Penang Smart Kariah Privacy Notice

1. Introduction

Penang Smart Kariah ("PSK", "we", "us", "our") is committed to protecting the privacy and personal data of users of our application and services. This Privacy Notice ("Notice") describes how we collect, use, store, and protect your personal data in accordance with the Personal Data Protection Act 2010 (Act 709) ("PDPA") of Malaysia.

By registering, accessing, or using the Penang Smart Kariah application, you are deemed to have read, understood, and agreed to the terms and conditions contained in this Notice. Please read carefully before providing any personal data to us.

2. Data Controller

The responsible data controller ("Data Controller") under this Notice is the Islamic Religious Council of Penang (Majlis Agama Islam Negeri Pulau Pinang, "MAINPP"). Penang Smart Kariah (PSK) is the official MAINPP platform for kariah management, mosque services, and facilities for kariah members in the State of Penang.

3. Categories of Personal Data Collected

We collect the following categories of personal data from you:

3.1 Identity and Contact Data

• Identification number (MyKad), passport, MyPR, or police/military ID
• Type of identification and citizenship status
• Full name as stated in the identification document
• Date of birth, age, gender
• Email address and mobile phone number
• Residential address, postcode, district, state, and country
• Family information: head-of-household and dependant relationships

3.2 Demographic and Socioeconomic Data

• Race and marital status
• Highest level of education attained
• Occupation and estimated household income
• Home ownership status, date of residence commencement, and duration of residence
• Registered kariah mosque

3.3 Technical and Audit Data

• Device type (Android/iOS), device model, operating system version
• Application version
• IP address (recorded server-side during consent acceptance)
• Account authentication tokens and notification tokens
• Timestamps of registration, login, and in-app activities

3.4 Location Data

• GPS location of your device (with your permission) for prayer time calculation, nearby mosque search, and attendance verification for prayers and activities

3.5 Supporting Documents

• Utility bills as proof of address
• Verification letters related to OKU (disability), asnaf, mualaf (convert), orphan, or chronic illness status
• Profile picture (optional)

4. Sensitive Personal Data

We collect the following sensitive personal data which requires your specific consent:

• Race — for kariah administration and MAINPP statistical reporting
• Health status — including disability (OKU) and chronic illness status, for eligibility for special assistance
• Economic status — including asnaf status, for zakat and welfare assistance eligibility
• Social status — including mualaf and orphan status, for special assistance eligibility
• Religious belief — implicitly given that PSK is a kariah management platform for Muslims in the state of Penang

During registration, you will be asked to provide separate explicit consent for us to process this sensitive data. Without this consent, we will not be able to proceed with your kariah registration as this data constitutes essential information in the kariah management system.

5. Sources of Data

Personal data that we process is obtained from the following sources:

• Directly from you — through registration forms, profile updates, welfare applications, complaints, appointment bookings, and other in-app interactions
• From your head of household — if you are a dependant, your personal data may be entered by the head of household when registering you as a family member
• From MAINPP-authorised mosque officers — during the review and approval process conducted by the Nazir or Mosque Committee members, who are MAINPP personnel within the kariah administration structure
• Automatically from your device — technical data such as device model, OS version, IP address, and GPS location is automatically generated as you use the application

6. Purposes of Data Collection and Processing

Your personal data is collected and processed by MAINPP through PSK for the following purposes:

1. Kariah management — kariah member registration, membership record maintenance, and general mosque kariah administration
2. Welfare assistance services — reviewing eligibility and processing applications for zakat, asnaf, and special assistance (disability, orphan, convert, chronic illness)
3. Complaints and feedback — receiving, recording, and resolving complaints submitted through the application
4. Appointments with mosque officers — facilitating scheduling and confirmation of appointments
5. Community activities and events — attendance management, event registration, and kariah activities
6. Support ticket system — managing user inquiries and technical issues
7. Notifications and communication — sending notifications related to prayer times, mosque activities, and important announcements
8. Reports and statistics — generating anonymised reports for MAINPP administrative purposes and service improvement
9. Legal compliance — fulfilling obligations under the Administration of Islamic Religious Affairs Enactment of Penang and other relevant laws
10. Security audit — recording PDPA consent (including IP address and device fingerprint) for legal compliance purposes

