Home
Privacy Policy

Privacy Policy

Effective Date: September 15, 2026
Version : HMY/LC-PP-002

Definitions:
This Privacy Policy is our personal data protection notice for customers, prospective customers, website users and other individuals who interact with HMY in the activities described below. Your privacy choices are separate from acceptance of the website Terms of Use.
Stop marketing: Email STOP MARKETING to dpo@hyundaimotor.my
Correct your information: Email UPDATE MY DETAILS to dpo@hyundaimotor.my
You may use your own wording. No account, reason for opting out or marketing consent is required to make a request. See sections 9–11 for details.

1.Who we are and the scope of this Policy

Hyundai Motor Malaysia Sdn. Bhd. (HMY, we, us or our) is the data controller where we determine the purposes and manner of processing your personal data. We process personal data in accordance with the Personal Data Protection Act 2010 (Act 709), as amended, and applicable regulations, standards, directions and requirements issued under it (PDPA).

This Policy covers HMY’s website at www.hyundai.com/my, enquiries, vehicle sales support, test drives, aftersales and ownership support, customer-care activities, events and marketing. Specific notices may supplement it for an application, connected service, event, recruitment activity or other particular purpose. A specific notice applies to that activity, but does not remove your statutory rights.

Hyundai Motor Company (HMC), Hyundai Manufacturing Malaysia Sdn. Bhd. (HMMY), dealers, insurers, financiers and other providers are separate legal entities. They may act as independent data controllers or process data on HMY’s behalf, depending on the activity. This Policy does not describe all processing they independently undertake. HMY remains responsible for its own obligations, including its disclosures

2. Personal data we process

Depending on your relationship and interactions with us, we process identification and contact details, such as your name, contact address, telephone number and email address; customer or account identifiers; contact preferences; and evidence of authority where you act for another person. Identity-document details are requested only where reasonably needed for a transaction, legal requirement or appropriate verification.

We process relevant vehicle and ownership information, including registration and vehicle identification numbers, model, ownership or authorised-user details, purchase and delivery records, mileage, service history, diagnostic information, warranty and recall records, and information needed to investigate a technical issue or complaint.

We process enquiry, appointment, test-drive, event and customer-care records, communications and feedback; relevant transaction, invoicing, payment and refund information; and records of notices, consent, preferences and requests. Where calls are recorded or CCTV is used, the relevant collection-point notice will explain that activity.

When you use our digital services, relevant data may include device and browser information, IP addresses, security logs, online identifiers, account activity and information generated through cookies or similar technology. Connected-vehicle location, telemetry or driving information is processed only where the relevant function is available and the applicable notice and legal requirements have been addressed.

We do not collect every category from every person. Sensitive personal data, including health information and biometric data, is processed only for a specified need and in accordance with section 40 of the PDPA, including explicit consent where required. This Policy does not itself obtain that consent or authorise a new sensitive-data activity.

3. Where personal data comes from

We obtain personal data directly from you when you contact us, submit a form, attend an event, request or use a service, make a purchase or communicate your preferences. We also obtain relevant information through our website and digital services as described in this Policy.

Where lawfully permitted, information may come from authorised Hyundai dealers and service centres; HMC or HMMY; the previous Hyundai distributor, Hyundai-Sime Darby Motors Sdn. Bhd., or the relevant entity involved in the distribution transition; event organisers; service providers; insurers or financiers involved in a requested transaction; and a person authorised to act for you. The source relevant to a particular exercise may be identified in the accompanying notice.

Information obtained from another organisation is not automatically available for every purpose. Its use remains subject to the applicable permission or other lawful condition, the relevant notice, disclosure restrictions and your recorded choices. If you provide another person’s data, provide only what is needed and ensure you are authorised to do so and that the person receives the relevant notice.

4. Why we process personal data

We use relevant personal data to respond to enquiries; arrange quotations, appointments and test drives; support purchases, delivery and registration; provide requested products or services; administer payments and refunds; and maintain accurate customer and ownership records.

We use relevant information to provide aftersales support, assess and administer warranty claims, investigate complaints and technical issues, manage repairs, communicate recalls or safety matters, verify ownership or authority, and support continuity when a distributor, dealer or service arrangement changes. Business continuity is a purpose description, not a blanket permission for marketing.

Subject to your choices and the applicable legal requirements, we use information to administer events and campaigns, conduct customer research or satisfaction activities, improve services, and communicate Hyundai products, services and promotions. Advertising, audience matching, personalisation or profiling involving identifiable individuals is subject to the applicable notice and permission; it is not treated as essential ownership support.

We also process information as lawfully necessary for security, fraud prevention, accounting, audit, legal and regulatory compliance, responding to lawful requests, and establishing, exercising or defending legal claims. We may use genuinely anonymised information for analysis where individuals are no longer reasonably identifiable; coded or pseudonymised records remain protected where they can identify you.

5. Consent and other lawful conditions

We obtain and record consent where required. Where the PDPA permits processing without consent, we rely only on an applicable condition, such as necessity for a contract with you, steps you request before a contract, compliance with a legal obligation, protection of vital interests, administration of justice or a function conferred by law. Sensitive-data processing and disclosures must also meet their applicable requirements.

