1. Introduction

Welcome to MJ Adventure Travel Sdn. Bhd. We are committed to protecting your privacy and handling your personal information responsibly. This Privacy Policy explains how we may collect, use, disclose, and safeguard your information when you visit our website and use our services related to car rentals, travel bookings, customer support, and related online services. It also explains how certain features may involve third-party service providers, including where applicable for payments, analytics, security verification, maps, hosting, performance monitoring, and sign-in options.

2. Information We Collect

We may collect information you provide directly to us, information generated through your use of our website and booking flows, and technical or operational information collected automatically or through integrated service providers.

2.1 Personal Information

When you use our website, we may collect personal information that you voluntarily provide, including but not limited to:

• Contact Information : Name, email address, phone number, mobile number, and address details such as street, city, postcode, country, and state.
• Booking Information : Details about car rental and travel bookings, including pickup and dropoff dates, selected locations, selected vehicle, extras, insurance selections, pricing-related selections, and optional flight details where applicable.
• Account Information : User credentials and profile details, including login information if you create an account. If social login is available and you choose to use it, we may also receive limited profile information from the relevant provider, such as your name, email address, and profile image, depending on the permissions you grant.
• Identity Verification Information : Driver's licence or passport details, including document type, document number, issue date, and expiry date, where required to verify eligibility for rental, support insurance processes, prevent fraud, or meet legal and operational requirements. Identity document data is transmitted over encrypted connections (TLS) and stored on EU-based infrastructure. Document fields are redacted from application logs and diagnostic traces.
• Payment and Transaction Information : Booking references, contract identifiers, payment transaction references, and limited contact details shared with the payment provider. Payment card details are handled directly by the relevant third-party payment processor and are not stored in full on the website itself.
• Messages and Support Requests : Information you provide when contacting us, requesting support, or submitting an enquiry, including message content and related contact details.

2.2 Technical and Usage Information

We also collect technical and usage information automatically when you visit our website. Some of this information, such as IP addresses, may be considered personal data under applicable data-protection laws. Such information includes:

• Usage Data : Information about your interactions with our website, including IP address, browser type, device information, referral information, pages viewed, booking-flow interactions, request timing, and security-related request metadata. IP addresses are processed in pseudonymised (hashed) form for rate limiting and abuse prevention and are not stored in their original form in rate-limiting systems; hashed rate-limit entries are retained for a maximum of 15 minutes before automatic deletion. This processing is carried out under a legitimate-interest basis (GDPR Article 6(1)(f)). IP addresses may also be shared with Google reCAPTCHA (https://policies.google.com/privacy) as part of bot-protection verification on login, signup, and password-reset forms; Google processes this data under Standard Contractual Clauses (SCCs).
• Cookies and Tracking Technologies : We use cookies and similar technologies to support site functionality, remember consent choices, maintain sessions, help prevent fraud and abuse, measure site usage, understand campaign attribution, and improve website performance and user experience.
• Browser Session Storage : We use browser sessionStorage to temporarily preserve booking context, selected vehicles, rental location data, short-lived rental availability cache entries, and technical safeguards such as duplicate-submission prevention.
• Performance and Diagnostic Data : We collect technical performance and diagnostic data through server-side observability tools (including OpenTelemetry via our hosting provider) and client-side analytics subject to your consent preferences. Server-side observability captures request-level operational metrics such as response timing, error rates, and route information to monitor reliability and investigate issues; this processing is carried out under a legitimate-interest basis (GDPR Article 6(1)(f)) and does not include user-identifying data. Client-side analytics events, such as site-usage metrics, are only sent after you have accepted analytics cookies via our consent tools.

3. How We Use Your Information

We use your information for the following purposes:

• To Provide Services : To process and manage bookings and enquiries, support vehicle rental and travel-related services, coordinate pickups or dropoffs, and provide customer support.
• To Improve Our Website : To analyze usage patterns, understand campaign and traffic sources, improve website functionality, fix errors, optimize user experience, and maintain service quality.
• To Communicate With You : To send booking confirmations, payment updates, operational notices, support responses, and, where appropriate, follow-up messages related to incomplete or abandoned bookings.
• To Comply with Legal Obligations : To comply with applicable laws, regulations, contractual obligations, law-enforcement requests, dispute handling requirements, and record-keeping obligations.
• To Verify Eligibility and Identity : To verify customer identity and, where applicable, assess eligibility for vehicle rental, insurance, fraud prevention, legal compliance, or operational review.
• To Process Payments : To create and manage payment sessions, confirm payment-related events, and reconcile booking and transaction records through our payment service providers and backend systems.
• To Prevent Fraud and Protect the Service : To apply rate limiting, spam and bot protection, consent controls, monitoring, security checks, abuse prevention, and related safeguards.

