Privacy

1. Introduction

MJ Adventure Travel Sdn. Bhd. (MJAT, we, us, our) is committed to protecting your privacy and handling your personal information responsibly. This Privacy Policy explains how we may collect, use, disclose, and safeguard your information when you visit our website and use our services related to vehicle rentals, travel bookings, customer support, and related online services. It also explains how certain features may involve third-party service providers, including where applicable for payments, analytics, security verification, maps, hosting, performance monitoring, and sign-in options. This policy is intended to comply with applicable data protection laws, including Malaysia's Personal Data Protection Act 2010 (PDPA) for customers based in Malaysia, and the General Data Protection Regulation (GDPR) where applicable to customers in the European Economic Area (EEA).

2. Information We Collect

We collect information from you, directly and through third parties, in accordance with this Privacy Policy, when you contact us, interact with us in person, or online through our website, social media, or use our products or services. If you do not provide the information we request, we may not be able to provide our products or services to you.

2.1 Personal Information

When you make a reservation or rent a vehicle with us we collect the following personal information:

• **Contact Information:** Name, email address, phone number, mobile number, and address details such as street, city, postcode, country, and state.
• **Booking Information:** Details about vehicle rental and travel bookings, including pickup and dropoff dates, selected locations, selected vehicle, extras, insurance selections, pricing-related selections, and optional flight details where applicable.
• **Account Information:** User credentials and profile details, including login information if you create an account. If social login is available and you choose to use it, we may also receive limited profile information from the relevant provider, such as your name, email address, and profile image, depending on the permissions you grant.
• **Identity Verification Information:** Driver's licence or passport details, including document type, document number, issue date, and expiry date, where required to verify eligibility for rental, support insurance processes, prevent fraud, or meet legal and operational requirements. Identity document data is transmitted over encrypted connections (TLS) and stored on EU-based infrastructure. Document fields are redacted from application logs and diagnostic traces.
• **Payment and Transaction Information:** Booking references, contract identifiers, payment transaction references, and limited contact details shared with the payment provider. Payment card details are handled directly by the relevant third-party payment processor and are not stored in full on the website itself.
• **Messages and Support Requests:** Information you provide when contacting us, requesting support, or submitting an enquiry, including message content and related contact details.

2.2 Technical and Usage Information

We also collect technical and usage information automatically when you visit our website, social media platforms or interact with us using e-mail, texts, or other forms of electronic communications. Some of this information, such as IP addresses, may be considered personal data under applicable data-protection laws. Such information includes:

• Usage Data: Information about your interactions with our website, including IP address, browser type, device information, referral information, pages viewed, booking-flow interactions, request timing, and security-related request metadata. IP addresses are processed in pseudonymised (hashed) form for rate limiting and abuse prevention and are not stored in their original form in rate-limiting systems; hashed rate-limit entries are retained for a maximum of 15 minutes before automatic deletion. This processing is carried out under a legitimate-interest basis (GDPR Article 6(1)(f)). IP addresses may also be shared with Google reCAPTCHA (https://policies.google.com/privacy) as part of bot-protection verification on login, signup, and password-reset forms; Google processes this data under Standard Contractual Clauses (SCCs).
• Cookies and Tracking Technologies: We use cookies and similar technologies to support site functionality, remember consent choices, maintain sessions, help prevent fraud and abuse, measure site usage, understand campaign attribution, and improve website performance and user experience.
• Browser Session Storage:** We use browser session storage to temporarily preserve booking context, selected vehicles, rental location data, and short-lived technical state used to keep the booking flow reliable. These entries are cleared when the browser tab closes.
• **Performance and Diagnostic Data:** We collect technical performance and diagnostic data through server-side observability tools provided by our hosting provider and through client-side analytics subject to your consent preferences. Server-side observability captures request-level operational metrics such as response timing, error rates, and route information to monitor reliability and investigate issues; this processing is carried out under a legitimate-interest basis (GDPR Article 6(1)(f)) and does not include user-identifying data. Client-side analytics events, such as site-usage metrics, are only sent after you have accepted analytics cookies via our consent tools.
• **Analytics:** We use analytics tools, such as Google Analytics and similar services, to better understand how our website performs and how visitors use it. These tools record technical information about your device together with usage information, such as how often you visit, which pages and features you use, aggregated usage and performance data, and details of your visit including parts of the URL clickstream to, through, and from our website. Client-side analytics events are only collected after you accept analytics cookies through our consent tool.

