PETRONAS Dagangan Berhad Privacy Statement

Introduction

1. The main purpose of this Privacy Statement is to make you better understand the reasons and purposes of the collection of personal data by PETRONAS Dagangan Berhad (hereinafter referred to as “PDB” or “the Company”) and its group of companies (hereinafter referred to as “PDB Group”) as well as our commitment to ensure that your personal data is securely processed and kept.
2. For the purpose of this Privacy Statement, please note that PDB Group refers to PETRONAS Dagangan Berhad and all its related companies, as defined in section 7 of the Companies Act 2016 and jointly controlled companies, excluding companies, branches, offices, and other forms of presence operating outside of Malaysia unless and to the extent otherwise stated. If any member entity within the PDB Group has its own privacy statement governing their handling of personal data of their customers, the privacy statement of that specific entity will apply instead. If there are any conflicts or discrepancies, the terms stated in the entity's own privacy statement will take precedence over this Privacy Statement.
3. For the purpose of this Privacy Statement, the term “personal data” shall refer to any information that relates directly or indirectly to an individual, from which the said individual may be identified, and shall include sensitive personal data and expressions of opinion about any individual. Sensitive personal data may include information such as physical or mental health or medical conditions, political opinions, religious or other similar beliefs, commission or alleged commission of any offence.
4. Further, the term “Network” shall cover the MyMesra website and its product microsites and apps including, but not limited to PETRONAS Dagangan Corporate Site, PETRONAS Primax site, PETRONAS Dynamic Diesel site, PETRONAS Mesra Loyalty Programme site, and PETRONAS PitStop App, E-Service 2.0, MyStation and SmartPay Online.

Scope of Application

5. This Privacy Statement is issued to all individuals who are visitors or users of our premises and/or Network, individuals who provide us with their personal data in the course of using or procuring any of our products and services, or otherwise provide us with their personal data during the course of dealings with us in any way or manner, including pursuant to any transactions and/or communications made from / with us.
6. Depending on the context, “you” or “your” may refer to:
   • Our end users and customers, i.e., individuals who use any of our products or services for personal use; individuals who register any account with us or otherwise transact with us through our Network, whether in connection with our MyMesra and SmartPay offerings or any other offerings;
   • Representatives of our end users, customers, and business partners, i.e., individuals acting on behalf of any business or corporate users in any communications, registration process or transactions with us; and
   • Our visitors, i.e., individuals who visit and/or use our premises and/or Network or otherwise communicate with us without being logged into a user account (for instance, if you send an email to us requesting for more information because you are considering being a user of our services; where you attend any of our meetings, seminars, conferences, talks, exhibitions, customer satisfaction surveys, or other events organised and/or sponsored by us).
      
7. By providing your personal data to us and by using our products, services, or Network, you consent to our collection, use and disclosure of your personal data in accordance with this Privacy Statement. You confirm that all Personal Data provided by you is accurate and complete, and that none of it is misleading or out of date.
8. To the extent that you have provided (or will provide) personal data about any other individuals, you confirm that you have explained (or will explain) to them that their personal data will be provided to, and processed by, us and you represent and warrant that you have obtained their consent to the processing (including disclosure and transfer) of their personal data in accordance with this Privacy Statement.

Nature of Personal Data We Process

9. The personal data that we may collect and process in relation to you include, but is not limited to, the following:
   • Personal particulars and contact details, such as your name, copies and other details of your identity documents and proof of identification (for instance, NRIC number, passport number, driver’s license etc.), proof of address and other contact details (for instance, residential or business address, telephone/facsimile number, email address etc.), information concerning age, gender, race, nationality, date of birth, occupation and position as well as your photographs and video recording;
   • Business contact information, such as your company name and details, your job designation, and your nature of employment;
   • Account information, such as your username, password, and any other information you disclose in your user profile;
   • Transaction and financial details, including the purpose of transaction, transaction history, types of goods or services requested, credit/debit card details (including card number, cardholder name, CVV codes and expiration dates), PETRONAS Gift Card data, and bank account details;
   • Vehicle Information, including your type of vehicle, information on your driving preferences, licence plate number, and vehicle location;
   • Personal preferences and interests, including your spending behaviour;
   • Feedback and opinions, including your testimonials, reviews, and ratings of our products and services, whether they are provided directly to us or whether they are published on any other platforms in the public domain;
   • Device information such as device hardware information, International Mobile Equipment Identity (IMEI) number, phone number, phone model, app version serial number, current software version, mobile country code, mobile network code, device operating system versions, and settings of the devices you use to access our Network;
   • Log information such as browser and uniform resource locator (URL) information, geolocation information, IP address information, the time and duration of your use of our Network, diagnostic, technical, error, and usage information page views, history of profile updates and password changes;
   • Loyalty information, if you decide to become a member of our Mesra Loyalty Programme, we may process relevant data such as the status of your account, the number of points you have earned, purchase history, your reward status levels, and reward redemption history;
   • Dietary requirements for events management; and
   • Any other personal data you provide to us or collected by us in the course of your dealings with us.
      
