1. Introduction
M1 Merchant Sdn Bhd (“M1 Merchant”, “we”, “our”, “us”) operates the Road2Haramain brand and the public-facing pilgrim experience described at road2haramain.app. The payment, e-money and wallet infrastructure behind the Road2Haramain app is operated by MobilityOne Sdn Bhd through the MiPAY platform.
This Privacy Policy explains how personal data is collected, used, stored, shared and protected across the Road2Haramain ecosystem, including the website at road2haramain.app, the Road2Haramain mobile app (when launched), and the wallet and payment services provided through MiPAY.
By using Road2Haramain, you agree to the practices described in this Policy. If you do not agree, please discontinue use of the relevant services and contact us using the details in section 11.
2. Personal Data We Collect
Depending on how you interact with Road2Haramain, we may collect the following categories of personal data:
- Identity data: full name, identification number (NRIC or passport), date of birth, nationality, photograph and biometric data captured during eKYC.
- Contact data: mobile number, email address, residential or mailing address.
- Account and wallet data: Road2Haramain user ID, MiPAY wallet ID, transaction history, balance, device identifiers and authentication logs.
- Transaction data: payment amounts, counterparties, merchants, time stamps, payment methods and reference numbers.
- Partner-service data: booking, accommodation, travel, health, learning or protection data shared with you by our partner ecosystem when you use those services through Road2Haramain.
- Technical data: IP address, device type, operating system, browser, crash logs and aggregated usage analytics.
- Communications data: messages you send us through the contact form, partner enquiry form, email or other channels.
3. How We Use Personal Data
We use personal data for the following purposes:
- To register and verify your Road2Haramain account, including eKYC, sanctions screening and ongoing risk checks.
- To operate, secure and improve the Road2Haramain app, the MiPAY wallet and associated services.
- To process payments, settlements, refunds and other transactions through MiPAY.
- To connect you with partner services you choose to use through the R2H ecosystem.
- To provide customer support, respond to enquiries and resolve complaints.
- To comply with applicable laws and regulations, including anti-money-laundering, counter-terrorism-financing, tax and reporting obligations.
- To send you service notices, security alerts and (where you have opted in) product or partner updates.
4. Sharing of Personal Data
We do not sell personal data. We share personal data only as needed to operate the Road2Haramain ecosystem and as required by law:
- MobilityOne / MiPAY: the e-money and payment infrastructure provider, which processes wallet, payment and transaction data on our behalf.
- Partner services: when you choose to use a partner service through R2H, the relevant partner receives the data needed to fulfil that service (e.g. accommodation requests, travel bookings, protection onboarding).
- Service providers: hosting, customer support, KYC verification, fraud detection, communications and analytics vendors bound by confidentiality and data-processing obligations.
- Regulators and authorities: where required by Bank Negara Malaysia, the scheme operator, law enforcement or other lawful authority.
- Corporate transactions: in connection with a merger, acquisition, financing or restructuring of M1 Merchant Sdn Bhd, subject to confidentiality safeguards.
5. Cookies and Similar Technologies
The public website at road2haramain.app uses cookies and similar technologies to operate the site, remember your preferences and understand aggregate usage. See our Cookie Policy for details, including the types of cookies used and how to manage your preferences.
6. Data Security
We employ administrative, technical and physical safeguards designed to protect personal data, including encryption in transit and at rest where appropriate, access controls, role-based permissions, audit logging, secure hosting and security testing (VAPT) where required by the MiPAY platform framework.
No system is perfectly secure. If we become aware of a personal-data breach affecting you, we will notify you and the relevant authorities in accordance with applicable law.
7. Your Rights and Choices
Subject to applicable law (including the Personal Data Protection Act 2010 of Malaysia), you may have the right to:
- Request access to the personal data we hold about you.
- Request correction of inaccurate or incomplete personal data.
- Request deletion of personal data, subject to our legal and regulatory retention obligations.
- Withdraw consent for processing that is based on consent, without affecting prior lawful processing.
- Opt out of marketing communications at any time.
To exercise any of these rights, contact us using the details in section 11. We may need to verify your identity before acting on your request.
8. International Data Transfers
Some of our service providers, infrastructure components and partner services may be located outside Malaysia. Where personal data is transferred outside Malaysia, we take steps to ensure that it is protected in accordance with this Policy and applicable law, including through contractual safeguards with the receiving party.
9. Data Retention
We retain personal data for as long as needed to provide the Road2Haramain services, comply with legal and regulatory obligations (including AML/CFT and audit requirements), resolve disputes and enforce agreements. Specific retention periods may vary by data category and applicable law.
10. Updates to This Policy
We may update this Policy from time to time to reflect changes in our practices, our services, or applicable law. The “Last updated” date at the top of this page indicates when the latest changes took effect. Material changes will be communicated through the Road2Haramain app or website where appropriate.
11. Contact Us
If you have any questions about this Policy or how your personal data is handled, please contact: