Privacy Policy

01

Who we are

“Hari-Hari”, “we”, “us” and “our” refer to HARI-HARI TRAVEL & HOLIDAYS SDN. BHD. (Registration No. 1580938-A), a Malaysia-licensed travel company operating under MOTAC Licence No. 12654.

For the personal data described in this policy, Hari-Hari is generally the data controller. Where we process information on behalf of an overseas travel agency, corporate client, school or group organiser, that organisation may also determine how the information is used.

02

Personal data we may collect

The information we collect depends on how you interact with us and may include:

• Contact details: name, email address, telephone number, organisation and country.
• Enquiry details: preferred destination, travel month, trip length, group size, trip style, budget, interests and other requirements you choose to provide.
• Booking and traveller details: passport or identity information, nationality, date of birth, flight details, accommodation information, emergency contact and other information needed to deliver a confirmed trip.
• Special-category information: dietary, allergy, health, mobility, accessibility or religious requirements when you voluntarily provide them and they are necessary for your arrangements.
• Business and payment information: billing details, transaction records, company information and correspondence relating to quotations or bookings.
• Technical information: IP address, browser or device type, referring page, access time, security logs and cookie information generated when the website is used.
• Communications: messages and records from email, telephone, WhatsApp, WeChat, social media or meetings.

Please do not send passport, payment, health or other sensitive information through the public enquiry form unless we specifically request it through an appropriate channel.

03

How we collect personal data

We may collect personal data:

• directly from you through this website, email, calls, messaging services, forms, meetings and booking documents;
• from a travel agency, employer, school, family member, group leader or other person arranging travel for you;
• from travel suppliers and service partners involved in your requested or confirmed itinerary; and
• automatically through website hosting, security logs and limited cookies or similar technologies.

If you provide personal data about another person, please ensure you are authorised to do so and that the person has been informed about the relevant arrangements.

04

How we use personal data

We may process personal data to:

• respond to enquiries and prepare proposals, quotations and itineraries;
• make and manage transport, accommodation, guide, attraction, meal, event and activity arrangements;
• communicate service updates and provide customer support;
• manage safety, emergencies, accessibility and special travel requirements;
• administer contracts, invoices, payments, accounts and business records;
• operate, secure, maintain and improve our website and services;
• prevent fraud, misuse, security incidents or unlawful activity; and
• comply with legal, regulatory, insurance, tax and law-enforcement requirements.

We process personal data with consent where required and otherwise as permitted or required by applicable law. If required information is not provided, we may be unable to answer an enquiry or deliver part of a requested travel service.

05

Sharing and disclosure

We do not sell or rent personal data. When necessary, we may disclose it to:

• hotels, transport operators, airlines, guides, attractions, restaurants, venues, event partners and other suppliers needed for your itinerary;
• the travel agency, company, school, group organiser or other party responsible for the booking;
• website, form-delivery, hosting, cloud, email, communications, payment, accounting and IT-security providers acting for us;
• professional advisers, insurers and auditors; and
• government authorities, regulators, courts or law-enforcement bodies where disclosure is required or permitted by law.

We seek to provide only the information reasonably necessary for the relevant purpose. Suppliers and third-party platforms may process data under their own privacy terms.

06

Processing outside Malaysia

Some travel suppliers, technology providers or communication platforms may be located outside Malaysia or may process information in other countries. This can occur when arranging international travel, serving an overseas client or using global cloud and messaging services. Where applicable, we take reasonable steps to ensure such transfers are made in accordance with Malaysian personal-data-protection requirements.

07

Cookies and third-party services

Our hosting and security services may generate essential technical logs needed to serve and protect the website. Certain translated blog pages use Google Translate, which may set a language-preference cookie. You can block or delete cookies through your browser, although translated or other website features may then work differently.

Website enquiry forms are transmitted using FormSubmit and delivered to our company email. Links to WhatsApp, WeChat, Facebook, Instagram and other external websites take you to services governed by those providers’ own privacy policies. Hari-Hari does not control their websites.

08

Retention and security

We retain personal data only for as long as reasonably necessary for the purposes described here, including service delivery, customer support, legal obligations, dispute resolution and legitimate business records. Retention periods vary according to the type of information and the applicable legal or operational requirement. When information is no longer required, we take reasonable steps to delete, destroy or anonymise it.

We use reasonable administrative, technical and organisational safeguards designed to protect personal data against loss, misuse, unauthorised access, alteration or disclosure. No internet transmission or storage system can be guaranteed completely secure.

09

Your choices and rights

Subject to the Personal Data Protection Act 2010 and other applicable law, you may request to:

• access personal data we hold about you;
• correct personal data that is inaccurate, incomplete or outdated;
• withdraw consent where processing depends on consent;
• prevent processing for direct-marketing purposes;
• request data portability where that right applies; or
• raise a question or complaint about our handling of personal data.

We may need to verify your identity before completing a request. Legal exceptions may apply, and withdrawing consent may affect our ability to provide requested services. You may also contact the Personal Data Protection Commissioner of Malaysia.

10

Children and student travel

Our services may include educational and family travel involving children. Where information about a child is needed, we expect it to be provided or authorised by a parent, legal guardian, school or responsible organiser, as appropriate. We do not knowingly invite children to submit personal data directly through the public website without suitable adult involvement.

11

Updates to this policy

We may update this policy when our services, technology or legal obligations change. The latest version will be published on this page with its effective date. Material changes may also be communicated through an appropriate channel where required.