Privacy policy

DRONEPILOT MALAYSIA: PRIVACY AND DATA PROTECTION POLICY

Effective Date: 14 October 2026

Last Revised: 14 October 2026

Governing Legislation: Personal Data Protection Act 2010 (Act 709) of Malaysia

Statutory & Regulatory Alignment: Civil Aviation Act 1969; Civil Aviation Regulations 2016 (MCAR); CAAM Civil Aviation Directives (CAD 601); National Land Code; JUPEM Guidelines on Aerial Photography and Spatial Data Capture; Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA).

1. PRELIMINARY BINDING TERMS & SCOPE OF SERVICE

1.1 Parties and Platform Scope

This Privacy and Data Protection Policy ("Policy") governs the processing of Personal Data by DronePilot Malaysia (referred to herein as "DronePilot", "Company", "we", "us", or "our"), operating the domain `https://dronepilot.my/` and any associated application programming interfaces (APIs), mobile sites, or service endpoints (collectively, the "Platform").

1.2 Status of the Platform

DRONEPILOT OPERATES EXCLUSIVELY AS A TWO-SIDED TECHNOLOGY AGGREGATOR AND COMMUNICATIONS/ESCROW FACILITATOR. DronePilot is neither an air operator nor a surveying contractor. DronePilot does not directly pilot unmanned aircraft systems (UAS), direct physical flight paths, or execute aerial mapping missions. The legal duty to secure statutory operational approvals—including but not limited to the Civil Aviation Authority of Malaysia (CAAM), the Department of Survey and Mapping Malaysia (JUPEM), the Chief Government Security Office (CGSO), the Royal Malaysia Police (PDRM), and the Malaysian Communications and Multimedia Commission (MCMC)—rests strictly and indivisibly upon the participating Client and Remote Pilot/Operator, as contractually allocated between them.

1.3 Binding Agreement

By registering an account, submitting identity credentials, listing an aerial mission boundary polygon, quoting for a job, funding the escrow vault, or utilizing the Platform, you ("User", including Clients, Operators/Pilots, and casual Visitors) expressly consent to the practices, collection vectors, disclosures, and risk assignments set out in this Policy. If you do not accept these terms in full, you must immediately terminate use of the Platform.

2. STATUTORY NOTICING & LEGAL BASES FOR PROCESSING

Pursuant to Section 7 of the Personal Data Protection Act 2010 (PDPA), this Policy serves as statutory written notice of our data collection practices, purposes, and user rights. Processing is conducted pursuant to the following legal bases:

1. Contractual Necessity: Execution and performance of the intermediary platform agreement, bid matching, and milestone-governed escrow services.
2. Statutory & Regulatory Compliance: Fulfilling legal requirements under CAAM CAD 601, JUPEM spatial restrictions, Section 40 of AMLA, Inland Revenue Board of Malaysia (LHDN) directives, and the Companies Act 2016.
3. Legitimate Commercial Interests: Platform integrity, multi-factor eKYC verification, fraud prevention, safety screening against controlled aerodrome boundaries, and dispute resolution.
4. Express Commercial Consent: Given by the data subject at registration or mission creation.

3. CATEGORIES OF PERSONAL DATA COLLECTED

4. CRITICAL AERIAL DATA DISCLAIMERS & THIRD-PARTY CAPTURE

4.1 Incidental Capture of Third-Party Data (Nuisance & Privacy Exemption)

Aerial drone operations frequently capture background environments, including real property, private parcels, vehicles, registration plates, and natural persons.

• Operator Warranties: Operators warrant and represent that they adhere strictly to the general principles of common law privacy, the Penal Code, and CAAM operational constraints. Operators must deploy technical measures (such as spatial blurring, downsampling, or cropping) to obliterate incidental biometric or private identification data where no legal ground exists for processing.
• DronePilot Non-Liability: DRONEPILOT SHALL NOT BE HELD LIABLE AS A DATA CONTROLLER OR DATA USER FOR INCIDENTAL, UNINTENDED, OR COLLATERAL AERIAL RECORDINGS OF THIRD PARTIES, PRIVATE RESIDENCES, OR SENSITIVE INSTALLATIONS. DronePilot functions purely as a passive electronic conduit for file transmission between Operator and Client.

4.2 JUPEM Spatial Data & Restricted Installations

Certain spatial imagery constitutes protected federal survey information or security-sensitive national infrastructure under the Official Secrets Act 1972 and JUPEM Circulars (Arahan Keselamatan Pangkalan Data Ukur).

