Privacy Policy
This Privacy Policy is established in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 for the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter, the "Regulation" or "GDPR") and is addressed to visitors of the GCRide website (hereinafter, the "Site") and to anyone who has provided their contact details for an inquiry or to receive any newsletters. The data provided will be processed lawfully and in accordance with the principles set out in Article 5 of the Regulation.
With the help of this Privacy Policy, GCRide hopes to openly and honestly notify you about all the processing we do with your data, the reasons we do so, the user rights you have over your personal data, and how long we will keep it on file.
The usage of GCRide' website is governed by this privacy statement. In accordance with the provisions of the GDPR, all personal data that the User provides through the website www.gcride.my (hereinafter, the "Website") will be incorporated and processed in the files and processing systems owned by the company GCRide for the sole purpose of being able to handle your requests sent through our Website, provide our services, and keep you informed electronically about our services.
The term User/s is used here to refer to all persons over 18 years of age who access the Website. As a User, you declare that you have the necessary legal capacity to understand and accept in its entirety this Privacy Policy.
1. The data processing controller
The controller of the processing of personal data is Goldcrest Chauffeur Services (GCRide), with the registered office at No 11-1D, Jalan Puteri 3A/2, Bandar Puteri Bangi, 43000 Kajang, and can be contacted via our email address info@gcride.my (hereinafter, the "Data Controller").
2. What is personal data and data processing?
These are data that identify or allow the identification of a person. For example, data that can directly identify a person includes their name and surname, while the ID number can indirectly identify them. Personal data includes information such as mobile phone number, email address, date of birth, and gender, among others. It could also include numerical identifiers such as your computer's IP address, as well as information obtained through cookies.
A processing of personal data is any operation or set of operations that we carry out on your personal data, such as collection, recording, storage, use, and communication of your data.
3. What type of information do we collect?
If the user only accesses the website without interacting with GCRide in any of the contacts or hiring forms enabled, no data will be collected from the said user beyond what the user consents to share using cookies. That is, we use user identifiers (cookies) on our Website to collect information about the use of the website, such as the server to which the user's computer is connected, the type of browser (for example, Firefox or Internet Explorer), and how the potential customer became aware of GCRide. We use this information solely to help us improve our marketing policies, and the internet user's personal data is not included in the data capture. For more information about the cookies we use, please see our Cookie Policy.
Additionally, when the user provides data in the data collection forms, for the purpose of being able to provide the services that GCRide offers, we may collect the following information depending on the actions performed on the Website:
Name
Surname
Phone number
Bank details to proceed with the payment of your services.
This data is necessary for the correct provision and execution of the service.
As a user, you guarantee that the personal data provided to GCRide are truthful, accurate, complete, and up to date, being responsible for any direct or indirect damage or harm that may arise as a result of non-compliance with this obligation. If you provide GCRide with data of third parties, the User must have the consent of such third parties and undertake to transmit to them the information contained in this clause, exempting GCRide from any liability in this regard. However, GCRide may carry out verifications to verify this fact, adopting the due diligence measures that correspond, in accordance with data protection regulations.
4. Through what channels do we collect your personal data?
We only capture and process information that you provide to us through the following channels:
-
Through the service hiring form.
-
Through the emails that you may send to the contact addresses published on the Website.
5. What processing do we perform with your personal data and for what purposes?
We want to be open and honest with you, providing you with information about the actions we take with your data and the reasons for our processing of it.
Below, we outline all the processing or operations that we carry out with your personal data:
- Contracting and provision of the services offered by GCRide.
The purpose of this data processing is to enable GCRide to deliver the transportation service.
- Management aimed at finalizing the contracting of services.
That is, when a user expresses interest in using GCRide' services but doesn't finish the contracting procedure. In particular:
Abandoned reservation: if you’ve begun but not finished a hiring process, we’ll send you an email reminder. This way, you can complete it if you’re still interested. Keep in mind that prices might fluctuate based on service availability. Rest assured, we will send just one reminder and the original quoted price will remain locked for 30 days.
Payment error: In the event of a payment error, we will promptly send you an email notification. This will allow you to address the issue and proceed with the payment process to finalise the service contract.
Abandoned payment: We will send you an email as a gentle reminder that you’ve initiated but not completed a hiring process. If you’re still interested in proceeding, please be aware that prices might fluctuate based on service availability. Rest assured, you’ll receive only one reminder, and the initially quoted price will remain valid for 30 days.
- Commercial communications.
We will handle your data to provide you with updates about GCRide’s services and relevant promotions. This will happen only if you have given your consent, or you have previously used GCRide's services.
- Cookies.
Our website utilises technology to install small files known as cookies on your device. These cookies serve various purposes, including enhancing your browsing experience, analyzing user navigation, and providing personalized content. If desired, you can block or disable cookies through your browser’s settings. For additional details, please refer to our Cookie Policy.
