This notice explains how Hala Tourism Group Sdn. Bhd. handles personal data under the Personal Data Protection Act 2010 (as amended in 2024).
1. Who we are
Hala Tourism Group Sdn. Bhd. (Registration No. 202601032572 (1694667-H)) ("Hala", "we", "us") is a destination management company based at D-25-5, Menara Suezcap, KL Gateway, Jalan Kerinchi, Bangsar South, 59200 Kuala Lumpur, Malaysia. We work only with travel businesses: travel agencies, tour operators, wholesalers and corporate clients.
We are the data user responsible for the personal data described in this notice.
2. What this notice covers
This notice explains how we process personal data when you:
- visit our website at halatg.com;
- send us a quotation request or a message through the website;
- contact us by email, WhatsApp or phone about a request;
- receive a quotation or updates from us about that request; and
- work with us as a partner business or book services with us.
If a request becomes a confirmed booking, our booking terms and any further notice we give you at that time also apply.
3. Personal data we collect
| Category | Examples |
|---|---|
| Contact details | Full name, company name, company website, country, email address, WhatsApp number, other phone number, preferred contact method |
| Trip details | Destinations, travel dates or month, number of nights, number of adults, children's ages, travellers' nationality, trip style, services needed, hotel and room preferences, vehicle and airport preferences, flight details if known, interests, event details, budget, the date you need the quotation by, your own reference and the language you want the quotation in |
| Information you write or attach | Your brief or itinerary and any files you upload (up to 3 files). These may contain personal data about travellers |
| Business verification | Your company registration and licence details, and the name and identity document of your authorised representative, when you start working with us as a partner |
| Booking details | Travellers' names as in their passports, rooming lists, flight details and, only where a supplier or authority requires them, dates of birth or passport details; payment records |
| Communications | Messages we exchange with you and notes our staff make about your request or booking |
| Choices you make | Your acknowledgement of this notice (with the version you saw) and whether you agreed to receive updates from us |
| Technical data | A one-way coded (hashed) version of your IP address used to limit abuse, security-check signals processed by Cloudflare Turnstile, and anonymous, aggregated visit statistics |
We do not ask for passport numbers, identity card numbers or payment card details through the website. Please do not include them in your brief or attachments. If a booking needs passport details, we ask for them separately and tell you how to send them securely.
4. How we collect it
We collect personal data directly from you when you complete our forms, upload files, email us, message us on WhatsApp or call us. We collect technical data automatically when you use the website. If you send us details of other people, such as your clients or colleagues, section 13 applies.
5. Why we use it
We use personal data to:
- reply to your request and give you a reference number;
- prepare and send a quotation or proposal;
- contact you about your request by your preferred method;
- check availability and prices with suppliers, and arrange the services if you confirm the trip;
- keep a record of requests, quotations and their outcome;
- verify partner businesses, and protect the website and our systems against spam, fraud, money laundering and misuse;
- understand, in aggregate, how the website is used so we can improve it;
- send you updates about our services, only if you agreed (section 7); and
- comply with the law and respond to lawful requests from authorities.
6. Which details are required
Fields marked as required on our forms are needed to respond to your request. If you do not provide them, we cannot process the request. Other fields are optional, but they help us prepare an accurate quotation.
7. Marketing
We send updates about our services only if you tick the separate, optional box on our forms, or otherwise agree. You can withdraw that consent at any time by using the unsubscribe link in any update, or by contacting us (section 16). Withdrawing does not affect replies about your requests.
8. Who we share it with
We do not sell or rent personal data. We share it only as needed for the purposes in section 5, with:
- Travel suppliers, such as hotels, transport operators, tour and activity providers and guides, when we check availability or arrange services for your request.
- Partner companies in other destinations, for services in Bali, Thailand, Vietnam and other destinations we arrange through our partner network.
- Service providers that run the website and our systems for us, under contract and only on our instructions:
| Provider | What they do for us | Where data is processed |
|---|---|---|
| Supabase | Database and file storage for requests | Singapore |
| Vercel | Website hosting and anonymous visit statistics | Singapore and other regions |
| Resend | Sending confirmation and notification emails | United States |
| Cloudflare (Turnstile) | Security check against automated submissions | Global network |
| Google (Workspace) | Our business email | Global |
- Professional advisers, such as lawyers, accountants and auditors, under a duty of confidentiality.
- Authorities, when required by law or to protect our legal rights.
