Privacy Policy

MBGo is a workplace-meal delivery platform in Malaysia. This notice explains how we collect, use, disclose, and protect your personal data when you use our app and services.

MBGo is operated by MYBAIK HOLDINGS SDN. BHD. (SSM Registration No. 202501032366 / 1633778-V), a company incorporated in Selangor, Malaysia. In this notice, “we”, “us”, and “our” refer to that company, which is the data controller for your personal data.

We handle your personal data in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia. By using MBGo, you acknowledge the practices described here.

We collect only the data we need to run the service:

• Name — to identify you when your order is handed over.
• Email address — for login, account verification, and receipts.
• Phone number — for order notifications and urgent contact.
• Workplace and pickup point — the location and time slot you choose.
• Order history — items, amounts paid, status, and ratings.
• Rewards data — your wallet balance, referral code, and referral network.
• Device and usage data — device type, browser, IP address, and basic in-app activity, used to keep the service secure and working.

Payment is processed by our payment provider, CHIP. We do not store your card or bank account details — these are handled directly by CHIP in its secure environment.

We use your personal data to:

• Process, prepare, and hand over your orders at the pickup point.
• Verify your identity and QR code when your order is collected.
• Process payments, refunds, and your wallet balance.
• Calculate 2% cashback and referral rewards.
• Send you notifications about your orders (ready for collection, cancelled, and similar).
• Improve our menu, slot capacity, and service quality.
• Prevent fraud and abuse, and comply with our legal obligations.

We do not sell your personal data to anyone.

We rely on the following bases under the PDPA to process your personal data:

• Your consent — given when you register, place an order, or opt in to marketing.
• Performance of a contract — to fulfil the orders and services you request.
• Legal obligations — for example, keeping accounting and tax records.
• Legitimate interests — such as securing the platform and preventing fraud, balanced against your rights.

You may withdraw your consent at any time by contacting us (see the last section). Withdrawing consent for essential processing may mean we can no longer provide certain features, such as placing orders.

We share your data only as far as necessary, with:

• Workplace Partners — your name, order code, ordered items, and pickup QR are shown to the workplace partner who hands over your order. They do not see your email or payment information.
• CHIP — our payment provider, to process DuitNow QR transactions and refunds.
• Central Kitchen — your order items and slot, without your personal contact details.
• Infrastructure providers — hosting and database services (including Supabase) that are bound by confidentiality obligations.
• Authorities — when required by Malaysian law, or to protect our rights and the safety of others.

Your data is hosted on managed cloud infrastructure. Some of our service providers may process or store data on servers located outside Malaysia.

Where this happens, we take reasonable steps to ensure your data receives a level of protection consistent with the PDPA, including confidentiality commitments from our providers.

We keep your personal data only for as long as it is needed for the purposes described above.

Order and transaction records are generally kept for seven (7) years to meet accounting, tax, and dispute-resolution requirements. Inactive account data is deleted or anonymised after that period.

Your data is stored in a database protected by row-level access controls and encryption in transit.

Internal access is limited by role (customer, workplace partner, kitchen staff, administrator), so staff only see the data they need to do their job. No system can be guaranteed completely secure, but we work to protect your data against unauthorised access, loss, and misuse.

We use essential cookies and local storage only, to keep you logged in and to hold your cart contents on your device. Without these, you cannot stay logged in or check out.

We do not use third-party advertising cookies. You can clear cookies through your browser settings, but you will be logged out.

We will only send you marketing messages if you have opted in. You can withdraw your marketing consent at any time, without affecting the service you receive.

Messages about your orders, payments, and account (such as “your order is ready”) are service messages, not marketing, and are sent as part of providing the service.

Under the PDPA 2010, you have the right to:

• Access the personal data we hold about you.
• Correct data that is inaccurate, incomplete, or out of date.
• Limit processing, including for marketing purposes.
• Withdraw consent to the processing of your personal data.

We usually respond to requests within 21 working days. Some data cannot be fully deleted where we are required to retain it, for example financial records.

MBGo is intended for users aged 18 and above. If you are under 18, you may only use the platform with the consent of a parent, guardian, or your employer.

We do not knowingly collect personal data from children without appropriate consent. If you believe a child has provided us with personal data without consent, please contact us so we can remove it.

We may update this notice from time to time. The current version, together with its last-updated date, will always be shown on this page.

If we make significant changes, we will take reasonable steps to notify you, for example through the app.

The data controller responsible for your personal data is MYBAIK HOLDINGS SDN. BHD. (SSM Registration No. 202501032366 / 1633778-V), incorporated in Selangor, Malaysia.

For any question, data access request, or privacy complaint, contact our Data Protection Officer:

privasi@mbgo.my · +60 11-1213 0355

You also have the right to lodge a complaint directly with the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi, JPDP) of Malaysia.