10. The above description of personal data is a general description of the various types of personal data that we collect from various data subjects. The nature of personal data differs from one data subject to another.
11. Depending on the nature of business and circumstances, we may only need to collect and process a more limited form of personal data from certain data subjects. In other situations, there may be a need to collect more personal data depending upon the nature of transaction, business and so forth. We do not believe in collecting excessive personal data and what we collect are the essentials that are required to ensure the efficacy of business and transactions. You may choose whether or not to provide your personal data to us, including sensitive personal data.
12. In addition, please note that PDB will have access to any such information which you provide to (or which is gathered by) any of the websites of PDB’s subsidiaries or affiliates.
13. If you send us personal correspondence such as e-mails, letters, or if other users or third parties send us correspondence about your activities or postings on the Network, we may collect and subsequently store such information into a file specific to you.
14. If you use a service provided by a third party company providing a service co-branded with MyMesra branding, that company may subsequently share your personal data, including any transaction details with us.

What About Minors?

15. If you are under the age of 18 and you provide your personal data to us, you confirm that you have received the consent from your parent, guardian or person who has parental responsibility over you to share your personal data with us. Please be assured that your personal data will be processed in compliance with the terms of this Privacy Statement.
16. To the extent that you have provided (or will provide) personal data about your dependents, you confirm that you have explained to them that their personal data will be provided to, and processed by us and you represent and warrant that you have obtained their consent to the processing (including disclosure and transfer) of their personal data in accordance with this Privacy Statement. In respect of minors or individuals not legally competent to give consent, you confirm that you consent on their behalf to the processing (including disclosure and transfer) of their personal data in accordance with this Privacy Statement.

Source of Personal Data

17. Generally, the personal data that we collect comes directly from you. For instance, when you contact us, communicate, or register with us (whether online or otherwise) or enter into any transactions with us. We may also collect your personal data from a variety of sources, including without limitation, at any meetings, seminars, conferences, talks, exhibitions, customer satisfaction surveys, or other events organised, conducted and/or sponsored by us.
18. Apart from the information provided by you, the Company may obtain your personal data from other third parties such as credit reporting agencies, public databases, other third parties connected to you (for instance, from reference checks or background checks), governmental authorities, and from such other sources to which you have given your consent to disclose your personal data to us as well as from publicly available sources.

Importance of Providing Your Personal Data

19. We would like you to understand that it is necessary for you to provide your personal data to us for the purpose of communication with you, to provide and promote our products and services or those of our partners, for providing convenience to corporate customers, for fleet management and to manage our customer loyalty programmes.
20. The failure to supply your personal data as requested may result in us being unable to continue to communicate with you effectively or otherwise provide you with the services and/or products that you require or request. You should also ensure that the personal data which you have supplied to us is kept up-to-date, and you should notify us of any changes so that we may update our records.

