Privacy

1. Introduction

Welcome to MJ Adventure Travel Sdn. Bhd. We are committed to protecting your privacy and handling your personal information responsibly. This Privacy Policy explains how we may collect, use, disclose, and safeguard your information when you visit our website and use our services related to car rentals, travel bookings, customer support, and related online services. It also explains how certain features may involve third-party service providers, including where applicable for payments, analytics, security verification, maps, hosting, performance monitoring, and sign-in options. This policy is intended to comply with applicable data protection laws, including Malaysia's Personal Data Protection Act 2010 (PDPA) for customers based in Malaysia, and the General Data Protection Regulation (GDPR) where applicable to customers in the European Economic Area.

2. Information We Collect

We may collect information you provide directly to us, information generated through your use of our website and booking flows, and technical or operational information collected automatically or through integrated service providers.

2.1 Personal Information

When you use our website, we may collect personal information that you voluntarily provide, including but not limited to:

• Contact Information : Name, email address, phone number, mobile number, and address details such as street, city, postcode, country, and state.
• Booking Information : Details about car rental and travel bookings, including pickup and dropoff dates, selected locations, selected vehicle, extras, insurance selections, pricing-related selections, and optional flight details where applicable.
• Account Information : User credentials and profile details, including login information if you create an account. If social login is available and you choose to use it, we may also receive limited profile information from the relevant provider, such as your name, email address, and profile image, depending on the permissions you grant.
• Identity Verification Information : Driver's licence or passport details, including document type, document number, issue date, and expiry date, where required to verify eligibility for rental, support insurance processes, prevent fraud, or meet legal and operational requirements. Identity document data is transmitted over encrypted connections (TLS) and stored on EU-based infrastructure. Document fields are redacted from application logs and diagnostic traces.
• Payment and Transaction Information : Booking references, contract identifiers, payment transaction references, and limited contact details shared with the payment provider. Payment card details are handled directly by the relevant third-party payment processor and are not stored in full on the website itself.
• Messages and Support Requests : Information you provide when contacting us, requesting support, or submitting an enquiry, including message content and related contact details.

2.2 Technical and Usage Information

We also collect technical and usage information automatically when you visit our website. Some of this information, such as IP addresses, may be considered personal data under applicable data-protection laws. Such information includes:

• Usage Data : Information about your interactions with our website, including IP address, browser type, device information, referral information, pages viewed, booking-flow interactions, request timing, and security-related request metadata. IP addresses are processed in pseudonymised (hashed) form for rate limiting and abuse prevention and are not stored in their original form in rate-limiting systems; hashed rate-limit entries are retained for a maximum of 15 minutes before automatic deletion. This processing is carried out under a legitimate-interest basis (GDPR Article 6(1)(f)). IP addresses may also be shared with Google reCAPTCHA (https://policies.google.com/privacy) as part of bot-protection verification on login, signup, and password-reset forms; Google processes this data under Standard Contractual Clauses (SCCs).
• Cookies and Tracking Technologies : We use cookies and similar technologies to support site functionality, remember consent choices, maintain sessions, help prevent fraud and abuse, measure site usage, understand campaign attribution, and improve website performance and user experience.
• Browser Session Storage : We use browser sessionStorage to temporarily preserve booking context, selected vehicles, rental location data, and short-lived technical state used to keep the booking flow reliable. These entries are cleared when the browser tab closes.
• Performance and Diagnostic Data : We collect technical performance and diagnostic data through server-side observability tools provided by our hosting provider and through client-side analytics subject to your consent preferences. Server-side observability captures request-level operational metrics such as response timing, error rates, and route information to monitor reliability and investigate issues; this processing is carried out under a legitimate-interest basis (GDPR Article 6(1)(f)) and does not include user-identifying data. Client-side analytics events, such as site-usage metrics, are only sent after you have accepted analytics cookies via our consent tools.

3. How We Use Your Information

We use your information for the following purposes:

• To Provide Services : To process and manage bookings and enquiries, support vehicle rental and travel-related services, coordinate pickups or dropoffs, and provide customer support.
• To Improve Our Website : To analyze usage patterns, understand campaign and traffic sources, improve website functionality, fix errors, optimize user experience, and maintain service quality.
• To Communicate With You : To send booking confirmations, payment updates, operational notices, support responses, and, where appropriate, follow-up messages related to incomplete or abandoned bookings.
• To Comply with Legal Obligations : To comply with applicable laws, regulations, contractual obligations, law-enforcement requests, dispute handling requirements, and record-keeping obligations.
• To Verify Eligibility and Identity : To verify customer identity and, where applicable, assess eligibility for vehicle rental, insurance, fraud prevention, legal compliance, or operational review.
• To Process Payments : To create and manage payment sessions, confirm payment-related events, and reconcile booking and transaction records through our payment service providers and backend systems.
• To Prevent Fraud and Protect the Service : To apply rate limiting, spam and bot protection, consent controls, monitoring, security checks, abuse prevention, and related safeguards.