- A buyer or successor, if our business or part of it is sold or reorganised, under equivalent protection.
9. Transfers outside Malaysia
Some of the recipients in section 8 are located, or process data, outside Malaysia: for example Singapore, the United States, Indonesia, Thailand, Vietnam and Hong Kong. When you submit a form, we ask for your explicit consent to these transfers, which are needed to prepare and deliver the services you request. We also transfer personal data abroad only as permitted by section 129 of the Personal Data Protection Act 2010, for example where the recipient is subject to protection substantially similar to Malaysian law, or where adequate safeguards are in place. If you do not consent, we cannot arrange services that involve recipients outside Malaysia.
10. How long we keep it
| Data | How long |
|---|---|
| Requests that do not become a booking | Personal details removed or anonymised 24 months after the request is closed. We keep anonymous figures (destinations, dates, group size, outcome) for statistics |
| Files you upload | Deleted 12 months after the request is closed |
| Files added but not submitted | Deleted within 24 hours |
| Records of confirmed bookings and payments | As long as required by law, for example for accounting and tax purposes 7 years |
| Passport details needed for a booking | Deleted 3 months after the trip ends, unless the law requires longer |
| Business verification records | While we work together and 5 years after the relationship ends |
| Coded IP data used to limit abuse | Deleted after 2 days |
| Marketing preferences | Until you withdraw consent, plus a record that you withdrew |
11. How we protect it
We take practical security steps, including:
- encryption of data in transit between your browser and our systems;
- access limited to authorised Hala staff, who sign in with two-factor authentication;
- database access rules that stop the public website from reading stored requests;
- uploaded files kept private and never available through public links; and
- storing IP addresses only in coded (hashed) form.
No system is completely secure, but we review these measures regularly.
12. Data breaches
If a personal data breach occurs, we will act promptly to contain it. Where the law requires, we will notify the Personal Data Protection Commissioner, and affected individuals, within the time limits set by the Personal Data Protection Act 2010 and its regulations.
13. Details of travellers and other people
Travel businesses often send us details of their clients, such as names in an itinerary, ages or nationality. When you do so, you confirm that you are allowed to share this information with us for the purposes in this notice, and that you have told the people concerned how it will be used, including that it may be shared with suppliers and transferred outside Malaysia, and that you have obtained their explicit consent to this. Please share only what is needed for the quotation.
Children's ages are collected only from the travel business making the request, to price and arrange services correctly.
14. Cookies and browser storage
The website uses:
- one functional cookie that remembers the language you chose;
- your browser's temporary storage to keep an unfinished request if the page reloads (cleared when you submit or close the tab);
- your browser's local storage, only if you tick "Remember my details on this device", to pre-fill your contact details next time. You can clear it with "Forget my details" or in your browser settings; and
- cookie-free visit statistics that do not identify you.
The security check (Cloudflare Turnstile) processes technical signals from your browser to tell people from automated programs. We do not use advertising or tracking cookies. If this changes, we will update this notice and ask for consent where required.
15. Your rights
Subject to the Personal Data Protection Act 2010, you may:
- ask for access to the personal data we hold about you and a copy of it;
- ask us to correct data that is inaccurate, incomplete, misleading or out of date;
- withdraw your consent, in full or in part (we may then be unable to continue with your request);
- ask us to stop or limit processing that is likely to cause you substantial damage or distress;
- ask us to stop using your data for marketing; and
- ask us to transfer your data to another organisation, where technically feasible.
Send your request to the contact in section 16. We may need to verify your identity first. We will respond within 21 days, as required by law, and may charge a fee for access requests where the law allows.
16. How to contact us
For questions, requests or complaints about personal data, contact:
- Email: privacy@halatg.com
- Phone / WhatsApp: +60 11-1174 1170
- Post: Hala Tourism Group Sdn. Bhd., D-25-5, Menara Suezcap, KL Gateway, Jalan Kerinchi, Bangsar South, 59200 Kuala Lumpur, Malaysia
If you are not satisfied with our response, you may contact the Personal Data Protection Commissioner of Malaysia.
17. Changes to this notice
We may update this notice when our services or the law change. The current version and its effective date are always on this page. When you submit a form, we record which version you acknowledged.
Version 1.0 · Effective [launch date]
18. Language
This notice is available in English and Bahasa Malaysia. Arabic and French translations may be provided for convenience. If there is any inconsistency, the English version prevails.