ODA Malaysia | ODA Gig | ODA Partner | ODA Ops
Operated by SUMHERO SDN. BHD. (Malaysia)
Effective Date: 15 August 2022
Last Updated: 15 August 2026
SUMHERO SDN. BHD. (“SUMHERO”, “ODA”, “we”, “us”, or “our”) is a company incorporated in Malaysia and is the owner and operator of the ODA digital platform and associated applications and services.
This Privacy Policy applies to the following applications:
Collectively, these applications, together with our websites, APIs, systems and related services, are referred to in this Privacy Policy as the “ODA Platform.”
This Privacy Policy explains how SUMHERO SDN. BHD. collects, uses, processes, stores, shares, discloses and protects personal data when you access or use the ODA Platform.
The specific information collected depends upon which ODA application you use, your relationship with ODA, the permissions you provide, and the services you use.
ODA Malaysia allows customers to access services that may include:
When you use ODA Malaysia, we may collect information including:
We use this information to create and maintain your account, provide requested services, process orders and bookings, arrange deliveries and transportation, manage payments and wallet transactions, provide customer support, improve the ODA Platform, and maintain security.
ODA Gig is intended for individuals providing transportation, delivery or other services through the ODA Platform.
Depending upon the services provided and applicable requirements, we may collect:
Where required for onboarding, verification, security, legal or operational purposes, we may collect information such as:
We may collect:
ODA Gig may require location information to operate transportation and delivery services.
Depending upon the permissions granted, services being performed and applicable platform functionality, location information may include:
Location information may be used to:
Where the application requests background location permission, the permission and resulting data will only be used for functions disclosed to the user and permitted by applicable platform and legal requirements.
We may process:
This information is used to calculate and facilitate payments and maintain financial records.
ODA Partner is intended for businesses participating in the ODA Platform, including:
We may collect:
We may collect information about business owners, authorised representatives or staff, including:
Where necessary to process settlements and payments, we may collect:
We may process:
ODA Partner information is used to operate merchant accounts, process customer orders, facilitate settlements, provide analytics, manage products and services, and administer the ODA marketplace.
ODA Ops is intended for authorised ODA operations personnel.
Depending upon an individual's responsibilities and access permissions, we may process:
ODA Ops may also provide authorised personnel with limited access to customer, driver, rider, merchant, order or transaction information where such access is necessary for legitimate operational purposes.
Access is intended to be role-based and limited according to operational requirements.
Location information is important to several ODA services.
Depending upon the application and service being used, we may collect precise or approximate location information through:
We may use location information to:
Your device may allow you to control location permissions.
Some ODA services may not function correctly if location access is disabled.
ODA applications may request access to the camera, photographs or videos when necessary for specific functionality.
These functions may include:
ODA will process photographs or videos provided through these features for the relevant operational or service purpose.
We do not intend to access unrelated photographs or videos solely because they are stored on your device.
When you access an ODA application, we may automatically collect certain technical information, such as:
We use such information for security, troubleshooting, analytics, fraud prevention and improvement of the ODA Platform.
When a transaction is performed through the ODA Platform, we may process information including:
Information necessary to fulfil the transaction may be exchanged among the customer, merchant, driver/rider and ODA operations systems.
The ODA Platform may provide payment, wallet, top-up, refund, incentive, commission and settlement functionality.
We may process:
Payments may be processed by third-party payment gateways, banks, financial institutions or electronic payment providers.
Where payment details are entered directly into a third-party payment system, SUMHERO SDN. BHD. may not receive or store complete card or banking credentials.
Third-party payment providers may process your information according to their own privacy policies.
ODA may communicate with users through:
Communications may concern:
Users can manage certain communication permissions through application or device settings.
Essential transactional or security communications may still be sent where necessary to provide the requested service or protect an account.
SUMHERO SDN. BHD. may process personal data to:
We do not sell personal data as a standalone business activity.
Information may, however, be disclosed where reasonably necessary to operate the ODA Platform.
Drivers/riders and merchants may receive information reasonably required to fulfil a customer's transaction, such as the customer's name, relevant contact information, order details and pickup/delivery location.
Customers and relevant merchants may receive information required to identify or coordinate with an assigned driver/rider.
Merchants may receive information necessary to prepare, process and fulfil orders.
We may use third-party providers for services including:
These service providers may process information to the extent necessary to provide their services.
Information may be disclosed where appropriate to professional advisers such as accountants, auditors, lawyers and insurers.
We may disclose information where required or permitted by applicable law, regulation, court order, governmental authority, law enforcement request or other lawful process.
We may also disclose information where reasonably necessary to protect the safety, rights, property or security of SUMHERO SDN. BHD., users of the ODA Platform, or other persons.
ODA may use third-party mapping, navigation, geocoding and location technologies.
When such services are used, location and technical information may be processed by the relevant provider according to its terms and privacy practices.