Reading this Policy, browsing the website, owning a Hyundai vehicle or failing to reply to a message does not, by itself, constitute new consent to marketing or another optional use. We do not make optional marketing consent a condition of handling an enquiry, privacy request or necessary aftersales support. Where a new purpose requires further notice or consent, we address that before proceeding.

6. Required and optional information

We identify information that is required for a particular transaction, service or legal obligation at the point of collection. Without information reasonably necessary to verify ownership, investigate a warranty claim or arrange a requested service, we may be unable to complete that particular activity. We will explain the relevant consequence; it is not an automatic loss of unrelated rights or benefits.

Other information and optional marketing permissions may be withheld. You need not provide an NRIC copy, vehicle documents or unrelated details merely to unsubscribe where the relevant contact identifier is sufficient. Different verification may be necessary for access to records or changes affecting ownership, payments or another person’s rights.

7. Who receives personal data

We disclose only information relevant to a permitted purpose and only where the PDPA allows the disclosure. Recipient classes may include HMC, HMMY and relevant Hyundai group entities for technical support, warranty, quality, safety, administration or other notified and lawful activities.

Relevant authorised dealers and service centres may receive information for your enquiry, purchase, appointment, service, warranty, recall or other ownership support. Marketing disclosure or use must have the necessary permission and respect your choices. We do not give every dealer unrestricted access to the entire customer database.

Providers supporting HMY may receive information to supply hosting, IT, customer-care, communications, logistics, payment, research, event or other contracted services. Where they process on our behalf, we require appropriate contractual restrictions on instructions, confidentiality, security, use, onward processing, retention and assistance with customer rights.

Other recipients may include insurers, financiers and professional advisers involved in a transaction or matter; auditors; courts, regulators and competent authorities where disclosure is legally permitted; and parties to a genuine business reorganisation or transfer, subject to appropriate confidentiality, necessity and legal safeguards.

A dealer or another recipient acting independently must satisfy its own data-protection obligations and may provide its own notice. This does not remove HMY’s responsibility for the lawfulness of its disclosure or for processing carried out on its behalf. We do not authorise recipients to sell HMY-provided customer data or reuse it for unrelated marketing.

8. Transfers outside Malaysia

Relevant information may be transferred to, stored in or accessed from outside Malaysia, including South Korea for HMC support and systems. Overseas recipients may also include approved group entities, technology hosts and contracted service providers supporting the purposes described above. The actual destinations depend on the relevant service; you may ask our DPO about the destinations and safeguards applicable to your information.

Before a transfer, we establish an applicable condition under section 129 of the PDPA, such as substantially similar protection, an adequate equivalent level of protection, or another permitted statutory condition. We assess the relevant circumstances and apply appropriate safeguards, which may include recipient due diligence, contractual protection, access restrictions and transfer assessments.

Where consent is the condition relied upon, we provide the required information about the recipient classes and transfer purposes and obtain and record the required consent. Mere website use is not treated as consent to an overseas transfer. A reference to a possible transfer in this Policy is not a waiver of Malaysian legal requirements.

9. Marketing communications and how to opt out

Where permitted, HMY may send Hyundai-related marketing by email, SMS, telephone, WhatsApp or other messaging services, post or another channel you have chosen. Marketing may concern products, services, events or promotions. You may decline or withdraw marketing permission at any time, without giving a reason or affecting your statutory rights.

To opt out, email dpo@hyundaimotor.my with STOP MARKETING or any clear request to stop. Send it from the email address concerned where possible and identify any telephone number or other contact detail you want suppressed. We do not require a particular phrase. You may also use a functioning unsubscribe facility offered in a message, or reply STOP where the message expressly confirms that replies are supported.

If a privacy or marketing-preferences form is made available on our website, you may use it without creating an account or consenting to marketing. Email remains an alternative if an online facility is unavailable. Customer Care on 1300-13-2000 can assist with recording or routing a request, including where you have difficulty using a written channel.

Unless you specify a narrower choice, we treat a clear general opt-out as a request to stop HMY direct marketing across the contact channels we can reasonably match to your request. We also notify and require relevant recipients to stop marketing using HMY-supplied data within the scope of the applicable arrangement. Independently collected dealer or third-party lists may need a separate request to that organisation; we will assist in identifying the appropriate contact.

We record and implement your request without unnecessary delay, stop the relevant processing as required by law and update active marketing lists and queued communications. We may retain a restricted, minimum suppression record so that your details are not inadvertently re-added. A later data refresh or import does not automatically cancel an existing opt-out.

A response period stated in a particular refresh exercise does not limit your continuing right to opt out. Non-response is not, by itself, new consent. If you later wish to receive marketing again, we will record the appropriate new permission before restarting it.

Opting out of marketing does not cancel your warranty or access to aftersales services. We may still send communications lawfully necessary for a safety recall, active warranty claim, requested service, transaction, complaint or legal obligation. Such communications will not be used to conceal unrelated promotions.

