Backhaul Connect ("Backhaul Connect", "we", "us", or "our") is committed to protecting your personal data in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia and applicable data protection regulations.

This Privacy Policy explains what personal data we collect, how we use it, and your rights as a data subject. Backhaul Connect is a free, open, bot-native marketplace — posting and browsing are open to all signed-in users, we do not use phone-OTP/SMS authentication, and we do not process payments (see Section 3).

1. Data Controller

Backhaul Connect is the data controller for personal data processed through the Backhaul Connect Platform. Our registered address is available upon request at support@backhaul.thebigdays.com.

2. Data We Collect

2.1 Account Registration

Your name and company name, if you choose to provide it
Your verified Telegram or WhatsApp identity used to sign in
If you sign in with Telegram: your Telegram user ID, username, first/last name, and profile photo, as provided by Telegram's Login Widget.
If you sign in with WhatsApp: the verified WhatsApp phone number used to link your account.
Preferred language

We do not collect a phone number via SMS one-time-password, and we do not ask for or store payment card, bank account, or other financial information — Backhaul Connect does not process payments.

2.2 Posts (loads and empty capacity)

Origin and destination
Available date and pickup time preference
Cargo type and weight, or vehicle type and capacity
Optional notes and an optional asking-price note you choose to include

Because Backhaul Connect is an open marketplace, the details of your post — route, dates, cargo or vehicle type, capacity or weight, and any asking-price note — are visible to other signed-in users browsing the marketplace. Your name and company name, however, are shown on your post only after a match is confirmed (see Section 5, "reveal on match"). Company name is optional; if you do not provide one, there is no company name to share.

2.3 Reviews

If you review another user, we store that review against the relevant user's account. Reviews help other users assess a party's track record. They are not a dispute process and are not used by Backhaul Connect to resolve commercial or shipment disputes between matched parties.

2.4 Usage & Technical Data

Device type, operating system version, IP address
Posts created, browsed, and matched; Interest expressed and accepted
Messages sent through the bot needed to operate the service
Support enquiries and responses

We do not collect real-time GPS location. Backhaul Connect does not offer live shipment tracking.

3. How We Use Your Data

Platform operation — showing your posts to other users, letting you browse theirs, and revealing contact details once a match is confirmed.
Communications — match and interest notifications, security alerts, support responses.
Safety & fraud prevention — detecting fake or duplicate posts, keeping contact details private until a match is confirmed.
Legal obligations — PDPA compliance, responding to lawful requests from Malaysian authorities.
Platform improvement — analysing usage patterns to improve features.

Backhaul Connect does not process payments, hold funds in escrow, or act as a party to any transaction between matched users.

4. Legal Basis for Processing

Under the PDPA, we process your data based on:

Contractual necessity — data needed to provide the service (account, posts, matches).
Legal obligation — PDPA data handling requirements.
Legitimate interest — improving the Platform and preventing fraud.
Consent — optional product updates, optional surveys.

5. Sharing Your Data

Reveal on match — we never share your name, company name, or contact details with other users without your explicit action. When you express Interest in a Post and its owner accepts it, a Match is created — and only then do we reveal both parties' name, company name, and contact channel. Before a Match, the other party sees only the Post's route, cargo, or vehicle details, not your identity.
Service providers — Telegram and WhatsApp/Meta (sign-in and bot messaging), and Google Firebase (authentication, hosting, Cloud Functions, Firestore). Each relationship is governed by the provider's standard terms.
Regulators — PDRM, the Personal Data Protection Commissioner (PDPC), or other competent authorities where required by law.
Acquirers — in the event of a merger or acquisition, personal data may be transferred subject to your consent where required by law.

We do not sell your personal data to third parties.

6. Data Retention

Account data: duration of account + 2 years (legal compliance).
Post data: 24 months (analytics, abuse investigation).
Match/contact-reveal records: duration of account (service operation and legal compliance).
Marketing consent records: until withdrawn.

7. Your Rights Under the PDPA

You have the right to:

Access — request a copy of personal data we hold about you (within 30 days).
Correction — request correction of inaccurate or incomplete data.
Deletion — request deletion of data (subject to legal retention obligations).
Withdrawal of consent — stop us processing data for non-essential purposes.
Complaint — file a complaint with the Personal Data Protection Commissioner (PDPC).

To exercise any of these rights, contact us at support@backhaul.thebigdays.com. We aim to respond within 21 days.

8. Security

We implement technical and organisational measures to protect your data, including encryption in transit (TLS) and at rest, role-based access controls with per-user data isolation, and audit logging. However, no system is perfectly secure — please notify us immediately at support@backhaul.thebigdays.com if you suspect a data breach.

9. Cookies & Tracking

The marketing website uses cookies to remember your cookie preferences and, with your consent, track usage analytics (Google Analytics / GA4). You may disable non-essential cookies via the cookie preferences panel or your browser settings. The Telegram bot and Mini App do not use browser cookies.

10. Children's Privacy

The Platform is not directed at persons under 18 years of age. We do not knowingly collect personal data from children. If you believe a minor has provided us with personal data, please contact us and we will delete it.

11. Cross-Border Transfers

Your data is primarily stored in Singapore (Google Cloud asia-southeast1region). Some incidental processing may occur via Telegram's infrastructure for messages sent through the bot. We rely on these providers' published contractual safeguards as our cross-border transfer mechanism under section 129 of the PDPA.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via the bot or an in-app notification.

13. Contact

For privacy questions or to exercise your rights, contact: support@backhaul.thebigdays.com

You also have the right to lodge a complaint with the Personal Data Protection Commissioner (PDPC) at www.pdpc.gov.my.