Tour Adviser, operating from A-25-3A Jalan 1/48a, Bandar Baru Sentul, 51000 Kuala Lumpur, Malaysia, is the data controller of your personal data under the Personal Data Protection Act 2010 (“PDPA”), as amended by the Personal Data Protection (Amendment) Act 2024.
This policy is issued pursuant to the Notice and Choice Principle (s.7 PDPA).
1. Scope
This policy applies to personal data collected through our web app, mobile site, booking engines, customer support channels, and offline bookings entered into our systems. It covers all processing in commercial transactions, which is the PDPA’s scope.
2. Personal data we collect
| Category | Examples | PDPA classification |
|---|---|---|
| Account & contact | Name, email, phone, password hash | Personal data |
| Booking & itinerary | Passenger names, booking references, itinerary, seat/meal preferences | Personal data |
| Identity & travel documents | Passport/IC number, nationality, visa details | Personal data — handle with elevated security |
| Sensitive personal data | Health or mobility needs, dietary/religious requirements (religious beliefs are sensitive personal data under s.4 PDPA) | Sensitive — explicit consent required (s.6(1)) |
| Biometric data | Face verification for check-in (if used) | Sensitive under the 2024 amendments |
| Payment | Tokenized card data, billing address; full card numbers are processed by our PCI-DSS certified payment processor and never stored by us | Financial |
| Usage & device | IP address, device ID, pages viewed, search history | Personal data |
3. Purposes and legal bases
We process personal data only for purposes for which it was collected, in accordance with the General Principle (s.6 PDPA):
- To fulfil your booking (necessary for a contract): issuing tickets, transmitting passenger data to airlines, hotels, rail/ferry operators, insurers, and ground handlers, and to border/immigration authorities where required by law.
- Legal obligations: record-keeping under the Income Tax Act 1967 (we retain booking and payment records for at least 7 years), and MOTAC licensing requirements.
- With your consent: marketing communications, non-essential analytics cookies, and all sensitive personal data. Consent is obtained through unticked, granular checkboxes and recorded (timestamp + wording version) as evidence.
- Legitimate operational needs: fraud screening, account security, and service improvement — limited to what is necessary and not excessive, per the data-minimisation element of the General Principle.
4. Your rights under the PDPA
- Right to be informed — this notice (s.7).
- Right of access — request a copy of your personal data; we acknowledge and respond as soon as practicable (ss.8–12).
- Right of correction — request inaccurate, incomplete, or misleading data be corrected (ss.14–16).
- Right to withdraw consent — at any time by written notice, without affecting the lawfulness of prior processing (s.8(2)); withdrawal may mean we can no longer fulfil your booking.
- Right to prevent processing for direct marketing — via the unsubscribe link or a written notice to us (s.43).
- Right to data portability (NEW, s.43A, in force 1 June 2025) — request your data be transmitted directly to another data controller of your choice, subject to technical feasibility and data format compatibility.
Minors: where the data subject is under 18, consent must be given by a parent or legal guardian (s.6(3) PDPA).
To exercise any right, contact our Data Protection Officer at legal@tour-adviser.com or write to A-25-3A Jalan 1/48a, Bandar Baru Sentul, 51000 Kuala Lumpur, Malaysia. We do not charge for access or correction requests.
5. Disclosure to third parties
Consistent with the Disclosure Principle (s.8 PDPA), we do not disclose your personal data for purposes other than those notified to you, except:
- Service partners — airlines, hotels, transport operators, guides, and insurers, limited to the data needed to deliver the booked service;
- Processors — cloud hosting, payment gateways, email/SMS providers, under written contracts requiring them to process data only on our instructions. Note: under the 2024 amendments, processors are directly bound by the Security Principle and face fines up to RM1,000,000 / 3 years for breach;
- Authorities — where required by law (immigration, customs, law enforcement);
- Professional advisers and regulators — where necessary.
We do not sell personal data to any third party.
6. Cross-border transfers
Booking data necessarily travels outside Malaysia (airline reservation systems, global hotel chains). Under the amended s.129 PDPA (in force 1 April 2025), we may transfer personal data to a place outside Malaysia only where that place has substantially similar data protection laws or ensures equivalent protection, or where:
- you have consented to the transfer, after being notified in writing;
- the transfer is necessary for the performance of our contract with you; or
- we have taken all reasonable steps and exercised all due diligence to ensure the data will not be processed in a manner contravening the PDPA.
We maintain records of each transfer basis as the Commissioner’s cross-border guidelines expect.
7. Data security
Under the Security Principle (s.9 PDPA) and the Personal Data Protection Standard 2015, we implement: TLS encryption in transit, AES-256 encryption at rest, segregated and encrypted storage of passport documents, role-based least-privilege access, staff confidentiality undertakings, access logging, and regular penetration testing.
8. Data breach notification
NEW under s.12B PDPA (in force 1 June 2025). If a personal data breach occurs, we will:
- Notify the Personal Data Protection Commissioner as soon as practicable — and in any event within 72 hours — where the breach causes or is likely to cause “significant harm” (physical harm, financial loss, credit damage, illegal misuse, involving sensitive personal data, enabling identity fraud, or affecting more than 1,000 data subjects), per the Commissioner’s Data Breach Notification Guideline;
- Notify affected individuals without unnecessary delay, and at the latest within 7 days of notifying the Commissioner, where significant harm is likely;
- Maintain a breach register for at least 2 years, including unreported incidents and the reasons.
Failure to notify is an offence carrying a fine up to RM250,000 and/or up to 2 years’ imprisonment.
9. Data retention
Under the Retention Principle (s.10 PDPA), personal data is kept no longer than necessary for the notified purpose, then destroyed or permanently anonymised:
| Data | Retention |
|---|---|
| Account data | Life of account |
| Booking, payment & tax records | 7 years (Income Tax Act 1967) |
| Passport copies | Duration of trip + processing window, then destroyed |
| Health/mobility data | End of the trip, then deleted |
| Marketing data | Until consent withdrawn |
| Server/security logs | 12 months |
10. Data integrity
Under the Data Integrity Principle (s.11 PDPA), we take reasonable steps to keep personal data accurate, complete, not misleading, and up to date. You may correct your data at any time in account settings or by contacting us.
12. Data Protection Officer
As required by the amended s.12A PDPA (in force 1 June 2025), we have appointed a Data Protection Officer responsible for monitoring compliance with the PDPA and our policies. The Commissioner has been notified of this appointment.
13. Changes to this policy
Material changes will be notified to you in-app and, where required, re-consent obtained. Version history is retained and available on request.
14. Complaints
You may lodge a complaint with:
- Data Protection Officer — legal@tour-adviser.com · A-25-3A Jalan 1/48a, Bandar Baru Sentul, 51000 Kuala Lumpur, Malaysia · www.tour-adviser.com
- Personal Data Protection Department (JPDP), Ministry of Digital — Kompleks Kementerian Digital, 62502 Putrajaya, Malaysia · https://www.pdp.gov.my
Breach of the PDPA’s protection principles is an offence punishable by a fine up to RM1,000,000 and/or up to 3 years’ imprisonment under the amended s.5(2) — your rights are enforceable by the Commissioner.