Privacy Policy -Superglow Auto Care

# Superglow Personal Data Protection Policy (PDPO)

Last Updated: 12 May 2026

Superglow Autocare ("Superglow", "we", "our", or "us") values your privacy and is committed to protecting your personal data in accordance with the Personal Data Protection Order 2025 (Brunei Darussalam) ("PDPO"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our mobile application and related services (collectively, the "App" or "Services").

## Our Data Protection Principles

Superglow adheres to the following principles under the PDPO:

1. Consent — We collect, use, or disclose personal data only with your knowledge and consent, except where permitted by law.

2. Purpose Limitation — Personal data is collected only for specific, legitimate purposes disclosed to you at the time of collection.

3. Notification — We inform you of the purposes for which your data is collected before or at the time of collection.

4. Accuracy — We make reasonable efforts to ensure your personal data is accurate and complete.

5. Protection — Reasonable security safeguards are applied to protect your data from unauthorized access, loss, or disclosure.

6. Retention Limitation — Personal data is retained only as long as necessary to fulfill the stated purposes or as required by law.

7. Transfer Limitation — Personal data transferred outside Brunei is subject to equivalent levels of protection.

8. Access and Correction — You have the right to access your personal data and request corrections.

9. Accountability — Superglow is responsible for all personal data in its possession and has appointed a Data Protection Officer to oversee compliance.

## 1. Information We Collect

- Personal Information: Name, phone number, email address.

- Vehicle Information: Make, model, year, registration number, and vehicle size classification.

- Booking and Transaction Data: Booking history, services purchased, branch visited, scheduled dates and times, payment method, payment status, completion timestamps, and internal booking references.

- Loyalty and Rewards Data: Points earned, points redeemed, redemption history, voucher issuance and usage, package purchases, and remaining sessions.

- Age Confirmation: A timestamp recording when you confirmed you are 18 years of age or older, and the version of the policy you agreed to. We do not collect your date of birth.

- Marketing Consent: A record of whether you have opted in or out of marketing communications, and when.

- Customer Communications: Reviews, ratings, and feedback submitted in the App; support enquiries.

- Usage Information: Features accessed, services booked, and pages visited.

- Device Information: Device type, operating system, IP address, and browser type for diagnostics and security.

- Location Information: With your consent, approximate location to help you find the nearest Superglow branch.

## 2. How We Use Your Information

We use your data only for the following purposes:

- Creating and managing your Account and providing the Services.

- Processing bookings, payments, packages, and transactions.

- Operating the loyalty Points program, including calculating earnings, processing redemptions, and reconciling Points across branches.

- Managing prepaid packages and tracking session usage.

- Issuing, validating, and redeeming reward vouchers.

- Sending booking confirmations, automated reminders (day-before and same-day notifications), and rescheduling notices. These are transactional messages and are not subject to marketing consent.

- Sending marketing campaigns about offers, new services, and loyalty rewards, where you have given consent.

- Generating personalized service recommendations based on your vehicle and service history (see Section 11).

- Responding to inquiries, feedback, and support requests.

- Displaying your submitted reviews within the App.

- Fraud detection, dispute resolution, and audit of Points or voucher activity.

- Complying with applicable laws and lawful requests from authorities.

## 3. Sharing Your Information

We do not sell or rent your personal data. We may share information only in the following circumstances:

- Service Providers: Third-party processors assisting with payment processing, SMS and messaging delivery, cloud hosting, and analytics. These parties are bound by confidentiality obligations and may only process data as instructed by Superglow.

- Between Branches: Your data is shared across Superglow branches for service delivery, loyalty redemption, and inter-branch reconciliation.

- Legal Obligations: Disclosure required to protect rights, property, or safety, or as required by law or lawful authority.

- Business Transfers: In the event of a merger, acquisition, or restructuring, subject to the same privacy protections.

- Cross-Border Transfers: Your data may be processed on servers located outside Brunei Darussalam (including Japan, where our cloud infrastructure is hosted). We ensure equivalent protection standards are in place for any such transfers, in accordance with the PDPO.