We may use analytics, performance-monitoring, crash-reporting and security technologies.
These technologies may process information concerning:
We use this information to improve reliability, performance, security and user experience.
ODA websites and web-based services may use:
These may be used for authentication, security, analytics, preferences and maintaining user sessions.
Browser settings may allow users to control cookies, although disabling certain cookies may affect functionality.
SUMHERO SDN. BHD. takes reasonable administrative, organisational and technical measures designed to protect personal data against:
Depending upon the system and circumstances, safeguards may include:
No internet, mobile application, electronic transmission or storage system can, however, be guaranteed to be completely secure.
Users should protect their account credentials and should never disclose passwords, OTPs or security codes to unauthorised persons.
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected or as required or permitted by applicable law.
Retention may be necessary to:
When information is no longer reasonably required, we may delete, anonymise, aggregate or securely dispose of it in accordance with applicable requirements.
Users may request deletion of their ODA account and associated personal data.
Where account deletion functionality is provided within an ODA application, users may submit a request through the relevant account or profile settings.
Users may also contact SUMHERO SDN. BHD. using the contact information provided in this Privacy Policy.
Following a valid deletion request, we will delete or anonymise personal information that is no longer reasonably required, subject to information we may retain where required or permitted for purposes such as:
Deleting an account from one ODA application may affect access to other ODA services where the applications use the same ODA account.
Subject to applicable Malaysian law and any lawful limitations, individuals may have rights relating to their personal data, including the right to:
We may require reasonable identity verification before processing certain privacy requests.
With appropriate permission or other lawful basis where required, ODA may communicate promotions concerning:
Users may opt out of applicable promotional communications using available unsubscribe or preference controls.
Opting out of marketing does not necessarily prevent essential service, security, transaction or account communications.
SUMHERO SDN. BHD. and its technology or service providers may use infrastructure located in Malaysia or other countries.
Accordingly, personal data may be processed or stored outside Malaysia where permitted under applicable law.
Where personal data is transferred internationally, SUMHERO SDN. BHD. will take reasonable measures to handle such transfers in accordance with applicable Malaysian personal data protection requirements.
ODA services are primarily intended for individuals legally capable of entering into transactions relating to the services they request.
We do not knowingly seek to collect personal data directly from children in circumstances where parental or guardian consent would be required under applicable law.
If you believe personal data relating to a child has been provided improperly, please contact us so that we can investigate and take appropriate action.
Customer, driver/rider and merchant information may be accessible to authorised SUMHERO SDN. BHD. personnel through ODA Ops or other internal systems where access is reasonably necessary for:
Access should be limited according to job responsibilities and operational requirements.
Unauthorised use of personal data by employees or authorised personnel is prohibited.
The ODA Platform may contain or integrate services operated by third parties.
These may include payment providers, mapping services, communication providers, merchants and other external services.
Third-party services may maintain their own privacy policies and terms.
SUMHERO SDN. BHD. is not responsible for independent processing carried out by third parties outside our control.
Users should review the privacy policies of relevant third-party services.
SUMHERO SDN. BHD. intends to process personal data in accordance with applicable Malaysian personal data protection requirements, including the Personal Data Protection Act 2010 [Act 709], as amended, and applicable regulations, standards and guidelines.
Our personal data practices are intended to address applicable principles concerning:
Where subsequent amendments or regulations impose additional obligations applicable to SUMHERO SDN. BHD., we will take reasonable steps to comply with those requirements.
SUMHERO SDN. BHD. may update this Privacy Policy periodically because of:
The latest version will display an updated Last Updated date.
Where required by applicable law, we may provide additional notice or obtain consent for material changes.
For clarity, this Privacy Policy applies to the following applications operated by SUMHERO SDN. BHD.:
Customer application.
Driver, rider, delivery and gig-worker application.
Merchant, restaurant, retailer, vendor and business-partner application.
Authorised ODA operations and management application.
It also applies, where stated or applicable, to related ODA websites, APIs and digital services operated by SUMHERO SDN. BHD.
Questions, requests or complaints regarding privacy or personal data may be directed to:
SUMHERO SDN. BHD.
Malaysia
Applications: ODA Malaysia, ODA Gig, ODA Partner and ODA Ops
Privacy / Support Email: info@odamalaysia.com
Telephone: +60 11-1099 9101
Registered / Business Address: Kelatan, Malaysia
Website: https://odamalaysia.com
For privacy-related requests, please use the subject:
“Privacy Request – ODA Platform”
We may request information reasonably necessary to verify your identity before acting upon requests relating to personal data.
By accessing or using an ODA application or service, you acknowledge that you have been provided with this Privacy Policy and understand how SUMHERO SDN. BHD. processes personal data as described herein.
Where consent is required under applicable law for a particular type of processing, SUMHERO SDN. BHD. will seek such consent through an appropriate mechanism.