2.3 Information from Booking Partners

When you book through a travel platform or online travel agency, we receive your booking and contact details from that platform so we can provide the vehicle and services you reserved. We use this information to fulfil and manage your rental. We use it for advertising measurement or audience matching only where you have separately given us your own consent, for example by opting in when you collect your vehicle. Your use of the booking platform is also governed by that platform's own privacy policy.

2.4 Vehicle Security and Telematics Data

MJAT vehicles may use vehicle security and telematics systems. We collect and use vehicle location, speed, mileage, fuel level, and operational data to manage and maintain our fleet, support vehicle security and recovery, investigate accidents and incidents, handle summonses and toll charges, calculate fuel and mileage charges, and enforce the rental contract. This data is processed in accordance with the Personal Data Protection Act 2010 and, where applicable, the rights described in this policy.

2.5 Devices Paired with the Vehicle

If you connect a phone or device to the vehicle (by Bluetooth, USB, or otherwise), your data may be stored in the vehicle's system. Please remove and unpair your device before returning the vehicle. MJAT is not responsible for personal data you leave in the vehicle.

3. How We Use Your Information

We use your information for the following purposes:

• **To Provide Services:** To process and manage bookings and enquiries, support vehicle rental and travel-related services, coordinate pickups or dropoffs, and provide customer support.
• **To Improve Our Website:** To analyze usage patterns, understand campaign and traffic sources, improve website functionality, fix errors, optimize user experience, and maintain service quality.
• **To Communicate With You:** To send booking confirmations, payment updates, operational notices, support responses, and, where appropriate, follow-up messages related to incomplete or abandoned bookings.
• **To Comply with Legal Obligations:** To comply with applicable laws, regulations, contractual obligations, law-enforcement requests, dispute handling requirements, and record-keeping obligations.
• **To Verify Eligibility and Identity:** To verify customer identity and, where applicable, assess eligibility for vehicle rental, insurance, fraud prevention, legal compliance, or operational review.
• **To Process Payments:** To create and manage payment sessions, confirm payment-related events, and reconcile booking and transaction records through our payment service providers and backend systems.
• **To Prevent Fraud and Protect the Service:** To apply rate limiting, spam and bot protection, consent controls, monitoring, security checks, abuse prevention, and related safeguards.
• **To Advertise and Measure Campaigns:** We may measure advertising performance and completed bookings using limited booking and conversion information. Where permitted by applicable law and your consent or opt-out status, this may include sending verified email or phone details to advertising partners such as Google Ads in hashed form for conversion attribution or audience matching. We do not send identity documents, driving licence or passport details, payment card details, vehicle security or telematics data, accident reports, claim documents, or raw rental notes for this purpose. For customers in the EEA, United Kingdom, or Switzerland, verified email or phone details are used for Google Ads user-data attribution or audience matching only where the required advertising consent has been recorded.
• **Use of Booking Platform Data:** Where your booking originated with a travel platform, we use the details received from that platform to fulfil your rental and to meet our legal, tax, and safety obligations. We do not use platform-introduced customer details for our own marketing unless you have given us direct consent and our agreement with that platform permits it.

4. How We Share Your Information

We may share your information with:

• **Service Providers:** Third-party vendors and infrastructure providers that help us operate the website and related services, including where applicable backend and CRM systems, payment processors, hosting and observability providers, anti-bot and fraud-prevention tools, map and location services, analytics and tag-management tools, and authentication providers.
• **Business Partners:** Operational partners and service providers involved in delivering bookings, payments, support, or related customer services, including where applicable our booking and CRM backend platform (hosted on EU-based infrastructure under a GDPR-compliant Data Processing Agreement), Stripe, Google reCAPTCHA (which receives your IP address for bot-protection scoring; data transfers are governed by Standard Contractual Clauses), Google Tag Manager, Google Analytics where configured and consented to, our website hosting and observability provider (which receives server-side performance and observability data under a Data Processing Addendum, with transfers outside the EEA covered by Standard Contractual Clauses), Google Maps, and social login providers if enabled. Where applicable, Data Processing Agreements or equivalent contractual safeguards are in place with service providers that process personal data on our behalf.
• **Advertising Partners:** Google (Google Ads) and Meta (Facebook and Instagram), which we use to measure advertising performance, attribute completed bookings, build remarketing audiences, and, where eligible, match hashed contact details to show or suppress ads. Contact details shared for attribution or audience matching are transmitted only in hashed form. For customers in the EEA, United Kingdom, and Switzerland, verified email or phone details are not used for Google Ads user-data attribution or audience matching unless the required advertising consent has been recorded. Transfers outside the EEA are governed by Standard Contractual Clauses where required.
• **Business Transfers:** If MJAT is involved in a merger, acquisition, restructuring, or sale of assets, customer information may be transferred as part of that transaction, subject to the protections in this policy.
• **Legal Authorities:** When required by law or legal process, or when we reasonably believe disclosure is necessary to protect our rights, property, customers, staff, website, or the public, including in connection with fraud prevention, disputes, or regulatory matters.