## 4. Data Retention

We retain personal data only as long as necessary for the purposes stated, or as required by law:

Data Category                          | Retention Period

---------------------------------------|--------------------------------------------------

Account and contact information        | Duration of Account + 3 years after closure

Booking and transaction records        | 7 years (accounting and tax obligations)

Loyalty Points and voucher records     | Duration of Account + 3 years after closure

Age confirmation records               | Duration of Account + 3 years after closure

Marketing consent records              | Duration of Account + 3 years after closure

Customer reviews                       | Until removed by request or Superglow moderation

Device and usage logs                  | 12 months

Upon account closure, personal data not required for legal or regulatory purposes will be deleted or anonymised.

## 5. Your Rights Under PDPO

You have the following rights under the Personal Data Protection Order 2025:

- Access: Request a copy of your personal data held by Superglow.

- Correction: Request correction of inaccurate or incomplete data.

- Withdrawal of Consent: Withdraw consent for specific data uses at any time, including marketing communications. Withdrawal does not affect the lawfulness of processing before withdrawal, and does not apply to transactional communications necessary to deliver the Services.

- Data Portability: Request your personal data in a commonly used electronic format.

- Erasure: Request deletion of your personal data, subject to legal retention requirements.

- Complaints: Lodge a complaint with the Authority for Info-communications Technology Industry of Brunei Darussalam (AITI), the designated regulatory authority under the PDPO.

To exercise any of these rights, contact our Data Protection Officer:

- Email: superglow.bn@gmail.com

- Phone: +673 818 3963

- Address: Superglow Autocare, Unit 6, Tan Bee Yong Flat, Spg 5, Kg Menglait, Jln Gadong, Bandar Seri Begawan BE2719, Negara Brunei Darussalam

We will respond to verified requests within 30 days.

## 6. Security

We adopt reasonable organizational and technical measures to protect your data, including:

- Encryption of data in transit using HTTPS/TLS.

- Role-based access controls limiting staff access to data relevant to their function.

- Row-level security on our database, ensuring customers can only access their own data.

- Regular review of access permissions.

No electronic storage or transmission is entirely secure. While we strive to protect your data, absolute security cannot be guaranteed.

## 7. Data Breach Notification

In the event of a data breach that poses a risk to your rights and interests, Superglow will:

- Notify the Authority for Info-communications Technology Industry (AITI) as required under the PDPO.

- Notify affected individuals where required, without undue delay.

- Take immediate steps to contain the breach and mitigate harm.

## 8. Marketing Communications

With your consent, Superglow may send promotional messages about offers, new services, and loyalty rewards via SMS, email, WhatsApp, or in-app notifications.

You may withdraw marketing consent at any time through the App settings or by contacting our DPO. Withdrawal of marketing consent does not affect transactional messages, which are necessary to deliver the Services.

## 9. Children's Privacy

Our Services are intended for individuals aged 18 and above. Customers are required to confirm they meet this age requirement when creating an Account. We rely on this confirmation in good faith and do not collect date of birth as we apply the principle of data minimisation under the PDPO.

We do not knowingly collect personal data from children under 18. If we become aware that we have inadvertently collected such data, we will:

1. Suspend the Account immediately pending investigation.

2. Delete or anonymise all associated personal data.

3. Notify the parent or guardian where contact details are available.

If you believe Superglow holds personal data belonging to a child under 18, please contact our DPO immediately at dpo@superglow.bn.

## 10. Cookies and Device Tracking

The App may use device identifiers, push notification tokens, and local storage for session management, security, and to deliver service reminders. These are necessary for the App to function. No advertising cookies or cross-site tracking are used.

## 11. Automated Decision-Making

Superglow may use automated processing to generate personalized service recommendations based on your vehicle and service history. These recommendations are advisory only and do not produce legal or significant effects on you.

## 12. Data Protection Officer

Superglow has appointed a Data Protection Officer responsible for overseeing compliance with the PDPO and handling data subject requests.

- Email: superglow.bn@gmail.com

- Phone: +673 818 3963

## 13. Regulatory Authority

The supervisory authority for the PDPO in Brunei Darussalam is:

Authority for Info-communications Technology Industry (AITI)

Website: www.aiti.gov.bn

You have the right to lodge a complaint with AITI if you believe your data protection rights have been violated.

## 14. Changes to this Policy

We may update this Privacy Policy periodically. Material changes will be notified through the App at least 14 days before taking effect. Continued use of the Services after updates constitutes acceptance of the revised Policy. Prior versions are available on request from our DPO.