Effective Date: 10 July 2026
Websumo Solutions (Co. Reg. No. 201803015504) ("WhatsMenu", "we", "us", or "our") provides the WhatsMenu Driver Application ("Driver App") and related technology services. This Privacy Policy describes how we collect, use, and protect your personal information when you use the Driver App to deliver orders on behalf of a Merchant.
About your relationship with WhatsMenu and your Merchant employer
WhatsMenu is a technology provider only. If you use the Driver App, you do so as an employee of a Merchant (for example, a restaurant, retail shop, or delivery business that uses WhatsMenu to manage their orders). Your employment relationship — including hiring, supervision, pay, working hours, discipline, and termination — is with the Merchant, not with WhatsMenu. WhatsMenu is not your employer, does not pay your wages, does not set your schedule, and does not decide whether you keep your job.
How your driver account is created
Your driver account is created by your Merchant employer, not by you. The Driver App does not allow you to register an account, and it does not allow you to change your name, email address, or phone number. If any of these are wrong, ask your Merchant to correct them.
Data controller roles
- For most personal data processed through the Driver App in connection with your deliveries (including the information your Merchant entered about you, delivery records, and location during deliveries), your Merchant employer is the data controller, and WhatsMenu acts as a data processor on their behalf. Questions about why the Merchant collects certain data, how long they keep it, or whether they share it outside the platform should be directed to your Merchant.
- For a limited category of data (such as account credentials, app technical data, and platform-level security monitoring), WhatsMenu is the data controller, as described in this policy.
Age requirement
You must be at least 18 years old (or the minimum age to hold a valid driver's licence in your jurisdiction, whichever is higher) to use the Driver App.
1. Information We Collect
1.1 Driver Account Information (provided by your Merchant)
Your Merchant sets up your driver account with your full name, your email address, and your phone number. You sign in with your email address and a password.
WhatsMenu does not collect identity documents, driver's licence copies, background check results, criminal history, driving records, insurance details, vehicle registration details, or financial information from drivers. Any such information that your Merchant collects for employment purposes is handled by the Merchant outside of the WhatsMenu platform.
1.2 Location Data
The Driver App collects your precise GPS location only while you are carrying an order you have marked as Picked Up. Collection begins at that moment and stops as soon as the delivery is completed, marked as failed, or you sign out. Section 4 describes this in detail.
We do not collect your location when you are signed out, when you are online and available but carrying no order, or between deliveries.
Location is collected to show your live position to your Merchant and to the customer awaiting that order, to support delivery coordination, and to resolve disputes about a delivery.
1.3 Delivery Records
For each delivery, we record:
- Pickup location and drop-off location
- The times you accepted, picked up, and completed the order
- Any failure reason you report (for example, customer unavailable)
- Where your Merchant requires it, a proof-of-delivery photograph you take at the door
- Where the order is paid in cash, the amount you record as collected from the customer
This information is recorded for your Merchant's operational records.
The Driver App does not show you earnings, pay, ratings, or performance scores, and does not collect them from you.
1.4 Device and Technical Information
We collect your device type, operating system, app version, and IP address. When you sign in, the app registers a push notification token and a device identifier so that order alerts reach every device you use.
The Driver App contains no advertising, no advertising identifier, and no analytics or crash-reporting software. We do not track how you use the app.
1.5 Communications
The Driver App has no built-in messaging. When you call or message a customer, the app opens your phone dialler or WhatsApp, and that conversation is handled by those applications, not by WhatsMenu. We do not read, store, or intercept it. Your own phone number is visible to the customer if you call or message them directly.
We retain emails you send to our support address.
2. How Your Information Is Used and Legal Basis
Under applicable data protection law (including GDPR and UK GDPR), personal data is processed only where there is a valid legal basis.