10. Correcting information and requesting access

To correct or update your information, email dpo@hyundaimotor.my with UPDATE MY DETAILS or another clear description. Identify the record or contact detail concerned, what needs changing and the correct information. Provide only the information reasonably needed for the request. Customer Care may help you submit it.

You may also ask whether we process your personal data and request access to it in accordance with the PDPA. We may seek proportionate proof of identity or authority to prevent disclosure to, or changes by, an unauthorised person. We will explain any additional verification needed and provide a suitable channel for sensitive supporting material.

We respond within the applicable statutory periods and inform you of any permitted extension, applicable prescribed access fee or lawful reason for declining all or part of a request. No HMY charge applies to opting out of marketing or requesting a correction. Do not send passwords, one-time passcodes, full payment-card details or unnecessary identity documents.

Where a correction is accepted, we update the relevant active records and notify recipients where required by law. We may preserve a restricted historical record where necessary for audit, legal obligations or claims, while marking the corrected position. If you no longer own a vehicle or a contact detail belongs to someone else, please tell us so we can review the record.

11. Your other rights and complaints

You may withdraw consent to processing based on consent and exercise your rights under the PDPA, including requesting prevention of processing likely to cause substantial unwarranted damage or distress. We will explain any effect on a service and whether specific information must still be processed under an applicable legal requirement or permitted condition.

You may request direct transmission of your personal data to another data controller by written electronic notice, subject to the technical feasibility, data-format compatibility and other requirements of the PDPA. You may also ask us to review whether information should be deleted or its use restricted; these requests are assessed against applicable law, necessary retention and the rights of others.

12. Cookies and similar technologies

Our website may use cookies and similar technology for necessary functionality and security and, where the applicable permission is obtained, analytics, personalisation and advertising. The Cookie Policy provides further information about the relevant technologies and providers. Where a consent choice is required, optional tracking is subject to that choice.

Use any available cookie-preference controls and your browser settings to manage cookies. Blocking necessary cookies may affect particular functions. Cookie choices are separate from email or SMS marketing preferences; withdrawing one does not automatically change the other. If you cannot locate or use the relevant controls, contact our DPO for assistance.

13. Connected services, profiling and automated decisions

Where a connected service processes vehicle location, telemetry or user activity, the relevant service notice will explain the data, purposes, recipients and available controls before the activity begins. Users of shared vehicles should receive the relevant information, and account access should be reviewed when a vehicle changes hands.

Where we use identifiable data for profiling or automated decision-making, we provide appropriate information about the activity, its purposes and material implications, address applicable consent and impact-assessment requirements, and provide a route to raise concerns or request human review where appropriate. We do not treat this Policy as advance permission for an undisclosed automated activity.

14. Security and personal data breaches

We take practical technical and organisational measures appropriate to the nature of the information and the risks, including controls over authorised access, handling, transmission, storage and service-provider processing. No system can eliminate every risk. This does not limit our statutory obligations or excuse a failure to apply required safeguards.

We assess and respond to personal data breaches and notify the Commissioner and affected individuals where required, within applicable legal timeframes and through permitted channels. Alternative public notification is used only where legally permissible. If you suspect misuse, unauthorised access or a misdirected communication involving your information, contact our DPO promptly.

15. How long we retain information

We retain personal data only for as long as needed for its permitted purposes or applicable legal requirements. Relevant criteria include the relationship or transaction, warranty and recall requirements, resolution of complaints, accounting obligations, limitation periods, legal proceedings and justified security needs. Different categories may have different retention periods.

When information is no longer needed, we securely delete, destroy or effectively anonymise it, subject to lawful retention and controlled backup cycles. Information retained in backups or for legal holds is access-restricted and is not retained for continuing marketing merely because it remains technically available.

Minimum consent, request and suppression records may be retained to demonstrate compliance and honour your choices. A marketing opt-out does not require destruction of records still lawfully needed for a warranty, recall, transaction or legal claim.

16. Children and persons acting through a representative

Our general website is not directed at children. Where we knowingly process information about a person below 18 for a relevant service or event, we use appropriate notices and obtain consent from a parent, guardian or other authorised person where required. A representative making a privacy request must have appropriate authority, and we may verify it proportionately.

17. Contacting HMY

For privacy questions, access, corrections, withdrawal of consent, marketing opt-outs, portability or complaints, contact the Data Protection Officer, Hyundai Motor Malaysia Sdn. Bhd., at dpo@hyundaimotor.my. Customer Care assistance is available at 1300-13-2000. General contact information is published on our Contact Us page.

Provide a safe reply channel and sufficient information to identify your request. We may route it to authorised HMY personnel or relevant providers solely to handle it. You do not need to agree to marketing or accept new optional processing to exercise a privacy right.

18. Changes and language

We may update this Policy to reflect changes in our activities or legal requirements and will show the revised version and effective date. We give additional notice of material changes where appropriate and obtain further consent where required before new processing. An update does not retrospectively authorise earlier processing or override a recorded withdrawal.

This Policy is available in English and Bahasa Malaysia. Both versions are intended to convey the same information and choices. Please contact our DPO about any discrepancy; we will clarify and correct it without reducing your rights under the PDPA.