Purposes of Processing Your Personal Data

21. Your personal data may be collected and processed by any entity within the Company for the following purposes
    1. Customer and account management
       • to communicate with you;
       • for customer onboarding and related processing such as account registration and opening, eligibility assessment, and personal information verification;
       • for management and maintenance of your account with us and of your MyMesra loyalty card and PETRONAS gift card;
       • for general customer data management such as organising data into databases;
       • to enter into any commercial contracts and dealings with you;
       • to manage and process any enquiries and complaints from you;
       • for the purpose of organising and administering any of our events, surveys, campaigns, contests including to send you any invitations, prizes, or any information related thereof;
       • to send newsletters, offers, festive and birthday greetings, and various public relations notices to you;
       • to share any of your personal data with our business partners to jointly develop products and/or services or launch marketing campaigns;
       • to obtain and process any feedback, reviews, and testimonials from you regarding our products and services;
    2. Provision of goods and services
       • to facilitate the delivery of our products and services to you, including physical goods delivery; for those purposes specifically provided for in any particular product or service offered by the Company;
       • to provide you with general customer support services;
       • to process any payment made to us in connection with our provision of goods or services to you, and to provide refund payments, where applicable;
    3. Marketing and analytics
       • for conducting marketing, promotion, customer survey, and client profiling activities in connection with any of our existing or future products and services and those of our business partners;
       • to create aggregated data and portraits of MyMesra audience, which present anonymous statistical demographic information but no personal data;
       • to improve our marketing and promotional efforts and to tailor our offerings to you;
       • to statistically analyse your Network usage;
       • to analyse your preferences and habits in order to personalise, enhance, and optimise your experience on our Network, as well as of your usage of our products and services;
       • to improve our content, products, and offerings and to customise our Network's content, layout, and services;
       • for research, benchmarking and statistical analysis;
    4. Participation in events
       • to facilitate your participation in, and our administration of, any events including any meetings, seminars, conferences, talks, exhibitions, customer satisfaction surveys, or other events organised and/or sponsored by us;
       • to provide you with post-event notifications for internal business operations and administrative purposes (such as to receive feedback from you);
       • to publish or upload materials which may contain images or videos of you in the context of the events in our Network and/or other media;
    5. Compliance, verification, and harm prevention
       • for customer due diligence and verification, particularly to comply with any know-your-customer requirements under any applicable laws;
       • for fraud and dispute investigation and management in relation to MyMesra cards or any of our other offerings;
       • to investigate any instances of suspected or actual personal data breach incidents;
       • to manage risks including to perform creditworthiness and solvency checks, as well to obtain your credit information and verify your credit history with data obtained from credit reporting agencies or any other source deemed appropriate under any applicable laws in relation to your transaction or dealings with us;
       • for meeting or complying with any legal, regulatory or statutory requirements relating to our provision of services and products and to make disclosure under the requirements of any applicable law, legislation, rule, ruling, regulation, direction, court order, by-law, guideline, circular, code applicable to us or any member of our group of companies;
       • to enforce, or investigate any actual or suspected violations of, our Terms and Conditions or any applicable end-user agreements;
       • for risk management purposes, including, risk monitoring and evaluation.
    6. For internal administration
       • for our internal record keeping, maintenance and updating of any information database(s), customer service-related matters and other administrative purposes;
       • for management of information technology, such as for the purpose of business operations, including information technology operation, information technology security and information, technology security monitoring, business management in compliance with internal regulations policies and procedures;
       • for any regulatory and taxation submissions to the relevant authorities;
       • for management and operation of our Network to ensure that it is properly functional, efficient, and safe for all of our customers and users;
       • for troubleshooting problems, internal diagnostics and related assessments in order to provide software updates, maintenance services, technical support and other important notices and support;
       • for the purpose of entering into any commercial transactions with third parties such as any project engagement with external business partners;
       • for the purpose of entering into any corporate and financing transactions such as sale or transfer of business, security financing and other financing transaction, merger and acquisition, joint venture, business reorganisation or other similar cases; and
       • to store, host, and back up your personal data, whether within or outside Malaysia, whether for disaster recovery or otherwise.
    7. Use of Artificial Intelligence (“AI”) in Customer Engagement
       • PDB is committed to enhancing customer experience and operational efficiency through responsible use of technology. As part of our ongoing digital transformation, we have integrated AI capabilities into our existing communication chatbot. This AI functionality supports the following objectives:
         • Enhanced Customer Experience: AI is used to improve the chatbot’s ability to understand and respond to customer queries more accurately and naturally, thereby delivering a more seamless and intuitive interaction;
         • Improved Service Efficiency: AI facilitates faster response times and more efficient handling of customer enquiries by assisting in the identification and resolution of customer issues through the communication channel;
         • Operational Optimization: By automating responses to routine or frequently asked questions, AI enables our human agents to focus on more complex tasks and customer needs, thereby improving overall productivity and service quality.
       • The AI functionality processes certain personal data, such as your name, contact information, and the content of your messages, to understand your query and provide appropriate responses. PDB ensures that this processing is conducted strictly in line with applicable data protection laws and is limited to what is necessary to fulfil the purposes described above. In particular:
         • No Solely Automated Decisions: We do not make decisions that produce legal or similarly significant effects on individuals solely through automated means. Any such decisions will be subject to meaningful human oversight and review;
         • Human Review of Significant Outcomes: Where automated processing may significantly affect individuals, such as in service eligibility or complaint resolution, a qualified human representative will review and validate the outcome before any final decision is made.
       • Please refer to Paragraph 45 with regards to your right as a data subject in relation to AI-driven processing. You have the right to access, correct, inquire about, or withdraw consent for the processing of your personal data held by PDB subject to legal requirements, by contacting mesralink@petronas.com
          