2.1 Processing by WhatsMenu (as Controller)
Legal basis: legitimate interests, legal obligation
- Operate and secure the Driver App
- Authenticate driver logins and prevent unauthorised access
- Investigate platform-level security incidents
- Provide technical support
- Comply with applicable laws
2.2 Processing by WhatsMenu (as Processor for your Merchant)
Legal basis determined by your Merchant
For delivery-related data, WhatsMenu processes information only on the instructions of your Merchant, for purposes including:
- Delivering to you the orders your Merchant has assigned
- Providing location and tracking information to the Merchant and end-customer during an active delivery
- Logging delivery activity for the Merchant's operational records
- Supporting dispute resolution between the Merchant, customer, and driver
The legal basis for this processing is set by your Merchant (typically performance of your employment contract or the Merchant's legitimate interests in operating their business). Questions about this processing should be directed to your Merchant.
2.3 Communications
Legal basis: performance of a contract
- Send you order notifications and important service updates about the Driver App
3. Information Sharing and Disclosure
3.1 With Your Merchant Employer
As your employer, your Merchant has access to the information in Section 1 relating to your work on their behalf, including your profile information, delivery records, and your location during active deliveries. Your Merchant is responsible for how they use this information in the context of your employment.
3.2 With Customers
During an active delivery only, the customer awaiting that order can see:
- Your name
- Your live location, until the delivery is completed
Customer access to your location ends when the delivery is completed, marked failed, or you sign out. Customers do not retain access to your live location after that point.
If you choose to call or message the customer from the Driver App, your own phone number is disclosed to them by your phone or by WhatsApp. WhatsMenu does not provide a masked or proxied number.
3.3 With Service Providers
We share information with third-party service providers who help us operate the platform, acting on our instructions:
- Cloud hosting and storage providers
- Push notification delivery (Expo and Google Firebase Cloud Messaging)
- SMS delivery providers, where SMS notifications are enabled
These providers are contractually obligated to protect your information and use it only as instructed.
We do not use analytics providers, advertising networks, or data brokers.
When you tap a map or navigation button, the Driver App hands the delivery address to the mapping application you have chosen (such as Google Maps or Waze). That application is operated by a third party under its own privacy policy, and the handoff happens only because you asked for it.
3.4 Legal Requirements
We may disclose information when required by law, including:
- Response to lawful requests, court orders, or government investigations
- Protection of our rights, property, or safety, or that of others
- Prevention or investigation of fraud, abuse, or illegal activity
3.5 Emergency Situations
If we reasonably believe you or another person is in imminent danger, we may share your location and contact information with emergency services (police, medical, or fire services). Where practicable, we will also notify your Merchant. We will not share this information with other parties without your consent or a legal requirement.
3.6 Business Transfers
In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of material changes and ensure appropriate protections remain in place.
4. Location Services and Tracking
4.1 When Location Is Collected
Location is collected only while you are carrying an order you have marked as Picked Up. It starts at that moment and stops immediately when you mark the delivery completed or failed, or when you sign out. There is no delay or grace period after a delivery ends.
We do not collect location when you are signed out, when you are online and available but carrying no order, or between deliveries.
4.2 How Location Is Collected
While a delivery is in progress, the Driver App records your position roughly every 20 seconds, or whenever you move about 50 metres, whichever comes first.
Collection continues while the app is minimised, or while you are using a navigation app, because a delivery cannot be tracked if it stops the moment you switch to Waze or Google Maps. Whenever this is happening, Android displays an ongoing notification reading "Delivery in progress — Sharing your location with the customer until drop-off." That notification disappears when collection stops.
The Driver App also reads your last known position once, at the moment you mark an order as delivered, to warn you if you appear to be far from the drop-off address.
4.3 Use of Location Data
Location data is used to:
- Show your live position to the customer and your Merchant during a delivery
- Order the stops on your delivery route
- Resolve delivery disputes
Your location is not sold, and it is not shared with advertisers or any other third party.
4.4 Retention of Location Data
Precise location records are retained for up to 90 days after a delivery for dispute resolution purposes, after which they are deleted or anonymised, except where longer retention is required by law or requested by your Merchant in connection with an ongoing investigation.
4.5 Your Controls
You can refuse or withdraw location access at any time in your device settings. The Driver App asks only for "while using the app" access. It never requests permission to read your location at times when you are not on a delivery.
If you refuse location access, the Driver App will not share your position, and your Merchant and the customer will not be able to follow your progress. You can still receive orders and mark them delivered. Whether location sharing is required during your working hours is a matter for your Merchant employer to address with you under your employment terms.
