Privacy Policy

1.1. In this Privacy Policy:

• “Personal Data” and “Processing” have the meanings given in the Personal Data Protection Act 2010 of Malaysia (“PDPA”).
• “Platform” means the Dapor mobile application and associated web properties, covering both the Dapor Direct and Dapor Drop features.
• “We”, “us”, “our” means Waymaker Technologies Sdn. Bhd. (Company Registration No. 202301020497 (1514419-D)).
• “You” means Users (Planners/customers) and Caterers.

3.1. Identity & Contact Data.

• Name, username, and profile picture.
• Mobile phone number (required for OTP authentication and, for Direct, the "Contact Seller" WhatsApp redirection).
• For Dapor Drop checkout (including guest checkout): name, email address, and phone number, collected to process your order and issue a receipt.

3.2. Location Data. The state/area you manually enter into your profile (e.g., "Subang Jaya"), used to show relevant Caterers or Dropzones nearby. We do not use GPS tracking.

3.3. Order Data (Dapor Drop). Items ordered, order pool/MOQ status, selected Dropzone, and collection confirmation status.

3.4. Vendor Documentation (Caterers). For Caterers, we collect business and safety documentation for verification purposes, including SSM registration, Halal/GMP certificates (where applicable), food handling certification, and proof of typhoid vaccination for food handlers. This documentation is currently collected and verified as part of an offline onboarding process, separate from the live app database.

3.5. Device Permissions. To upload photos (e.g., profile pictures, certificates), the App may request access to your device’s Camera or Photo Gallery. You may decline, but will not be able to upload images.

3.6. Technical Data. IP address, device ID, and crash logs, collected automatically via tools such as Firebase, to fix bugs and maintain security.

4.1. We process your Personal Data to:

• Connect Parties (Direct): Generate the "Contact Seller" WhatsApp link between User and Caterer.
• Process Orders (Drop): Facilitate your order, manage MOQ pool status, coordinate Dropzone fulfillment, and process payment via Chip.
• Search & Sorting: Display relevant Caterers or Dropzones based on your manually entered location.
• Trust & Safety: Review Caterer documentation (Section 3.4) to determine eligibility to list, and to respond to health & safety reports as described in our Terms of Service.
• Security: Verify identity via SMS/OTP at sign-up to prevent spam or bot accounts.
• System Notifications: Send important updates, such as order status, Dropzone arrival notifications, or Terms/Policy updates.

5.1. Direct — The WhatsApp Handoff. When you click "Contact Seller" on Dapor Direct, the Platform redirects you to WhatsApp on your device. Once you leave Dapor, your data is governed by WhatsApp’s own Privacy Policy; we have no access to that chat and cannot mediate disputes or recover messages there.

5.2. Drop — In-App and Order Notifications. For Dapor Drop, communication (order confirmation, MOQ pool status, Dropzone arrival notification) takes place via in-app notification, SMS, or email, rather than WhatsApp.

6.1. To Counterparties:

• Direct: Your phone number is disclosed to the Caterer when you initiate a WhatsApp chat.
• Drop: The Caterer receives the order details necessary for fulfillment (items, quantity, Dropzone). The Caterer does not receive your payment details.
• Caterer Public Profile: A Caterer’s profile information (name, area, certificates) is displayed publicly to Users. We review certificates for apparent validity at the time of submission but do not conduct ongoing on-site inspections, and are not liable if a Caterer’s actual practices fall below certified standards after our review (see also our Terms of Service, Section 6.2).

6.2. To Service Providers:

• Payment Processing (Drop): We share the necessary order and payment amount information with Chip to process your payment. Chip’s own privacy and security practices govern how it handles your card/e-wallet data.
• Cloud Infrastructure: We use third-party cloud storage and database providers to host account data securely.
• SMS Gateways: We use third-party SMS providers to deliver OTPs and order notifications.

6.3. Legal Requirements: We may disclose data to law enforcement or regulatory authorities where required by a court order or valid legal request (e.g., fraud investigation).

8.1. We retain your Dapor profile data as long as your account is active.

8.2. If you request account deletion, your profile is removed from our live database. Deleting your account does not delete WhatsApp chat history on your (or the Caterer’s) personal device, which we do not control.

8.3. Marketplace (Retired). Data associated with the discontinued Marketplace feature has been archived rather than deleted, and is retained in accordance with applicable record-keeping and audit requirements.

8.4. Transaction records for Dapor Drop orders are retained as required under applicable tax and PDPA record-keeping obligations, even after account deletion.

9.1. The Platform is intended for individuals aged 18 and above. We do not knowingly collect data from minors.

11.1. In accordance with the PDPA, this Policy is issued in English and Bahasa Malaysia. In the event of conflict, the English version prevails.