Privacy Notice

This notice explains what Small Hero Holidays Sdn Bhd (886399-H) does with your personal data, as required by the Personal Data Protection Act 2010. WHAT WE COLLECT When you sign in, we hold your mobile number. That number is your identity here: it is what connects the bookings our counter staff key in to the account you see in the app. If you give them, we also hold your name, email address, date of birth and passport details. Passport numbers are stored encrypted. When our staff record a booking we hold the tour, the dates, the amount paid and the points it earned. We record when you send an enquiry to WhatsApp from the app, so we know which tours people are asking about. That record holds the tour and the time, not the conversation. If you allow notifications, we hold a token from Apple or Google identifying your device. It does not identify you personally and we delete it when you sign out. Browsing the app needs no account, and we do not track you across other apps or websites. WHY WE HOLD IT To take and service your bookings. To run the loyalty programme — points cannot be calculated without knowing what you spent and when. To reach you about a trip you have booked. To meet the record-keeping obligations of a licensed tour operator. We send marketing only if you have agreed to it. You can withdraw that at any time in the app, and doing so does not affect messages about a booking you have already made. WHO WE SHARE IT WITH Airlines, hotels, ground operators and insurers, where it is needed to provide the tour you booked. Some are outside Malaysia, because that is where you are travelling. Government authorities where the law requires it, including immigration. Our technology suppliers, who host the system and deliver notifications, under contracts that limit them to acting on our instructions. We do not sell your data. HOW LONG WE KEEP IT For as long as you hold an account, and after that for [RETENTION] to meet tax and licensing obligations. Then we delete it or make it anonymous. YOUR RIGHTS You may ask what we hold about you, ask us to correct it, ask us to stop using it for marketing, or ask us to delete your account. Write to [DPO EMAIL] or ask at our office. We will respond within twenty-one days. Deleting your account removes your personal details. Points and unused vouchers are forfeited at that point and cannot be restored. SECURITY Access to member records is limited to staff who need it. The connection between the app and our system is encrypted. Passport numbers are encrypted at rest. CHILDREN The app is not intended for under-eighteens. Where a child travels, we hold their details through the adult who books. CHANGES We will publish any change here and, where it matters, tell you in the app. CONTACT Small Hero Holidays Sdn Bhd (886399-H), MOTAC licence KPL 6698 57-2, Olive Hill Business Park, Jalan BS 1/1, Taman Bukit Serdang, 43300 Seri Kembangan, Selangor Telephone 03-8959 1088 · [DPO EMAIL]