Privacy Policy

Last updated: 26/08/2026

KMA Travel & Tours Sdn Bhd (Company No. 201801004103 (1266117-W)) ("we", "us", "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose and safeguard your personal data when you book with us, contact us, or use shop.kmatraveltours.com, and sets out your rights under the Personal Data Protection Act 2010 ("PDPA").

1. Personal Data We Collect

We collect only what we need to arrange and deliver your travel. Depending on how you interact with us, this may include:

• Identity and contact data — full name as per passport, date of birth, gender, nationality, passport or NRIC number and expiry, photograph, postal address, email address, telephone number.
• Booking data — travel dates and itinerary, room and seat preferences, frequent flyer numbers, names and details of others in your party, emergency contact details.
• Payment data — billing name and address, payment method and transaction records. Full card numbers are entered directly with our payment gateway and are not stored on our systems.
• Sensitive personal data — dietary requirements, medical conditions, disabilities, mobility needs or pregnancy, where you provide these so we can arrange suitable services. Under the PDPA we process this only with your explicit consent.
• Technical data — IP address, browser type, device information, pages viewed and referring site, collected through cookies and server logs.
• Marketing preferences — your consent to, or withdrawal from, our newsletters and promotions.

Where you provide personal data about other travellers, you confirm that you have their authority to do so and have brought this Privacy Policy to their attention.

2. How We Use Your Personal Data

We use your personal data to:

• process and confirm your booking, and issue tickets, vouchers and itineraries;
• transmit the details Suppliers require in order to provide your travel arrangements;
• take payment, issue receipts and process refunds;
• communicate with you about your booking, including changes, delays and emergencies;
• arrange visas, insurance or other services at your request;
• respond to your enquiries, feedback and complaints;
• meet legal, tax, licensing and immigration obligations, including advance passenger information required by airlines and border authorities;
• maintain and improve our website and services, and prevent fraud;
• send you marketing about our tours and offers, where you have consented.

3. Legal Basis

We process your personal data on the basis of: your consent; the performance of our contract with you; compliance with a legal obligation; and our legitimate interests in operating, securing and improving our business, where these are not overridden by your rights. Supplying the data marked as required is necessary to make a booking — without it, we cannot provide the service.

4. Disclosure of Your Personal Data

Travel necessarily involves sharing your details with the parties who deliver it. We may disclose your personal data to:

• Suppliers — airlines, hotels, cruise lines, transport operators, ground handlers, tour guides and attraction operators;
• Insurers and insurance intermediaries, where you purchase cover through us;
• Embassies, consulates and immigration authorities, for visa applications and advance passenger information;
• Payment processors, banks and card networks, to take payment and investigate chargebacks;
• Professional advisers — auditors, lawyers and accountants, under a duty of confidence;
• Service providers who host our website, send our email or provide IT support, acting only on our instructions;
• Government or regulatory bodies, or the courts, where required by law or to protect our legal rights.

We do not sell your personal data.

5. Transfers Outside Malaysia

Because you are travelling abroad, your personal data will be transferred to Suppliers and authorities in your destination and transit countries. Those countries may not offer a standard of data protection equivalent to Malaysian law. By making a booking you consent to this transfer, which is necessary for the performance of our contract with you. Where practicable we require overseas recipients to protect your data to a standard consistent with the PDPA.

6. Retention

We keep your personal data only as long as necessary for the purposes above, then delete or anonymise it. In practice, booking and financial records are retained for seven (7) years to satisfy Malaysian tax, accounting and licensing requirements. Marketing data is retained until you withdraw consent.

7. Security

We apply appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, including encrypted transmission of payment data, access controls limiting staff access to those who need it, and secured systems. No transmission over the internet can be guaranteed completely secure, and any transmission is at your own risk. If a breach occurs that is likely to result in significant harm, we will notify affected individuals and the relevant authority without undue delay.

8. Cookies

Our website uses cookies and similar technologies to keep you signed in, remember your cart and language, and understand how the site is used. Strictly necessary cookies are required for the site to function. You can block or delete cookies through your browser settings, but parts of the site — including booking and login — may then stop working correctly.

9. Your Rights Under the PDPA

Subject to the exceptions in the Act, you have the right to:

• Access the personal data we hold about you and request a copy;
• Correct data that is inaccurate, incomplete, misleading or out of date;
• Withdraw consent to our processing at any time, including consent to sensitive personal data;
• Limit processing for purposes you specify;
• Object to direct marketing at any time, without giving a reason.

To exercise any of these rights, write to us using the details in section 12. We may ask you to verify your identity, and we will respond within the period prescribed by the PDPA. A reasonable fee may apply to a data access request, as permitted by the Act.

Please note that withdrawing consent or asking us to delete data may prevent us from continuing to service a live booking, and cancellation charges under our Return, Refund & Cancellation Policy may then apply.

10. Marketing

We will only send you marketing where you have opted in. Every marketing email contains an unsubscribe link, and you may also opt out at any time by emailing enquiry@kmatraveltours.com. Opting out of marketing does not stop service messages about a booking you have already made.

11. Children

Our services are not directed at children, and we do not knowingly collect data from anyone under 18 except as part of a family booking made by a parent or guardian. If you believe we hold a child's data without proper consent, contact us and we will delete it.

12. Contact and Complaints

For any question about this Policy, or to exercise your rights:

KMA Travel & Tours Sdn Bhd — Data Protection Officer
A1-18-12, Arcoris Business Suite, 10, Jalan Kiara, 50480 Mont Kiara, Kuala Lumpur, Malaysia
Telephone: 60364612324
Email: enquiry@kmatraveltours.com

If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commissioner, Malaysia (Jabatan Perlindungan Data Peribadi).

13. Changes to This Policy

We may update this Policy from time to time. The current version is always published on this page with the date it took effect. Material changes affecting how we use your data will be notified to you directly where practicable.