• Clients and Operators assume sole, undivided criminal and civil liability for ensuring that all missions requiring an Akuan Penerimaan Kerja (APK) or security clearance from JUPEM/CGSO possess valid approvals prior to flight initiation.
• DronePilot disclaims all liability for the interception, seizure, or regulatory prosecution arising from an Operator or Client capturing, hosting, or transmitting unapproved spatial survey data through the Platform.

5. ESCROW DISCLOSURE, DISPUTE RESOLUTION, AND FINANCIAL TELEMETRY

5.1 Financial Processing Architecture

Escrow balances funded via FPX or designated direct clearing mechanisms are held under designated commercial settlement accounts administered in cooperation with Bank Negara Malaysia-licensed financial intermediaries.

5.2 Mandatory Disclosure in Disputes

Where a formal project dispute is raised regarding deliverable quality, flight bounds, or non-performance:

• Users expressly grant DronePilot an irrevocable, non-exclusive license to inspect all submitted mission data, flight telemetry logs, communications, and raw deliverable files.
• DronePilot reserves the right to disclose the complete operational file—including pilot identity records, insurance policies, and flight bounds—to appointed legal counsels, independent technical evaluators, or statutory dispute adjudicators.

5.3 Anti-Money Laundering & Terrorist Financing (AMLA)

DronePilot monitors transaction patterns. We reserve the unrestricted right to submit Suspicious Transaction Reports (STRs) and Cash Threshold Reports (CTRs) to the Financial Intelligence and Enforcement Department (FIED) of Bank Negara Malaysia without providing notice or disclosing such actions to the affected User.

6. CROSS-BORDER DATA TRANSFERS & INFRASTRUCTURE HOSTING

6.1 Server Topologies & Edge Processing

The Platform utilizes distributed cloud architectures (including Supabase, Amazon Web Services, and specialized database hosting engines) whose physical servers, backup clusters, and edge caching nodes may reside outside Malaysia (e.g., in Singapore, the United States, or the European Union).

6.2 Compliance with Section 129 of the PDPA

By utilizing the Platform, the User explicitly consents under Section 129(3) of the PDPA to the transfer, storage, and processing of their Personal Data, mission boundaries, identity records, and escrow metadata outside Malaysia. We ensure that our infrastructure vendors are bound by rigorous contractual data protection agreements and internationally recognized security certifications (such as ISO/IEC 27001 and SOC 2 Type II).

7. THIRD-PARTY DISCLOSURES & REGULATORY DISPATCH

We do not sell, rent, or trade your Personal Data. We disclose Personal Data strictly within the parameters detailed below:

1. Transactional Counterparties: Awarded Operators receive the Client's site manager contact details and site boundary specifications. Clients receive the Operator's verified name, CAAM pilot certificate verification status, and insurance certificates.
2. Statutory Law Enforcement & Aviation Oversight: DronePilot shall disclose all requested log files, pilot credentials, flight plans, and user profiles to CAAM, PDRM, MCMC, or the Courts of Malaysia upon receipt of a valid subpoena, warrant, official directive, or immediate aviation safety inquiry.
3. Corporate Transitions: In the event of a merger, acquisition, divestiture, or bankruptcy of the Company, user data assets will be transferred as part of the commercial enterprise, subject to the acquiring entity's continued adherence to this Policy.

8. DATA RETENTION, SECURITY CONTROLS, AND STORAGE DISPOSAL

8.1 Technical Security Controls

We employ defense-in-depth infrastructure to protect data assets:

• In-Transit Encryption: Enforced TLS 1.3 protocol encryption for all data traversing web browsers, mobile endpoints, and APIs.
• At-Rest Encryption: AES-256 bit hardware-level encryption across cloud database tables, identity file buckets, and media object stores.
• Access Governance: Zero-trust architecture, multi-factor administrative authentication, and strict least-privilege role segregation.

8.2 Retention Schedules

• Account Records: Maintained throughout the active existence of the User's account.
• Financial & Audit Logs: Retained for a minimum statutory period of seven (7) years following the completion of an escrow transaction in accordance with the Malaysian Companies Act 2016 and LHDN requirements.
• Regulatory Compliance & Dispute Artifacts: Flight plans, insurance policies, and permit clearances tied to executed missions are preserved for a minimum of five (5) years to defend against retrospective aviation casualty claims, statutory inquiries, or latent construction defect litigation.
• Disposal Standard: Expired records are deleted, de-indexed, or anonymized using irreversible cryptographic erasure standards.

