Privacy Notice

This notice explains how SportGivs handles your personal data under Malaysia's Personal Data Protection Act 2010 (as amended). A Bahasa Malaysia version is available on request.

1. Who we are

SportGivs is operated by Ruji Labs (the data controller). For privacy questions or to exercise your rights, contact us at the email on our Who We Are page.

2. What we collect

Account details (name, email, password — stored only as a secure hash); for program organisers, the person-in-charge's name, contact, email, address and IC/NRIC number; for sponsors, your name, email, phone and the equipment you sponsor; and payment records (amount, status, gateway references). We collect this only with your consent and only to run the platform.

3. Why we use it

To create and manage your account, verify programs (due diligence), process sponsorships and deliver equipment, send you receipts and delivery updates, and meet legal/accounting obligations. We do not sell your data.

4. Who we share it with

Only with service providers needed to operate: Brevo (email), Curlec/Razorpay (payments), DigitalOcean (hosting) and Cloudflare (security/CDN). Some may process data outside Malaysia; by using SportGivs you consent to this transfer. We never publish an organiser's personal contact details or IC number on public pages.

5. How we protect it

Encrypted connections (TLS), hashed passwords, encrypted IC/NRIC numbers at rest, role-based access, rate limiting and parameterised database access. We follow the PDP Security Standard 2015.

6. How long we keep it

No longer than necessary. Rejected submissions and their IC data are purged after 90 days; payment records are kept for 7 years for audit; sponsor contact details are kept while your account is active and removed on request.

7. Your rights

You may access, correct, withdraw consent, request deletion of, or request a copy (portability) of your personal data. Email us and we will respond as required by the PDPA. You may also lodge a complaint with the Personal Data Protection Commissioner (pdp.gov.my).

8. Data breaches

If a breach occurs that poses a significant risk, we will notify the PDP Commissioner promptly and affected individuals where required.

Last updated June 2026. This notice may be updated; material changes will be posted here.