BN TASK LINK SERVICES (SSM registration no. 202603273406 (NS0328657-D)), which operates Bantu Now, handles your personal data in line with the Personal Data Protection Act 2010 (PDPA) of Malaysia. This policy explains what we collect, why, who sees it, and your choices.
4.1 What we collect.
- Information you give us: name, MyKad number (kept only in masked form), MyKad photo and selfie for verification, phone number, email, district or address, profile details (skills, photos, service areas), task and listing details including photos, bank account name and number for payouts, and the messages and reviews you write.
- Information from your use of Bantu Now: tasks, offers, payment, escrow and payout records, device and browser details, IP address, usage data, and approximate location if you use a distance filter.
- Information from others: payment status from our payment provider.
Card and online banking details are handled by our payment provider and are not stored by us.
4.2 Why we use it. To verify identity and keep the community safe; to run tasks, offers and escrow; to process payments and payouts; to handle disputes and support requests; to prevent fraud and misuse; to meet legal duties; and to improve the service. We may send promotions, which you can opt out of. Account and service messages will still be sent.
4.3 Who we share it with. Only what is needed:
- Other users: your name, general area, ratings and task details, so you can complete a task together. Phone numbers, unit numbers and exact directions are shared only after payment is secured in escrow.
- Our payment provider (currently HitPay) and banks, to take payments, hold escrow and send payouts.
- Service providers that host our database and files (Lovable Cloud, running on AWS) and deliver our website (Cloudflare).
- Authorities, courts or regulators when the law requires it, and a buyer if the business is ever sold, who must follow this policy.
We do not sell your personal data.
4.4 MyKad data. We check your name and MyKad number automatically against the details you give us, and our team reviews them manually if the automatic check cannot be completed. We collect your MyKad details only to verify who you are. Your MyKad photo and selfie are kept in a private store that only authorised Bantu Now administrators can open, and they are never shown to other users. We delete both images within 30 days after the verification decision, unless they are needed for a dispute or the law. We keep only the last four digits of your MyKad number, and a one-way coded version (a hash) from which the number cannot be recovered, to prevent duplicate accounts and misuse of offers.
4.5 Consent. You accept this policy at sign-up, and give a separate consent before MyKad verification. You can withdraw consent at any time by contacting us, but we may then be unable to provide the service, and we may still need to keep records the law requires.
4.6 How long we keep it. Only as long as needed for the purposes above or as the law requires. After that we delete, destroy or anonymise it. Account data is kept while your account is active and for 12 months after it closes. Payment and transaction records are kept for 7 years for accounting and tax. Chat messages are kept for 12 months after the task or sale ends, to settle disputes.
4.7 Location. If you use 'Distance from me', we ask for your device location. It is used only to sort results by distance, and other users do not see your exact location. You can turn off location permission in your device settings.
4.8 Cookies and analytics. We use only essential cookies: one keeps you signed in, and one remembers how you set the navigation menu. We do not use advertising or third-party tracking cookies. You can block or delete cookies in your browser settings, but you may then not be able to sign in.
4.9 Transfers outside Malaysia. Our database and files are hosted in South Korea (AWS Seoul, through Lovable Cloud), and our website is delivered through Cloudflare's global network, so your data may be processed outside Malaysia. We only use providers that protect data to a standard comparable to the PDPA.
4.10 Security and breaches. We use access controls and encryption in transit, and limit access to people who need it. No system is completely secure. If a data breach is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and affected users as the law requires.
4.11 Your rights. You can ask to access the personal data we hold about you, correct it, withdraw your consent, or limit how we use it, and where it applies ask for your data to be transferred. We may need to verify who you are first, and we will reply within 21 days. You can also complain to the Personal Data Protection Commissioner.
4.12 Age. Bantu Now is for people aged 18 and over. We do not knowingly collect data from anyone younger and will delete it if we find it.
4.13 Language and changes. This policy is available in English and Bahasa Malaysia (see section 8). If they differ, the English version applies. We will notify users of material changes.
4.14 Contact. Privacy Officer, BN TASK LINK SERVICES. support@bantunow.my, WhatsApp 019-729 5539, 1 Jalan Persiaran Dato Chellam, Taman Dato Chellam, 81800 Ulu Tiram, Johor.