22. Other than the purposes mentioned above, we may process your personal data in other circumstance, for purposes that are necessary or directly related to your relationship with us or where it is required or permitted under the Personal Data Protection Act (PDPA) or any other applicable laws.
23. We do not collect personal data for any other reasons. Should there be a new purpose for the collection and processing of your personal data, we shall inform you accordingly and obtain your concurrence to the same, where necessary. In processing your personal data, you hereby consent to us supplementing the information that you provide us with information received from authorised third parties.

Our Disclosure of Your Information

24. We treat the confidentiality of your personal data very seriously, as it is of the utmost importance to us. Personal data provided to the Company by you will be kept confidential. However, in certain circumstances, it would be necessary for us to provide or disclose your personal data for the purposes stated above to the following categories of persons (whether within or outside Malaysia) or in the following instances and where we do so, we would merely disclose personal data to the extent necessary for the purpose of such disclosure.
25. We may share your personal data with third parties in the following instances:
    • when it is required by any applicable laws or pursuant to a court or similar order;
    • as deemed necessary, in our discretion, to protect the legal rights or our property or of any of our customers or third parties, or to prevent personal injury;
    • to any other entities within the PETRONAS group of companies including all related companies, subsidiaries, holding companies and associated companies for any of the purposes stated above including without limitation, for marketing and other analytical purposes in order to enhance the provision of our products and services to you;
    • when we are required to transfer personal data to a third party in the event of a sale, merger, assignment, joint venture or other transfer or disposition of a portion or all of our assets or stock, including, without limitation, in connection with any bankruptcy or similar proceedings;
    • financial service providers such as banks, credit card issuers, card associations, acquiring institutions, payment gateways or payment service providers;
    • analytics and search engine providers that assist us in the improvement and optimisation of our Network, including any advertisers and advertising networks;
    • to any other sub-contractors or third party service or product providers, such as our auditors, lawyers, company secretaries, events and training organisers, telecommunications companies, cloud computing or data back-up service providers, customer engagement platform providers and other advisers;
    • to other third parties providing necessary technical services when such access is required in order to provide those services, as well as to provide your personal data to third parties who provide services on our behalf. This is provided that such third parties are bound by contracts with us which require them to provide sufficient guarantees in respect of the technical and organisational security measures governing the processing to be carried out, and to take reasonable steps to ensure compliance with those measures;
    • to various government agencies or competent regulatory and enforcement authorities, wherein you further authorise us to release appropriate information to law enforcement officials when we, in our sole discretion, believe it necessary or appropriate in connection with an investigation of fraud, intellectual property infringement, piracy, or other unlawful activity;
    • any party required or deemed relevant in relation to legal proceedings or prospective legal proceedings; and
    • to any other third parties which we will disclose to you at the point of collection of the personal data, and subject to your consent before such disclosure is made, to the extent required by applicable laws.

Marketing and Promotion Efforts

26. Please note that we may also anonymise or aggregate your personal data by excluding information (such as your name, passwords, bank account information) that make the data personally identifiable to you ("Anonymous Information"), for marketing and promotional purposes. As Anonymous Information is no longer considered personal data under the PDPA, our processing of Anonymous Information is not subject to the requirements as stated in this Privacy Statement.

