Consent and documents
Take the details.
Then actually let them go.
The hard part was never collecting things. It’s that nothing ever throws them away.
A car dealer takes a photo of an IC
Plus the driving licence, plus the salary slip. It goes to the finance company, the application is decided, and everyone moves on. Two years later the photos are still on a phone, in a WhatsApp thread, in a folder called hp customers.
Nobody decided to keep them. Nobody decided anything.
It fits rental deposits, employment onboarding, insurance claims — anywhere a business handles somebody’s documents on the way to a third party.
In the order it happens
Collect
They fill it in on their own phone
You choose what the form asks for — name and number, or IC, address, employer, income, a photo of a licence. The camera opens straight to the back lens, because nearly every one of these is a photo of a card held in the other hand.
Agree
In the language they read
The wording is written for the case — financing, marketing, CCTV, an event — in English and Bahasa Melayu. What they agreed to is kept as they saw it, with the time, and every consent carries its own withdrawal link.
Use
Hand the details on, do the job
Your register knows who agreed to what, so you always know who you may message and who you may not. Search it by name or any part of a number.
Destroy
On the date you decided, without being asked
Documents carry a destruction date from the moment they arrive. A scheduled job removes them, and the app refuses to open one that is past its date even if that job is running late. You can destroy anything earlier whenever the job is done.
Prove
The record outlives the file
What the document was, when it arrived, when it went and whether a person or the schedule did it. That record is what you show if someone asks whether you still hold a copy — and it says nothing about what the document showed.
How long? That’s your call, and we won’t pretend otherwise
There’s no number in the Order, and there isn’t one hiding anywhere else either — the test is whether you still need the thing for what you took it for. So PDPO Go ships with no default and never suggests a figure. You decide, the app holds you to it, and a form where nobody has decided is reported rather than quietly left forever.
And the paperwork you’re supposed to have
Answer plain questions about your business — what you collect, why, who you send it to, how long you keep it. Out comes a customer privacy notice and a short staff data protection policy, in both languages, ready to publish.
Your Trust Centre page
A public address you can hand to anyone who asks what you do with their data. Your notice is on it, and so is the way to ask you for a copy of their details.
trust.pdpo.ai/p/your-shop