9. USER RIGHTS & EXERCISE PROCEDURES

Under Sections 30 to 43 of the PDPA, you retain specific rights regarding your Personal Data, subject to our statutory retention requirements:

• Right of Access (Section 30): You may submit a written Data Access Request to inspect your Personal Data maintained in our databases. A statutory fee prescribed under the Personal Data Protection (Fees) Regulations 2013 may apply.
• Right of Correction (Section 34): You may request the rectification of inaccurate, incomplete, misleading, or non-current Personal Data.
• Right to Withdraw Consent (Section 38): You may withdraw consent for continuous data processing. Given that identity and credential processing are fundamental prerequisites for safety, insurance, and escrow operations, withdrawing consent will trigger immediate account suspension and termination of access to the Platform.
• Right to Prevent Processing for Direct Marketing (Section 43): You maintain an absolute right to opt out of promotional newsletters and algorithmic marketing communications at any time.

10. COOKIES, TRACKING PIXELS, AND TELEMETRY

We deploy functional, security, and analytical tracking cookies:

• Essential Cookies: Mandatory for token authentication, session tracking, CSRF protection, and escrow transaction continuity.
• Analytical & Preference Cookies: Used to evaluate platform traffic distribution across Malaysian states, monitor flight path polygon editor performance, and preserve user language settings (English, Bahasa Malaysia, Chinese, Tamil).
• Disabling Tracking: Users may configure browser settings to decline non-essential cookies. However, disabling functional session cookies will break mapping canvases, real-time bidding updates, and the FPX payment gateway integration.

11. INDEMNIFICATION & LIMITATION OF LIABILITY

11.1 User Indemnification

You agree to defend, indemnify, and hold harmless DronePilot, its directors, officers, employees, agents, and technical affiliates from and against any third-party claims, regulatory enforcement actions, penalties, fines, civil litigations, or legal expenses (calculated on a full solicitor-client indemnity basis) arising out of or related to:

1. Your breach of the PDPA, CAAM regulations, JUPEM spatial restrictions, or the provisions of this Policy;
2. The unauthorized, unlawful, or negligent aerial surveillance, recording, or publishing of any individual, property, or facility via missions executed through the Platform;
3. Your failure to obtain required CAAM ATF, JUPEM APK, or local landowner consent for your flight operations.

11.2 Absolute Limitation of Company Liability

TO THE MAXIMUM EXTENT PERMITTED BY MALAYSIAN LAW, DRONEPILOT SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, PUNITIVE, SPECIAL, OR CONSEQUENTIAL DAMAGES (INCLUDING LOSS OF PROFITS, DATA LOSS, REGULATORY FINES IMPOSED ON OPERATORS/CLIENTS, OR THIRD-PARTY PRIVACY TORT CLAIMS) ARISING FROM THE USE OF THE PLATFORM, DELIVERABLE TRANSFERS, OR THIRD-PARTY PENETRATION OF OUR ENCRYPTED SYSTEMS.

12. AMENDMENTS & BILINGUAL PREVALENCE

12.1 Unilateral Revision Rights

We reserve the right to amend, restate, or update this Policy at our sole discretion to reflect structural changes in our technical pipeline, legal precedents, or aviation and data security laws. Material adjustments will be announced via platform banners or sent to your registered email address prior to taking effect. Continued utilization of the Platform following such notices denotes full acceptance of the revised Policy.

12.2 Language Prevalence (Section 7(3) PDPA Compliance)

In accordance with Section 7(3) of the PDPA, this Policy is drafted and published in both the national language (Bahasa Malaysia) and English. In the event of any conflict, divergence, semantic discrepancy, or interpretation dispute between the English and Bahasa Malaysia texts, the English language version shall prevail to the extent permitted by applicable law.

13. STATUTORY DATA PROTECTION OFFICER (DPO) CONTACT

For formal inquiries, data access/correction requests, or reports of privacy violations, address all communications in writing to our designated Compliance Officer:

• Designation: Data Protection & Regulatory Compliance Officer
• Entity: DronePilot Malaysia Regulatory Desk
• Registered Address: Petaling Jaya, Selangor Darul Ehsan, Malaysia
• Compliance Inquiries: `support@dronepilot.my`
• General Legal Support: `support@dronepilot.my`
• Subject Line Standard: `"PDPA Formal Inquiry / Data Subject Access Request - [Your Full Name/Company Name]"`