Trim Privacy Notice for Barbers

What we collect

Your name, phone number and email address.

Your IC or passport number and a photograph of it, which we need to confirm who you are and to register you with PERKESO.

Your IC type, gender, race, nationality, home address, and next of kin — PERKESO needs these to put you on the Self-Employment Social Security Scheme.

The zones you work, the hours you make yourself available, and your work history through Trim.

Your bank details, so we can pay you.

Your PERKESO registration data and your contribution records.

Your ratings, your Standing, coaching notes, grievances, human review requests, and any inquiry, incident or panic report involving you.

Photographs you upload after a visit, and messages you send in the app about a job.

Your location while you are on an assigned job, including the GPS point when you check in and when you check out.

We collect only what the service and the law need, and we do not buy personal data about you from anyone else.

Why we collect it

To offer you jobs and route you to the right home. To pay you, and to file the PERKESO contributions the Gig Workers Act 2025 requires. To keep you safe: check-in and check-out, panic alerts, and responding to incidents. To meet our occupational safety duties, including notifying an authority where the law requires it. To run ratings, grievances, human reviews and inquiries fairly, and to keep a written record of each one. To prevent fraud and to meet our legal and tax obligations.

Where we rely on your consent you can withdraw it. Most of the above we have to collect in order to pay you and to meet the law, and we will tell you if withdrawing means you can no longer take jobs through Trim.

Your location while you are on a job

We collect your live location only while you are on an assigned job, so we can tell the customer you are on the way and so we can respond if you raise a panic alert.

When you check in and when you finish a job we also record the GPS point at those two moments. PERKESO requires the start and end of each job when Trim files your contribution.

We do not track you between jobs, when you are off shift, or when the app is closed. When the job ends your live location is dropped, unless it forms part of an incident or panic record, or is the check-in or check-out point kept with that job's contribution record.

Your location is never used to score you, and pausing your availability is never held against you.

Customer addresses you are given

A customer's home address is the most sensitive thing Trim holds, so what you are given is deliberately narrow.

You see a customer's address only for a job assigned to you, and only for as long as that job needs it. Access ends when the job is completed, except where the address forms part of a dispute or incident record.

Under your service agreement you must not keep, share or reuse a customer's address, or contact them afterwards about anything other than that job. That obligation continues after your agreement with Trim ends.

Messages in the app

When you send a message in the app about a job, including through Support, we store it so the job can run and so we can look into a grievance, a complaint, or a safety issue.

Ops staff with a need-to-know role can read a conversation when they are investigating something. The customer sees the conversation for that job. We do not read messages as a matter of routine.

We keep those messages for 2 years after the visit, then delete them, unless they form part of a dispute or incident record, in which case we keep them for 7 years.

Who else we share it with

We do not sell your personal data and we do not share it for advertising.

We use a small number of service providers who process data on our behalf and only on our instructions: Supabase, for our database and file storage. Stripe, for your payouts. Expo, for sending push notifications to your phone. A maps provider, so we can route you to the right home.

Customers are shown only enough to recognise you at the door and to rate the visit. They never see your IC or passport details, your bank details, your home base or your contribution records.

We also share data where the law requires it: PERKESO for your registration and contributions, LHDN for tax and e-invoicing, and DOSH or another authority where an occupational accident or disease has to be notified. We will share data with the police or a court where we are legally obliged to, or where someone's safety is at immediate risk.

Where your data is stored

Some of the service providers above store or process data on servers outside Malaysia.

Where that happens we only use providers that give your data protection comparable to what the PDPA requires, we put contractual protections in place with each of them, and we remain responsible for your data. We do not move your data to another country simply because it is cheaper or more convenient.

How long we keep it

Your name, phone and email: while your account is active, then 12 months after it is closed.

Your IC or passport details, your bank payout details, your agreement and privacy acceptances, your earnings and payout ledger, and your PERKESO registration data: 7 years after your last payout or after the relationship ends. These are kept longer because tax law, PERKESO and proof of consent require it.

Your ratings and visit notes: 2 years after the visit.

Photographs you upload after a visit, and messages about a job: 2 years after the visit, or 7 years if they form part of a dispute or incident record.

Panic alerts and incident or occupational safety reports: 7 years, or longer where DOSH or another authority requires it.

Inquiry, grievance and human review records, including the notice, your reply and the decision: 7 years, so both you and Trim keep the written record.

Your live location during an assigned job: only during the job, then dropped, unless kept as part of an incident or panic record.

When a retention period ends we delete the data, or anonymise it so it can no longer identify you.

How we protect it

Access is role-based, so staff only see what their role needs. Data is encrypted in transit and at rest by our hosting providers. Your bank details are used for payouts and are not shown to customers or to other barbers. Access to production data is logged, and changes to compliance records are written to an audit trail.

If something goes wrong

If a security breach happens that affects your personal data, we will investigate and contain it immediately.

We will notify the Personal Data Protection Commissioner without undue delay, and in any event within 72 hours of becoming aware of the breach.

We will tell you directly, within 7 days, where the breach is likely to cause you significant harm. We will explain what happened, what data was involved, what we have done about it, and what you should do.

Your rights

You can ask us to: give you a copy of the personal data we hold about you; correct anything that is wrong or out of date; delete your data, where we are not required to keep it for a reason in the retention section; stop using your data for a particular purpose, or withdraw a consent you gave us; explain a decision you think was made unfairly, including a rating, a Standing decision, or how jobs were offered to you over a date range.

We will respond within 21 days. If we cannot do what you asked, we will tell you why.

Asking for any of this is never held against you.

You can also complain to the Personal Data Protection Commissioner if you are not satisfied with how we handled your request.

Marketing messages

Job offers, payout notices, and safety or account messages are part of working through Trim. They are not marketing.

If we ever send you promotional messages that are not about a job or your pay, you can ask us to stop by emailing privacy@trim.my. That is your right under section 43 of the PDPA. Asking does not affect your jobs or your pay.

Our Data Protection Officer

Denise Khaandor is Trim's Data Protection Officer. She is accountable for how Trim handles personal data, and is your point of contact for anything in this notice, including access requests, corrections, complaints and breaches.

The fastest way to reach her is the Support section of the app, which creates a written record of your request. You can also email privacy@trim.my.

Changes to this notice

If we change this notice we will publish a new version and ask you to read it in the app. Every version is stored with its number and date, and we keep a record of which version you agreed to and when, so we can always show you exactly what you were told.

How we ask for consent

You are shown this notice and asked to acknowledge it before you can submit your application. Your acknowledgement is recorded with the notice version and a timestamp.

Your service agreement is a separate document from this notice. The customer terms of service and the customer privacy notice are separate again. None of these documents are merged.