4. How We Share Your Information

We may share your information with:

• Service Providers : Third-party vendors and infrastructure providers that help us operate the website and related services, including where applicable backend and CRM systems, payment processors, hosting and observability providers, anti-bot and fraud-prevention tools, map and location services, analytics and tag-management tools, and authentication providers.
• Business Partners : Operational partners and service providers involved in delivering bookings, payments, support, or related customer services, including where applicable Odoo (hosted on OVHcloud infrastructure within the EU under a GDPR-compliant Data Processing Agreement), Stripe, Google reCAPTCHA (which receives your IP address for bot-protection scoring; data transfers are governed by Standard Contractual Clauses), Google Tag Manager, Google Analytics where configured and consented to, Vercel (which receives server-side performance and observability data under its Data Processing Addendum; transfers outside the EEA are covered by Standard Contractual Clauses), Google Maps, and social login providers if enabled. Where applicable, Data Processing Agreements or equivalent contractual safeguards are in place with service providers that process personal data on our behalf.
• Legal Authorities : When required by law or legal process, or when we reasonably believe disclosure is necessary to protect our rights, property, customers, staff, website, or the public, including in connection with fraud prevention, disputes, or regulatory matters.

5. Data Security

We implement reasonable technical and organizational measures designed to protect your personal information from unauthorized access, disclosure, alteration, misuse, or destruction. Depending on the system and context, these measures may include secure session handling, security headers, access controls, same-origin and CSRF protections, rate limiting, bot-detection controls such as reCAPTCHA, and other safeguards appropriate to the service. However, no online transmission, website, or storage environment is completely secure, so we cannot guarantee absolute security.

6. Your Rights and Choices

You have the following rights regarding your personal information:

• Access and Correction : Under GDPR Article 15, you may submit a Data Subject Access Request (DSAR) to obtain a copy of the personal information we hold about you, including identity document details stored in our booking systems. You may also ask us to correct or update inaccurate or incomplete information, subject to applicable verification and legal requirements. To exercise these rights, please contact us using the details in Section 10.
• Opt-Out : You may opt out of receiving promotional communications by following the unsubscribe instructions provided in those communications where available. You may also manage certain analytics or cookie preferences through our consent tools and browser settings, although disabling some technologies may affect website functionality.
• Deletion : You may request deletion, deactivation, or restriction of certain personal information, subject to legal, operational, contractual, tax, insurance, fraud-prevention, and record-keeping requirements. Where deletion cannot be completed immediately or in full, we may retain information as reasonably necessary for those purposes.

7. Cookies and Tracking Technologies

We use cookies, browser storage, and similar technologies to operate the website, remember consent choices, maintain user or guest sessions, support account authentication, preserve booking progress, measure site usage, understand campaign attribution, improve performance, and help protect the service from abuse. Essential cookies (analytics consent preference with a 1-year duration, visitor token, authentication session) are set regardless of consent as they are strictly necessary for site operation. Non-essential cookies are set only after you accept analytics cookies via our consent banner: these include first-touch UTM attribution cookies (utm_ft_source, utm_ft_medium, utm_ft_campaign, utm_ft_term, utm_ft_content) with a 90-day duration, used to understand which marketing campaigns referred you. UTM parameters from your landing page may be temporarily preserved in browser sessionStorage until a consent decision is made, after which they are stored as cookies if consent is granted or discarded if consent is declined. Google Tag Manager and analytics-related technologies are also gated behind your consent choice and operate in denied mode by default until you accept. Server-side operational monitoring (OpenTelemetry) collects technical request metrics for reliability and debugging purposes and operates under a legitimate-interest basis (GDPR Article 6(1)(f)) for service operation; no user-identifying data is included in telemetry. Temporary sessionStorage entries are used for booking continuity, short-lived caching, and attribution preservation, and are cleared when the browser tab closes. You can control cookie settings through your browser and through our consent tools, but disabling essential cookies may affect website functionality.

8. Third-Party Links

Our website may contain links to third-party websites, services, or hosted pages, including for example payment pages, map or location tools, social login pages, and other external services. Those third parties operate under their own terms and privacy practices, and we are not responsible for the privacy, security, or content practices of external sites that we do not control. We encourage you to review the privacy notices of any third-party site or service you use.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, vendors, legal requirements, or business operations. Any changes will be posted on this page with an updated effective date. Your continued use of our website after changes are made constitutes your acceptance of the revised policy to the extent permitted by applicable law.

10. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at: help@mjadventuretravel.com | +60 11-3151 9796 | No. 4, Jalan 6/108D, Taman Sungai Besi, 57100 Kuala Lumpur, Malaysia.