Privacy notice
This notice explains what MyWorkshop collects about you, why we collect it, how long we keep it, and what you can ask us to do about it. It covers this website, the registration form and our app. Please read it before you register.
Who we are
MyWorkshop is operated by The Hobby Workshop, a business registered in Malaysia under the Registration of Businesses Act 1956, registration number 202603217637 (JM1048930-X), with its registered address at 357D, Jalan 5/57, Section 5, 46000 Petaling Jaya, Selangor.
We are the data user for your personal data under the Personal Data Protection Act 2010 (PDPA). You can reach us at info@hobbyworkshop.my or +60 11-7406 4755.
What this website collects
The website sets no cookies, runs no analytics, and embeds nothing from another company. Fonts and images are served from this domain, so loading a page does not report your visit to anyone else.
When you use the address search on the registration form, the text you type is sent to Photon, an address-lookup service built on OpenStreetMap data and run by komoot in Germany, so that it can suggest matching addresses. Your browser contacts that service directly, so it also sees your IP address, as any website you visit does. You can skip the search and type your address in yourself.
Our hosting provider keeps standard server logs, which include IP addresses, for security and troubleshooting.
What we collect when you register
If you fill in our registration form, we collect:
- From everyone: your full name, MyKad number, phone number, email address, and your address — street, postcode, city and state.
- From mechanics as well: your business name, the kind of mechanic you are, your SSM registration number, years of experience, the area you cover, what you specialise in, what equipment you have, and the certificates you upload.
We collect this to check who you are, to make sure one person holds one account, and — for mechanics — to verify you before we let you bid on jobs.
What the app collects
To run a repair job the app needs your name, phone number and email; your vehicle's registration plate and its details; the jobs you post and the messages you exchange about them; and photographs you choose to upload. Payments are processed by a licensed payment gateway, which handles your card details directly — we never see or store a full card number.
Your MyKad number
We ask for your MyKad number to confirm you are who you say you are, and to stop the same person opening several accounts.
We never store it in a form anyone can read. The moment you send it, it is put through a one-way scramble (a cryptographic hash) that cannot be reversed back into your number. Only the last four digits are kept as they are, so that you can recognise your own account. No other user of the platform ever sees any part of it.
Where your job is, and who sees your address
We do not collect GPS or any other precise location. For a job we record only the district and state.
Mechanics bidding on your job see the district — not your street address. Your full address is released to one mechanic only: the one you award the job to, so they can come and do the work.
Vehicle lookups
When you add a vehicle by its registration plate, we send that plate to a third-party vehicle data service to retrieve the make, model, engine and year. That service operates outside Malaysia, so this is a cross-border transfer of the plate number. We ask only for the technical specification of the vehicle. Where the reply contains anything about the registered keeper or their insurance, we throw it away at our server — it is never sent to the app and never stored.
Who else sees your data
- The mechanic you award a job to, so they can carry out the work.
- Our payment gateway, to take payment and pay mechanics.
- Our hosting and database providers, who store the data on our behalf.
- The vehicle data service described above, which receives only a plate.
- The address-lookup service described above, which receives only what you type into the address search.
- Regulators, the police, or our professional advisers — but only where the law requires it, or where we need it to bring or defend a legal claim.
We do not sell personal data. We do not use it for advertising, and we do not use it to train machine learning models.
Sending data outside Malaysia
Some of the companies we rely on keep data on servers outside Malaysia — our database provider, the payment provider, the vehicle lookup service and the address-lookup service. Your personal data is therefore transferred out of Malaysia for those purposes. We only use providers that are contractually bound to protect it to a standard comparable to the PDPA.
How we keep it safe
Access is controlled in the database itself, so one user cannot read another's records. Data travels encrypted. MyKad numbers are hashed as described above. Documents and photographs are reachable only through links that expire.
How long we keep it
Job records, invoices and warranty documents are kept for seven years, because tax law requires it and because a warranty claim depends on the record existing. Registration details are kept while your account is open, and verification documents for one year after a mechanic's account closes.
Your rights
Under the PDPA you may:
- ask for a copy of the data we hold about you;
- ask us to correct it if it is wrong;
- ask us to stop using it for a particular purpose;
- ask what we have disclosed to third parties; and
- withdraw a consent you previously gave.
Email info@hobbyworkshop.my and we will respond within 21 days. If you are not satisfied, you may complain to the Personal Data Protection Commissioner.
To delete your registration or account and the data attached to it, email us with the word DELETE.
Consent, and how to withdraw it
When you tick the consent box, we record which version of this notice you were shown, which language you read it in, and the date and time. We add to that record — we never overwrite it. If we change this notice in a way that materially affects you, we will ask for your consent again rather than carry the old one forward.
Withdrawing consent is as easy as giving it. Email us, or use the setting in your account. Withdrawal does not make our earlier use of your data unlawful, and it does not affect records we are required by law to keep.
We do not bundle marketing into this consent. If we ever want to send you marketing, we will ask separately, and you can say no without losing your account.
If you do not want to give us this data
The information described above is required in order to register. If you choose not to give it, or you later withdraw your consent, we will not be able to create or keep your account — and if you are a mechanic, we will not be able to approve you to bid.
Changes
If we change this notice we will update the version and date at the top. If a change materially affects how we use data you have already given us, we will email you before it takes effect.
Language
This notice is available in English and Bahasa Malaysia, as section 7(2) of the PDPA requires. If the two versions ever differ, please write to us and we will correct it. Baca notis ini dalam Bahasa Malaysia.