5. Automated Decision-Making
WhatsMenu does not make employment-related decisions about drivers. Decisions about your employment, shifts, or continued use of the Driver App are made by your Merchant employer.
The Driver App may use automated processing to:
- Order the stops on your delivery route
- Flag unusual activity on your account (for example, possible security or fraud issues)
If an automated process results in your WhatsMenu account being locked or suspended for platform-level security or fraud reasons, you have the right to:
- Request human review of the decision
- Express your point of view
- Contest the decision
To exercise these rights in relation to WhatsMenu's platform decisions, contact us at support@whatsmenu.my. For decisions about your employment, shifts, or pay, please contact your Merchant employer.
6. Data Security
We implement appropriate technical and organisational measures to protect your information, including:
- Encryption of data in transit (TLS/HTTPS) and at rest where applicable
- Restricted access controls based on role
- Regular security assessments
- Employee training on data protection
In the event of a personal data breach likely to result in risk to your rights and freedoms, we will notify affected drivers, the relevant Merchant, and relevant authorities as required by applicable law, and where feasible, within 72 hours of becoming aware of the breach.
7. Data Retention
We retain information for as long as necessary for the purposes described in this policy.
- Active account data: while your driver account is active with your Merchant
- Delivery records: retained on the Merchant's behalf according to their operational and legal record-keeping needs
- Location data: up to 90 days (see Section 4.4)
- Support communications: up to 3 years after last interaction
- Server logs: typically 90 days
When your employment with the Merchant ends and you no longer use the Driver App, data controlled by WhatsMenu is deleted or anonymised within 90 days, except where retention is required by law. Data controlled by your Merchant is retained in accordance with the Merchant's own retention policies and applicable employment law.
8. Your Rights
Depending on your jurisdiction, you have rights including:
- Access — request a copy of the personal data held about you
- Correction — request correction of inaccurate or incomplete data
- Deletion — request deletion, subject to legal obligations
- Restriction — request limits on how your data is processed
- Objection — object to processing based on legitimate interests
- Data Portability — receive your data in a commonly used, machine-readable format
- Withdraw Consent — where processing is based on consent
- Human Review — of automated decisions affecting your WhatsMenu account (see Section 5)
- Lodge a Complaint — with the data protection authority in your jurisdiction
Where to send your request:
- For data controlled by WhatsMenu (account, app, platform-level data): contact us at support@whatsmenu.my
- For data controlled by your Merchant (employment records, delivery performance, pay, working conditions): contact your Merchant directly. WhatsMenu will forward requests to the relevant Merchant where appropriate.
We will respond within 30 days (or shorter if required by law). We may ask you to verify your identity before fulfilling the request.
Requesting deletion of your account: email support@whatsmenu.my from the address on your driver account. We will deactivate your account, and delete or anonymise the data WhatsMenu controls within 90 days, except where retention is required by law. Delivery records are controlled by your Merchant and are retained under their policies.
9. International Data Transfers
Your data may be processed and stored in countries outside your country of residence, including Malaysia, Singapore, the United States, and the European Union. Where we transfer personal data from the EEA, UK, or Switzerland to a country not recognised as providing an adequate level of protection, we rely on appropriate safeguards, including:
- European Commission Standard Contractual Clauses and the UK International Data Transfer Addendum
- Other lawful transfer mechanisms
Copies of safeguards are available on request.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes through the Driver App, email, or platform notifications. Your continued use of the Driver App after changes take effect constitutes acceptance of the updated policy, subject to any consents required by applicable law.
11. Contact Information
For questions about this Privacy Policy, to exercise your rights regarding data controlled by WhatsMenu, or to lodge a complaint:
Websumo Solutions (Co. Reg. No. 201803015504)
G-09, Jalan Pandan Prima 1, Dataran Pandan Prima, 55100 Kuala Lumpur, Malaysia
Email: support@whatsmenu.my
For questions about data controlled by your Merchant employer (employment records, delivery performance, pay, or working conditions), please contact your Merchant directly.
You also have the right to lodge a complaint with the data protection authority in your jurisdiction.
Last updated: 10 July 2026