my. Electronic submissions receive a case reference. We investigate complaints without undue delay. For UK complaints, we acknowledge receipt within 30 days and communicate the outcome without unjustifiable or excessive delay.

19. Cookies, analytics, and tracking preferences

19.1 The app does not use cookies or third-party analytics SDKs.

19.2 The MyQRContact website may use cookies, local storage, and similar technologies for login, security, language, and abuse prevention. /qr pages do not load marketplace advertising pixels.

19.3 The Sticker Store uses Shopify technologies for checkout, security, customer accounts, preferences, storefront measurement, and, where enabled and permitted, marketing attribution. The store's cookie or privacy controls can be used to manage optional categories where available. Blocking essential technologies may prevent login, cart, or checkout from working.

19.4 You may also block cookies in the browser, but some web features may stop working. We honour legally required opt-outs. Global Privacy Control is recorded on web contact metadata where the browser sends it; it does not disable security rate limits.

20. Marketing and service messages

20.1 Service, safety, security, legal, support, activation, Telegram setup, and contact-alert messages are part of the service and may not be fully optional.

20.2 Optional marketing is not sent from MyQRContact app-collected emails unless you opt in. If you subscribe through the Sticker Store or another marketing form, we may use that submitted email and consent record for the stated marketing. You may opt out using the unsubscribe link or by emailing support@platehaus.my. Opting out of marketing does not stop service or order messages.

21. Children and minors

21.1 Accounts, activation, purchase, and dashboard management are not intended for persons under 18.

21.2 A minor may use the public scan flow only with appropriate authority or where reasonably necessary for a genuine vehicle-related safety or contact issue.

21.3 If we discover that a minor used the service without appropriate authority, we may delete or restrict the data.

21.4 Do not enter personal data about children in records, notes, reports, or support messages unless strictly necessary and lawful.

22. Sensitive personal data

Do not enter sensitive personal data unless it is strictly necessary and you have a lawful basis. This includes identity-document contents, health information, biometric data, financial account credentials, passwords, criminal allegations, and religious or political information. We may restrict or remove unnecessary sensitive data if we find it.

23. Accuracy

Keep your account, phone number, Telegram connection, emergency contact, registration, and records accurate. If data is linked to the wrong vehicle or account, email support@platehaus.my promptly.

24. Third-party links and trademarks

24.1 MyQRContact may link to Telegram, WhatsApp, phone apps, email, browsers, Apple, Google, Expo, and platehaus.my.

24.2 Processors in section 11.3 must provide equal protection as stated there. Independent apps you open have their own policies.

24.3 MyQRContact is not affiliated with, endorsed by, or partnered with WhatsApp, Meta Platforms, Inc., Telegram, or Telegram FZ-LLC. WhatsApp and Telegram marks are used only to label optional contact channels.

25. International users and UK information

The App Store and Google Play listings may be available outside Malaysia. Platehaus Sdn. Bhd. remains the controller. Additional rights may apply.

25.1 United Kingdom: The UK is an intended market. The UK GDPR applies to processing related to Platehaus's offering of MyQRContact goods or services to people in the UK. The purposes, Article 6 bases and legitimate interests are described in sections 8 and 9; recipients are in section 11; transfers are in section 13; retention is in section 16; and rights are in section 18.

25.2 UK representative: Platehaus has no identified UK establishment. Appointment of a written UK representative is therefore a launch requirement. The appointment is pending, and Platehaus will publish the representative's real name and UK contact details in this notice and at relevant collection points when appointed. Until then, contact support@platehaus.my. This interim contact does not replace the Article 27 appointment requirement.

25.3 UK complaints: You may complain to Platehaus using the route in section 18.6 and may also complain to the UK Information Commissioner's Office at https://ico.org.uk/make-a-complaint/. You do not lose any applicable right to go directly to the ICO.

25.4 European Economic Area: Availability in the EEA is a separate EU GDPR market decision. Platehaus does not claim that the UK representative will satisfy an EU representative requirement. An EEA launch must be approved and documented separately.

25.5 California / similar US state laws: we do not sell personal information. We do not share MyQRContact app personal information for cross-context behavioural advertising. The marketplace website's advertising measurement is separate and is described in the Platehaus Privacy Policy. State-specific rights apply where their legal thresholds and scope are met.

26. App Store Privacy Nutrition Label and Google Play Data Safety

This appendix is for the MyQRContact app. It does not describe website-only location metadata.

Apple — we collect, linked to identity, not used for tracking, purpose App Functionality:

Name (optional)
Email Address
Phone Number (optional until you enable call or WhatsApp)
Other User Content (plates, records, reports, contact reasons)
Other Financial Info (optional loan or insurance fields you type)
User ID
Device ID (push token; IP / hashed IP for abuse control, not location)
Product Interaction (contact, activation, access, and notification events)

Apple — not collected from the app: precise location, coarse location, address-book contacts, browsing history, search history, purchases, advertising data, crash data, tracking.

Tracking: No. Third-party advertising: No.

Google Play Data Safety: the app collects the types above; it does not share them with other companies for those companies’ own purposes. Processors listed in section 11.3 process data for us. Data is encrypted in transit. Users can request deletion as in section 18.

If our practices change, we will update this appendix, App Store Connect, and Google Play Data Safety.

27. Changes to this policy

We may update this policy. If changes materially affect how we process personal data, we will use reasonable efforts to notify you by website notice, in-app notice, or email. Showing or acknowledging an updated notice is not recorded as consent. We request a new consent only where the changed processing actually requires one, and request fresh Terms acceptance only where the contractual change requires it.

28. Contact and complaints

Email: support@platehaus.my
Privacy Choices: https://www.platehaus.my/qr/privacy-choices
Operator: Platehaus Sdn. Bhd. (SSM: 202501045049)
Person in charge for privacy enquiries and complaints: Ariiq Zulkarnaen bin Jebat
Designation: Privacy Lead
Registered Address: CT-06-21 Subang Square Corporate Tower, Jalan SS15/4G, SS15, 47500 Subang Jaya, Selangor, Malaysia

You may complain to the Malaysian Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi) where applicable.

If the UK GDPR applies to your processing, you may also complain to the UK Information Commissioner's Office: https://ico.org.uk/make-a-complaint/. The required UK representative appointment is described in section 25.2.

End of Privacy Policy