Co-Branded Services

27. We may from time to time, partner with another company to provide co-branded services. If you wish to use those services, we may provide some of your personal data to that other company. You can avoid these disclosures by choosing not to use such co-branded services. We do not control the privacy practices of those other companies and you should evaluate their practices before using their services.

Transactions with E-Commerce Partners

28. When you provide any personal data to one of our e-commerce partners, this transaction will occur on the e-commerce partner's site, not on our Network, and as such, the personal data you provide is collected and controlled by the e-commerce partner. It is important that you familiarise yourself with the privacy policy of the e-commerce site on which you intend to conduct any transactions.

Surveys and Polls

29. We may conduct surveys and polls to ask for your opinions on our products and services and these surveys and polls may sometimes be sponsored or associated with our third party advertisers and business partners. Most information obtained through surveys and polls is aggregated and used internally or shared with advertisers and partners only in aggregated form.
30. In the event that your personal data is requested as part of the surveys or polls about any of MyMesra members, such personal data will never be provided to third parties without your consent. In such instances, you may expressly choose to receive information from a sponsor/advertiser in which case your information is provided to that sponsor/advertiser only. Some survey answers may be used to help us personalise your experience on the platform and may be added to your profile in order that we can better provide you with content, ads and offers that are most appropriate for you.
31. Completion of any surveys or polls are entirely optional, and we will tell you every time what the purpose of the survey or poll is and how we will process your personal data.

Contests and Quizzes

32. We regularly organise contest, quizzes, and giveaways. We will require information such as email address, first and last names, postal address in order to verify the entrant's identity. This information is shared with a third party hosting the contest or administering the contest on our behalf.
33. You should carefully review the rules and regulations of the contests, quizzes and giveaways which you enter as they may contain additional information about a sponsor's use of your personal data.

Directories of Members

34. We provide directory services to our MyMesra members. Selected information will be collated from your registration form to be included in these directories of members. This service allows other MyMesra members to communicate with you via a contact link provided and it is your choice should you want to proceed with communicating with other members. Information retrieved from your registration form to be included in the directory shall include name, gender and job scope. Categories of directories are individual members, business members and organisation members.

Information Collected by Us Through IP Addresses and Cookies

35. Your IP address is a number that is assigned by the Internet Service Provider (ISP) to your computing devices to identify its location. We use your IP address to help administer and diagnose problems relating to our Network. We also sometimes use IP addresses to communicate with our customers and possibly ban any customers who are not complying with our Terms and Conditions.
36. We use a feature of your Internet Web browser called a cookie to assign a unique identification to your computer. Cookies are files that your web browser places on your computing devices. These cookies are used to tell us whether you have previously visited our website and to help us determine if you came from a particular Internet link. This information is then used to improve the Network and our services. We do not use cookies to retrieve personal data from your computing devices unless your browser is set to allow such retrieval.

Other Information Collectors

37. Except as otherwise provided, this Privacy Statement only addresses the use and disclosure of your personal data that we collect. To the extent that you disclose your personal data to other parties, or other sites throughout the Internet, different rules and policies will apply to their use of the personal data that you disclose to them, and you will therefore be subjected to their rules and policies.
38. We do not control the activities nor the privacy policies of any third parties. We therefore encourage you to make full inquiries with those third parties about their privacy policies before you disclose your personal data to them.

Links

39. The Network may include links to other websites (the "Linked Sites") such as to the websites of our partners and advertisers. We do not control the Linked Sites, and we are not responsible for the privacy practices or the content of the Linked Sites.
40. We shall not in any way be liable or to you or to any third party for any loss or damage whatsoever and howsoever caused, which may arise in connection with the activities and privacy practices of the above mentioned third parties or operators of the Linked Sites, as well as the content of any third party sites, including the Linked Sites.