6. What is the legitimacy for the processing of your data?
Compliance with data protection regulations necessitates a valid legal basis for processing your data. Consequently, we rely on different legal grounds depending on the specific purpose of data processing. In this context, we process your data based on the following:
Execution of a Contract: When you engage GCRide’ services, we process your data as part of the contractual agreement.
Likewise, this legal basis will be applicable to the processing necessary to manage promotions linked to the service contract.
Pre-contractual measures are taken at your request. These measures serve the purposes outlined in point 2 of the previous section. Specifically, they involve sending you transactional communications to finalise the service contract in cases where there has been a payment issue or when you have initiated the purchase process but not completed it.
User consent. To facilitate the processing of your data for purpose 3, which involves sending you commercial communications about GCRide services, we will seek your clear and direct consent. Please note that this consent can be withdrawn at any point.
Legitimate interest of GCRide. This involves sending you commercial communications related to your previous contract as an existing customer. If you wish to object to the processing of your date, you can do so directly through the commercial communications.
7. How long do we keep your data?
GCRide retains your personal data for the duration required to fulfil the purpose for which it was collected. Additionally, this retention period serves to demonstrate the lawful processing of data and the proper delivery of services. Here are the data retention periods based on their purposes.
Contracting and provision of the services offered by GCRide. Your data will be retained for up to six years following the conclusion of service provision. This duration allows GCRide to safeguard itself against any potential claims arising from the service execution.
Management efforts on completing service contracts. Your data will be retained solely until we despatch the transactional communications outlined in section 5. Subsequently, if you finalise the transaction process, this will be preserved as provided as indicated in the previous subsection.
Commercial communications. Regarding commercial communications, your data will be retained until you choose to withdraw the consent you’ve given to receive such communications. In any case, data retention will not exceed a period of 2 years.
Additionally, when your date is processed based on GCRide legitimate interest arising from a previous contract. it will be kept until you express an objection to receiving commercial communications.
8. Do we collect data from minors?
Individuals below the legal age of majority are not permitted to use the services offered through the Website without prior authorization from their parents, guardians, or legal representatives. These authorised parties will assume sole responsibility for any actions taken by minors under their care on the Website, including the submission of forms containing personal data and the selection of relevant options on the checkboxes.
9. What are your rights when you provide us with your data?
Below, we detail the rights that you, as a user of the website, can exercise:
Right of access
You are entitled to request GCRide to verify whether it processes your personal data. If it does, you also have the right to know what specific data it processes.
Right of rectification
You can request modifications to any inaccurate or incomplete data by specifying which specific information you’d like to be changed in your rectification request.
Right to object
You retain the right to object to the processing of your personal data by an organisation at any time. This means you can prevent or halt the organisation from utilizing your data. However, this right only applies in specific circumstances and the organisation may continue processing your data if they can provide strong and legitimate reasons for doing so.
Right to erasure
You have the right to request the deletion of your personal data. While the data will be blocked to prevent further processing, it may still be accessible to public authorities, courts, and tribunals for potential liability purposes during the limitation period.
Right to data portability
You possess the right to duplicate and transfer data from our database to another data controller. This entitlement can be exercised solely when the processing is grounded in contract execution or your consent, and the processing occurs through automated means. Additionally, you have the right to request the suspension of data processing under specific circumstances.
Right to restriction of processing
This provision enables you to ask for the temporary suspension of data processing under the following circumstances:
When you challenge the accuracy of the data, whilst GCRide verifies its correctness.
When you have exercised your right to object to data processing, pending verification of whether GCRide’s legitimate reasons outweigh your rights as the data subject.
Likewise, this right allows you to request GCRide to retain your personal data when:
When you challenge the accuracy of the data and, as the data subject, object to its deletion. Instead, you request a restriction on its use.
When GCRide no longer requires your personal data for processing purposes, but you need it for establishing, exercising, or defending legal claims.
How to exercise these rights?
You can exercise your rights by either emailing your request to privacy@gcride.my or sending a written and signed request via postal mail. Ensure that your request includes sufficient identifying information to verify your identity. Address the mail to the following location: No 11-1D, Jalan Puteri 3A/2, Bandar Puteri Bangi, 43000 Kajang, Malaysia, with the reference ‘Data Protection.’
Additionally, if we fail to adequately address your rights, you have the option to lodge a complaint with the Personal Data Protection Department (JPDP) or the Personal Data Protection Commissioner of Malaysia under the Personal Data Protection Act 2010 (PDPA). For further details on your data protection rights and instructions on how to submit a complaint, please visit the official JPDP website at:
10. To whom do we disclose your personal data?
GCRide refrains from disclosing the personal information you provide unless it is essential for delivering contracted services or complying with legal obligations. In the context of availing GCRide’ services, your data may be shared with the following entities.
Banking entities for processing card payments and other payment methods available on the Website.
Institutions that provide fraud investigation, detection, and prevention services, as well as the minimization of the risk of its commission, based on the legitimate interest recognized by current regulations.