4. How We Share Your Information

We may share your information with:

• Service Providers : Third-party vendors and infrastructure providers that help us operate the website and related services, including where applicable backend and CRM systems, payment processors, hosting and observability providers, anti-bot and fraud-prevention tools, map and location services, analytics and tag-management tools, and authentication providers.
• Business Partners : Operational partners and service providers involved in delivering bookings, payments, support, or related customer services, including where applicable our booking and CRM backend platform (hosted on EU-based infrastructure under a GDPR-compliant Data Processing Agreement), Stripe, Google reCAPTCHA (which receives your IP address for bot-protection scoring; data transfers are governed by Standard Contractual Clauses), Google Tag Manager, Google Analytics where configured and consented to, our website hosting and observability provider (which receives server-side performance and observability data under a Data Processing Addendum, with transfers outside the EEA covered by Standard Contractual Clauses), Google Maps, and social login providers if enabled. Where applicable, Data Processing Agreements or equivalent contractual safeguards are in place with service providers that process personal data on our behalf.
• Legal Authorities : When required by law or legal process, or when we reasonably believe disclosure is necessary to protect our rights, property, customers, staff, website, or the public, including in connection with fraud prevention, disputes, or regulatory matters.

5. Data Security

We implement reasonable technical and organizational measures designed to protect your personal information from unauthorized access, disclosure, alteration, misuse, or destruction. Depending on the system and context, these measures may include secure session handling, security headers, access controls, same-origin and CSRF protections, rate limiting, bot-detection controls such as reCAPTCHA, and other safeguards appropriate to the service. However, no online transmission, website, or storage environment is completely secure, so we cannot guarantee absolute security.

6. Your Rights and Choices

You have the following rights regarding your personal information:

• Access and Correction : Under GDPR Article 15 and Malaysia's Personal Data Protection Act 2010 (PDPA) section 34, you may submit a Data Subject Access Request (DSAR) to obtain a copy of the personal information we hold about you, including identity document details stored in our booking systems. You may also ask us to correct or update inaccurate or incomplete information under PDPA section 34(1)(b) or GDPR Article 16, subject to applicable verification and legal requirements. To exercise these rights, please contact us via our Contact page.
• Opt-Out and Withdrawal of Consent : You may opt out of receiving promotional communications by following the unsubscribe instructions provided in those communications where available. Under Malaysia's PDPA 2010 section 38, you may also withdraw consent to the processing of your personal data at any time; however, withdrawal of consent may affect our ability to provide certain services. You may manage analytics or cookie preferences through our consent tools and browser settings, although disabling some technologies may affect website functionality.
• Deletion : You may request deletion, deactivation, or restriction of certain personal information, subject to legal, operational, contractual, tax, insurance, fraud-prevention, and record-keeping requirements. Where deletion cannot be completed immediately or in full, we may retain information as reasonably necessary for those purposes.

7. Cookies and Tracking Technologies

We use cookies, browser storage, and similar technologies to operate the website, remember consent choices, maintain user or guest sessions, support account authentication, preserve booking progress, measure site usage, understand campaign attribution, improve performance, and help protect the service from abuse.

• Essential Cookies : These cookies are strictly necessary for site operation and are set regardless of consent. They include an analytics consent preference (1-year duration) so we remember your choice, a visitor token used to maintain guest and account sessions, and an authentication session cookie used after sign-in.
• Analytics and Marketing Cookies : These are set only after you accept analytics cookies via our consent banner. They include first-touch UTM attribution cookies with a 90-day duration, used to understand which marketing campaigns referred you. Google Tag Manager and analytics-related technologies are gated behind your consent choice and are blocked by default until you accept. Detailed cookie names and durations are available in our consent preferences tool.
• Browser Session Storage : UTM parameters from your landing page may be temporarily preserved in browser sessionStorage until a consent decision is made, after which they are stored as cookies if consent is granted or discarded if consent is declined. Other temporary sessionStorage entries are used for booking continuity and short-lived technical state. All sessionStorage entries are cleared when the browser tab closes.
• Server-Side Operational Monitoring : We collect technical request metrics for reliability and debugging purposes. This processing operates under a legitimate-interest basis (GDPR Article 6(1)(f)) for service operation, and no user-identifying data is included in this monitoring.
• Managing Your Preferences : You can control cookie settings through your browser and through our on-site consent tool. Disabling essential cookies may affect website functionality, including sign-in and booking continuity.

8. Third-Party Links

Our website may contain links to third-party websites, services, or hosted pages, including for example payment pages, map or location tools, social login pages, and other external services. Those third parties operate under their own terms and privacy practices, and we are not responsible for the privacy, security, or content practices of external sites that we do not control. We encourage you to review the privacy notices of any third-party site or service you use.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, vendors, legal requirements, or business operations. Any changes will be posted on this page with an updated effective date. Your continued use of our website after changes are made constitutes your acceptance of the revised policy to the extent permitted by applicable law.