Security

41. We use industry standard enhanced security systems in order to prevent unauthorised third party access to your personal data. Although we employ efforts to maintain the privacy of your personal data, we cannot guarantee that your personal data will not be intercepted by a third party's illegal efforts to intercept it.
42. We also have put in place privacy protection control systems designed to ensure that your personal data remains safe and private. Each and every one of our employees must abide by our privacy and confidentiality policies. Only authorised employees are permitted to have access to your personal data and such access is limited on a “need to know” basis. In addition, any company with which we contract to be our agent in conducting our business is required to adhere to confidentiality agreements to ensure that your information remains safe and secure. All our employees are required to acknowledge that they understand and will comply with this Privacy Statement in handling your personal data. Employees who violate our policies are subject to disciplinary action, up to and including termination.
43. Further, we strongly encourage our business partners to clearly post their own privacy policies and to have privacy control systems in place to protect your personal data. However, we cannot and do not control the activities of our business partners who do not process personal data under our instructions or otherwise process your personal data as a data user in their own right. In such case, be sure to review their privacy policies and contact them directly if you have any questions.
44. However, where your personal data is processed by our data processors, such as our third party service providers, we will remain responsible for the security of your personal data to such extent as required by the law.

Your Rights of Access, Correction and Withdrawal

45. You have the right to request access to, and correct your personal data that is held by us, and you may contact us at the details provided below if you wish to:
    • check whether we hold or use your personal data and request access to and/or a copy of such data that we retain about you;
    • request that we correct any of your personal data that is inaccurate, incomplete or out-of-date;
    • request that we specify or explain its policies and procedures in relation to data and types of personal data handled by us; and
    • withdraw your consent to us from processing your personal data entirely, or for particular purpose(s) at any time, subject to the requirements of the law. Upon the withdrawal of your consent, we will cease to process your personal data within a reasonable timeframe. However, please understand that your withdrawal of consent may result in us not being able to properly perform or discharge our obligations to you and unable to continue to provide you with the services and/or products requested.
46. You may send your written requests to exercise any of the rights mentioned above by contacting us at mesralink@petronas.com.

Website Visitors

47. We also collect personal data that is collected by Google Analytics. The analytics feature which we have implemented is Google Display Advertising, i.e., a feature to allow us to advertise more strategically, particularly by displaying our advertisements to potential customers at the right place and the right time. You can opt-out of Google Analytics for Display Advertising, customer Display Network ads and tracking by controlling the relevant settings via this link.
48. We will not facilitate the merging of personal data with non-personal data previously collected from Google Display Advertising features that is based on the DoubleClick cookie (i.e., a cookie which we place on your browser to tell particularly inform us which sections of Our Site you are browsing), unless we have robust notice of, and the user's prior affirmative (i.e., opt-in) consent to, that merger. We also collect potentially personally identifying information like Internet Protocol (IP) addresses.
49. Additionally, we also use the Google Analytics Demographics and Interest Reporting features to identify trends in the usage of our website.

Your Password

50. It is your responsibility to maintain the privacy of your username ID and password which you have created in connection with any accounts with us. Please keep your username ID and password in a safe place.

Retention of Your Personal Data

51. Generally, we only keep your personal data for as long as we require it in order to fulfil the purpose for which it was collected or provided to us, or for an additional period afterwards for such period as may be necessary for our business purposes, subject to the requirements and restrictions of all applicable laws.

Incorporation by Reference

52. This Privacy Statement is incorporated by reference into all terms and conditions entered into by our customers with us, unless expressly stated otherwise.

Modifications

53. We may update or amend this Privacy Statement from time to time. Such amendments and updates will be posted on this page. Please read this page regularly to keep yourself informed of our Privacy Statement and practices.

Language

54. In the event of any inconsistency or conflict between the English language version and the Bahasa Malaysia version of this Privacy Statement, the English language version shall prevail.

Contact Information

55. If you have any questions about this Privacy Statement or anything else about MyMesra or any of our products and services, you can contact us via the following details:
    
    Head (Data Privacy) / Data Protection Officer
    
    Address: Level 31, Tower 1, PETRONAS Twin Towers, Kuala Lumpur City Centre, 50088 Kuala Lumpur, Malaysia.
    
    Contact No.: 1-300-88-8181
    
    Email Address: dpo.pdb@petronas.com
    
    Alternative Email Address: mesralink@petronas.com
    
    Effective Date: 25 August 2025
    
    Last Updated: 25 August 2025