Consumer and user offices in case of any claims.
Companies providing passenger transportation services that are responsible for fulfilling the transportation services you’ve contracted.
Personal data may be disclosed where required or authorized by law, including to Malaysian law enforcement agencies, regulatory bodies, and judicial authorities when appropriate.
Public administrations to which we must provide information for the fulfilment of our legal obligations.
In all circumstances, any personal data accessed by third parties with whom we collaborate to deliver our services will be handled and processed in strict compliance with the Personal Data Protection Act 2010 (PDPA) and other applicable laws of Malaysia.
11. Security measures
GCRide adheres to the security levels required by the GDPR, appropriate to the nature of the data being always processed. However, whilst technical security measures are in place, the internet always remains vulnerable to malicious actions by third parties. GCRide makes every effort to prevent such actions.
12. Do we perform international data transfers?
The personal data that we retain from the User will be processed exclusively in EU member states or the European Economic Area, respectively. However, in cases where processing occurs by a provider located in a country lacking the corresponding data protection laws, the processing will be protected by international contracts in accordance with European requirements.
13. Can i revoke my consent?
If you have previously granted consent for the processing of your data, you retain the right to revoke this consent at any point in the future. To do so, you can send your revocation notice to privacy@gcride.my.
It’s important to be aware that even if you choose to oppose or revoke your consent, there might be legal obligations that require us to retain your data. However, you still have the right to object to and withdraw your consent specifically for the processing of your personal data related to advertising purposes. For detailed contact information, please refer to Section 1 of this Privacy Policy.
14. Social media
We have configured social media icons on our website. With a simple click, users can access the following social media platforms: Facebook and X.
When browsing our website, no personal data is shared with other providers. You can recognize the platform provider by its logo. We offer you the opportunity to go directly to GCRide's posts on each social network through the icon. We have no influence on the data collected and the data processing procedures on these social networks, nor are we aware of the full extent of data collection, the purposes of processing, and the retention periods. Furthermore, we do not possess information regarding data collection.
If followers of GCRide’s profiles contact the company through social networks or publish images or information containing personal data, it will be the exclusive responsibility of the User and/or follower, with GCRide being exempt from any liability regarding the content that the User and the follower incorporate into our public profiles. Since GCRide's profile on social networks is public, the company is not responsible for any direct or indirect actions taken by third parties resulting from the User's publication of their personal data on our profiles. Therefore, we strongly urge you not to share personal or sensitive information and to carefully read the Privacy Policies and Terms and Conditions of such social platforms to configure your profile with the desired level of privacy. If anyone no longer wishes to follow GCRide on the social networks where it is present, they can unfollow the profile according to the provisions of the corresponding social platform´s Terms and Conditions.
Below are the addresses of the social media platforms where you will find information about data protection:
“Facebook” (Meta Platforms Ireland Limited. ATTN: Privacy Operations, Merrion Road, Dublin 4, D04 X2K5, Ireland); https://www.facebook.com/privacy/policy/
“X” (X Internet Unlimited Company. ATTN: Data Protection Officer, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07 IRELAND.); https://x.com/es/privacy.
15. Confidentiality and professional secrecy
All private communications between GCRide and Users are handled with utmost confidentiality. GCRide is committed to maintaining the secrecy of personal data and takes necessary precautions to prevent any unauthorised processing, alteration, loss or access in accordance with relevant data protection regulations.
Any information shared between the parties, agreed to have such nature, or simply related to the content of such information, will be treated as confidential. Accessing data over the Internet will not automatically grant access to it unless express consent is provided by the owner on each occasion.
16. Links to other websites
Our website also uses features from other service providers. To utilise them, you will be redirected to the actual service provider’s website, and you will be informed before redirection. You can view the respective privacy statements on their websites.
The GCRide website includes links to other websites that are not managed by GCRide. As a result, GCRide does not have control over these external sites, nor does it assume responsibility for the information they contain. We recommend that you visit these websites directly to learn about their Privacy Policy, which covers data protection, security, data collection, and data transmission provisions. GCRide will not be held accountable for any actions taken or the content found on these websites.
Unless authorized in writing by GCRide, no link, hyperlink, framing, or similar link may be inserted on the Website.
17. Changes in this privacy policy
This Privacy Policy is subject to potential changes based on changing criteria set by the relevant data protection authority at any given time. GCRide reserves the right to modify this Privacy Policy to align with such criteria, as well as any jurisprudential or legislative novelties.
18. Cookies
GCRide will utilise data storage and retrieval devices ("Cookies") in accordance with the User’s consent which is obtained during the user’s initial visit to the Website as indicated in the browser pop-up window. Additionally, users are expected to familiarise themselves with the terms and conditions outlined in the Cookies Policy.
19. Contact
If you need further clarification regarding the management of your personal data, please feel free to contact us via email at privacy@gcride.my.
Last review date: March 2026.