5. Data Security

We implement reasonable technical and organisational measures designed to protect your personal information from unauthorized access, disclosure, alteration, misuse, or destruction. Depending on the system and context, these measures may include secure session handling, security headers, access controls, same-origin and CSRF protections, rate limiting, bot-detection controls such as reCAPTCHA, and other safeguards appropriate to the service. However, no online transmission, website, or storage environment is completely secure, so we cannot guarantee absolute security.

6. Data Retention

MJAT will only retain your personal data for as long as is necessary to serve the purposes set out above in section 3, or to comply with the relevant legal requirements. When it is no longer necessary for us to process your personal data, we will either securely delete or anonymise the data.

7. Your Rights and Choices

You have the following rights regarding your personal information:

• **Access and Correction:** Under GDPR Article 15 and Malaysia's Personal Data Protection Act 2010 (PDPA) section 34, you may submit a Data Subject Access Request (DSAR) to obtain a copy of the personal information we hold about you, including identity document details stored in our booking systems. You may also ask us to correct or update inaccurate or incomplete information under PDPA section 34(1)(b) or GDPR Article 16, subject to applicable verification and legal requirements. To exercise these rights, please contact us via our Contact page.
• **Opt-Out and Withdrawal of Consent:** You may opt out of receiving promotional communications and withdraw marketing or advertising consent at any time by following unsubscribe instructions where available, using our consent tools, or contacting MJAT. Withdrawing marketing or advertising consent does not affect your rental contract, vehicle handover, safety checks, identity verification, payment processing, vehicle security or safety processing, insurance claims, debt recovery, legal compliance, or the lawfulness of processing already carried out before withdrawal. You may manage analytics or cookie preferences through our consent tools and browser settings, although disabling some technologies may affect website functionality.
• **Deletion:** You may request deletion, deactivation, or restriction of certain personal information, subject to legal, operational, contractual, tax, insurance, fraud-prevention, and record-keeping requirements. Where deletion cannot be completed immediately or in full, we may retain information as reasonably necessary for those purposes.

8. Cookies and Tracking Technologies

We use cookies, browser storage, and similar technologies to operate the website, remember consent choices, maintain user or guest sessions, support account authentication, preserve booking progress, measure site usage, understand campaign attribution, improve performance, and help protect the service from abuse.

• **Essential Cookies:** These cookies are strictly necessary for site operation and are set regardless of consent. They include an analytics consent preference (1-year duration) so we remember your choice, a visitor token used to maintain guest and account sessions, and an authentication session cookie used after sign-in.
• **Analytics and Marketing Cookies:** These are set only after you accept analytics and marketing cookies via our consent banner. They include first-touch UTM attribution cookies (90-day duration) and tags used for advertising measurement and remarketing, including the Google Ads conversion and remarketing tag and the Meta Pixel. Google Tag Manager and all analytics and advertising tags are gated behind your consent choice and are blocked by default until you accept. For visitors in the EEA, the United Kingdom, and Switzerland, consent signals are passed to Google and Meta in line with their consent requirements. Detailed cookie names and durations are available in our consent preferences tool.
• **Browser Session Storage:** UTM parameters from your landing page may be temporarily preserved in browser sessionStorage until a consent decision is made, after which they are stored as cookies if consent is granted or discarded if consent is declined. Other temporary sessionStorage entries are used for booking continuity and short-lived technical state. All sessionStorage entries are cleared when the browser tab closes.
• **Server-Side Operational Monitoring:** We collect technical request metrics for reliability and debugging purposes. This processing operates under a legitimate-interest basis (GDPR Article 6(1)(f)) for service operation, and no user-identifying data is included in this monitoring.
• **Managing Your Preferences:** You can control cookie settings through your browser and through our on-site consent tool. Disabling essential cookies may affect website functionality, including sign-in and booking continuity.

9. Third-Party Links

Our website may contain links to third-party websites, services, or hosted pages, including for example booking platforms, payment pages, map or location tools, social login pages, and other external services. This policy does not cover those third parties; they operate under their own terms and privacy practices, and we are not responsible for the privacy, security, or content practices of external sites that we do not control. We encourage you to review the privacy notices of any third-party site or service you use.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, vendors, legal requirements, or business operations. Any changes will be posted on this page with an updated effective date. Your continued use of our website after changes are made constitutes your acceptance of the revised policy to the extent permitted by applicable law.