7. Legal Basis for Processing

MAINPP processes your personal data based on the following legal grounds under the PDPA:

• Your consent (Section 6) — for general processing of personal data as provided during registration
• Explicit consent (Section 40) — for processing sensitive personal data as described in Section 4 of this Notice
• Legitimate interests — for kariah administration and the execution of MAINPP's statutory functions
• Legal obligations — to fulfil the requirements of the Administration of Islamic Religious Affairs Enactment of Penang and related laws

8. Data Disclosure

Your personal data belongs to MAINPP and is not sold, rented, or shared with any commercial third party for marketing or profit purposes. MAINPP manages and controls your data directly through the PSK platform and the kariah administration structure.

Mosque officers (Nazir and Mosque Committee Members) who process your kariah applications, complaints, and welfare requests are MAINPP-authorised personnel within the kariah administration structure. They are not third parties — they are part of the same MAINPP organisation.

Data disclosure only occurs in the following limited circumstances:

9. Data Retention Period

We will retain your personal data for a period of 1 to 7 years, in accordance with the General Records Retention Schedule (Jadual Pelupusan Rekod Urusan Am) published by the National Archives of Malaysia (Arkib Negara Malaysia). The retention period is determined based on the purpose of data collection, compliance with legal and regulatory requirements, and MAINPP's internal operational needs.

For personal data of individuals who have passed away, such data will be disposed of from our records upon reaching the maximum retention period of 7 years.

Upon expiry of the retention period, your data will be securely disposed of or anonymised in accordance with the applicable records disposal procedures.

10. Data Security Measures

Your personal data belongs to MAINPP and is always under MAINPP's direct control. We take reasonable technical and organisational measures to protect your personal data from unauthorised access, loss, misuse, disclosure, alteration, or destruction. These measures include:

• Data transmission encrypted using HTTPS/TLS
• User authentication via JWT token-based security with automatic renewal
• API rate limiting to prevent automated attacks
• Audit logging of every consent given, including timestamp, IP address, and device fingerprint
• Role-based access control for authorised mosque officers
• Data stored in secure cloud infrastructure within the Southeast Asia region with data protection standards equivalent to Malaysia's PDPA
• Regular security reviews and software updates

Despite our best efforts, no electronic system can be guaranteed to be 100% secure. You are also responsible for safeguarding your account credentials and not disclosing them to others.

11. Your Rights as a Data Subject

Under the PDPA, you have the following rights regarding your personal data:

• Right of access (Section 30) — to request a copy of your personal data held by MAINPP
• Right to correction (Section 34) — to request us to correct inaccurate, incomplete, or outdated data
• Right to restrict processing (Section 38) — to request us to stop or restrict processing of your data for specific purposes
• Right to withdraw consent — you may withdraw consent that has been given at any time. However, withdrawal of consent for basic data processing will render your account unusable
• Right to file a complaint (Section 42) — file a complaint with MAINPP using the contact information in Section 12. If you are not satisfied with MAINPP's response, you also have the right to file a complaint with the Personal Data Protection Department (JPDP) of Malaysia as provided under Section 42 of the PDPA.

To exercise any of the rights above, please contact us using the information in Section 12. We will respond within 21 days from the date of receiving your complete request.

12. How to Contact Us

If you have any questions, comments, or complaints regarding this Privacy Notice or the processing of your personal data, please contact us at:

13. Changes to This Notice

MAINPP reserves the right to update this Privacy Notice from time to time to reflect changes in law, technology, or data processing practices. The latest version is always available at masjidpro.com/privacy-policy/en.

For material changes, we will request you to provide renewed consent before you can continue using the application. Continued use of the application after the notice update is deemed as your acceptance of the updated version.

Governing Version

In the event of any inconsistency or conflict between the Bahasa Melayu and English versions of this Privacy Notice, the Bahasa Melayu version shall prevail.