Privacy Policy

1. About This Policy

This Privacy Policy explains how Xiao Qiang Holidays Sdn Bhd (Company Registration No. 201301017811), trading as XQ Attractions ("the Company", "we", "us", or "our"), collects, uses, discloses, and protects your personal data when you use our website, mobile applications, and services for attraction tickets and island activities.

This Policy is to be read together with our PDPA Notice, which sets out your statutory rights under the Personal Data Protection Act 2010 ("PDPA").

2. Information We Collect

We collect personal data that you provide directly, data generated through your use of our services, and data obtained from third parties where lawful.

2.1 Information You Provide

• Full name, gender, date of birth, and nationality.
• Identification documents (passport, MyKad, or other government-issued ID) where required for a Product.
• Contact information (email address, telephone number, postal address).
• Payment information (card details processed through PCI-compliant payment gateways; we do not store full card numbers).
• Guest names, Visit Dates, and Product preferences for your booking.
• Booking history and customer service correspondence.
• Emergency contact information where provided.

2.2 Information Generated Through Service Use

• Website analytics, cookies, IP address, browser type, and device identifiers.
• CCTV footage at our office and customer service locations.
• Support chat and call metadata when you contact us.

2.3 Information from Third Parties

• Fraud screening and identity verification providers.
• Credit card issuers and payment processors.
• Attraction partners and operators fulfilling your Product, where needed to redeem tickets.
• Authorities, where legally required.

3. How We Use Your Information

We use your personal data for the following purposes:

• Processing bookings, payments, refunds, and Visit Date changes.
• Verifying identity and Product eligibility, and detecting fraud.
• Issuing confirmations and coordinating redemption with attraction partners.
• Customer service and communication about your booking.
• Compliance with Malaysian law, including reporting to authorities where required.
• Service improvement, internal analytics, and quality assurance.
• Marketing communications, where you have consented or where permitted by law.

4. Legal Basis for Processing

We process personal data on one or more of the following legal bases under the PDPA:

• Performance of our contract with you.
• Compliance with legal obligations.
• Your consent (which you may withdraw at any time).
• Our legitimate interests in operating, securing, and improving our services.

5. Disclosure of Your Information

We may disclose your personal data to the following categories of recipients, only as necessary for the purposes stated in this Policy:

• Attraction partners and activity operators fulfilling your booking.
• Payment processors and financial institutions.
• Identity verification and fraud screening providers.
• Legal advisors, auditors, and professional consultants under confidentiality obligations.
• Government authorities, regulators, and law enforcement, where legally required.
• Courts and tribunals, in connection with legal proceedings.

We do not sell your personal data to third parties for marketing purposes.

6. International Transfer of Data

Where we transfer personal data outside Malaysia (for example, to cloud service providers or international payment processors), we ensure that the receiving party provides a level of protection comparable to that required under the PDPA, through contractual safeguards or by the data subject's consent.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, and reporting requirements.

• Booking and payment records: seven (7) years from the Visit Date or last transaction, in line with Malaysian tax and accounting requirements.
• Identification document copies: three (3) years from the last interaction, unless required longer for legal purposes.
• CCTV footage: thirty (30) days unless retained for a specific incident.
• Marketing data: until you withdraw consent or unsubscribe.

8. Data Security

We implement reasonable technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration, and destruction. These include access controls, encrypted payment processing, secure storage, and staff confidentiality obligations.

No method of transmission or storage is completely secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security.

9. Your Rights

Subject to the PDPA, you have the following rights in respect of your personal data:

• Right of access: to request a copy of the personal data we hold about you.
• Right of correction: to request correction of inaccurate or incomplete data.
• Right to withdraw consent: to withdraw consent previously given, subject to legal or contractual restrictions.
• Right to limit processing: to request that we limit certain uses of your data.
• Right to prevent direct marketing: to opt out of marketing communications at any time.

To exercise any of these rights, contact us using the details in Section 12. We may charge a reasonable fee for processing access requests as permitted under the PDPA.

10. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to:

• Enable essential website functionality.
• Remember your preferences.
• Analyse website traffic and user behaviour.
• Deliver relevant advertising, where applicable.

You may disable cookies through your browser settings, though some features of the Platform may not function properly as a result.

11. Children's Privacy

Our services are not directed at persons under the age of eighteen (18) as account holders. Guests under eighteen may appear on a booking where Product terms allow, and data is provided by a responsible adult. If you believe a minor has provided us with personal data incorrectly, please contact us so we can take appropriate action.

12. Contact and Complaints

For questions about this Privacy Policy, to exercise your rights, or to make a complaint, contact our Data Protection Officer:

Xiao Qiang Holidays Sdn Bhd Attn: Data Protection Officer 26 & 28, 1st Floor, Jalan Pandak Mayah 4, Mukim Kuah, 07000 Langkawi, Kedah, Malaysia Website: https://attractions.xqholidays.com.my

If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commissioner of Malaysia at www.pdp.gov.my.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified through the Platform or by email. The current version is identified by its effective date at the top of this document.

Business review note: this draft is pending owner approval before production deploy.