Personal Data Protection Notice

1. Purpose of This Notice

This Personal Data Protection Notice ("Notice") is issued by Xiao Qiang Holidays Sdn Bhd (Company Registration No. 201301017811), trading as XQ Attractions ("the Company"), in accordance with the Personal Data Protection Act 2010 ("PDPA").

This Notice informs you of the personal data we collect, the purposes for which we use it, your rights, and how you may contact us regarding your personal data when you book attraction tickets and island activities.

This Notice should be read together with our Privacy Policy, which provides more detailed information about our data practices.

2. Personal Data We Collect

The Company collects and processes the following categories of personal data:

• Identification data: full name, date of birth, gender, nationality, identification document numbers (passport, MyKad, or equivalent), and copies of such documents where required.
• Contact data: residential address, postal address, email address, and telephone number.
• Financial data: payment card details (processed through PCI-compliant payment gateways), billing address, and transaction history.
• Booking data: booking history, Product preferences, Visit Dates, guest names, and confirmation references.
• Visual data: CCTV footage at our premises.
• Communication data: correspondence with our customer service team, including emails, WhatsApp messages, and call records.
• Emergency contact data: name and contact details of the person you nominate.

3. Purposes of Processing

Your personal data is collected and processed for the following purposes:

• To process and manage your booking, including verifying eligibility and identity where required by a Product.
• To process payments, refunds, and Visit Date or guest-count changes.
• To coordinate ticket redemption with attraction partners and activity operators.
• To respond to your enquiries and provide customer service.
• To prevent and detect fraud, money laundering, and other unlawful activity.
• To comply with our legal and regulatory obligations under Malaysian law, including tax, accounting, and reporting requirements.
• To enforce our terms and conditions.
• To improve our services and conduct internal analytics and quality assurance.
• To send marketing communications about our services, where you have consented or where permitted by law.
• To cooperate with police, courts, and regulatory authorities as legally required.

4. Source of Personal Data

We collect personal data:

• Directly from you when you create an account, make a booking, communicate with us, or use our services.
• Automatically when you use our website (cookies, analytics, and similar technologies).
• From third parties, including payment processors, identity verification providers, fraud screening providers, and attraction partners, where lawful.

5. Mandatory and Voluntary Data

Most of the personal data we request is mandatory to enable us to provide our services. If you do not provide this data, we will not be able to:

• Verify your identity where a Product requires it.
• Process your booking or issue tickets.
• Comply with our legal obligations.

Some data is voluntary (such as marketing preferences and emergency contact details). You may decline to provide voluntary data without affecting our ability to provide ticket booking services to you.

6. Disclosure of Personal Data

We may disclose your personal data to the following classes of third parties:

• Companies within our group, subsidiaries, and affiliates.
• Attraction partners and activity operators fulfilling your booking.
• Payment processors, banks, and financial institutions.
• Identity verification and fraud screening service providers.
• IT service providers, cloud hosting providers, and software vendors supporting our operations.
• Legal advisors, accountants, auditors, and other professional consultants under confidentiality obligations.
• Government bodies, regulators, courts, and law enforcement, where required by law.
• Any party to whom we may transfer our business or assets in the event of a sale, merger, or restructuring.

7. Transfer of Personal Data Outside Malaysia

Some of the service providers we engage (including cloud hosting and payment processing providers) may be located outside Malaysia. Where personal data is transferred outside Malaysia, we ensure that:

• The recipient country provides a level of protection comparable to the PDPA, or
• Appropriate contractual safeguards are in place to protect your data, or
• You have consented to the transfer.

8. Retention of Personal Data

We retain personal data only for as long as necessary for the purposes set out in this Notice or as required by law. Retention periods are detailed in our Privacy Policy.

9. Your Rights Under the PDPA

You have the following rights in respect of your personal data:

9.1 Right of Access

You may request a copy of the personal data we hold about you. We may charge a prescribed fee for processing your request, as permitted under the PDPA.

9.2 Right of Correction

You may request correction of personal data that is inaccurate, incomplete, misleading, or out of date.

9.3 Right to Withdraw Consent

You may withdraw consent previously given for the processing of your personal data. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and may affect our ability to provide services to you.

9.4 Right to Limit Processing

You may request that we limit the processing of your personal data in certain circumstances.

9.5 Right to Prevent Direct Marketing

You may, at any time and without charge, request that we stop using your personal data for direct marketing purposes.

10. How to Exercise Your Rights

To exercise any of the rights set out above, or for any question or complaint regarding your personal data, please contact our Data Protection Officer:

Data Protection Officer Xiao Qiang Holidays Sdn Bhd 26 & 28, 1st Floor, Jalan Pandak Mayah 4, Mukim Kuah, 07000 Langkawi, Kedah, Malaysia Website: https://attractions.xqholidays.com.my

We will respond to your request within twenty-one (21) days from the date we receive a valid request, as required under the PDPA. Complex requests may require additional time, and we will notify you accordingly.

11. Complaints to the Commissioner

If you are dissatisfied with our handling of your personal data or your request, you may lodge a complaint with the Personal Data Protection Commissioner of Malaysia:

Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi) Ministry of Communications and Digital, Malaysia Website: www.pdp.gov.my

12. Consent

By submitting your personal data to the Company through any of our service channels (including the website, mobile applications, telephone, email, WhatsApp, or in person), you consent to the collection, use, and disclosure of your personal data in accordance with this Notice.

Where you provide personal data of a third party (such as a guest on your booking or an emergency contact), you confirm that you have obtained that person's consent for us to process their personal data in accordance with this Notice.

13. Updates to This Notice

We may update this Notice from time to time to reflect changes in our practices or in applicable law. The current version is identified by its effective date. Material changes will be notified through the Platform or by email.

Business review note: this draft is pending owner approval before production deploy.