This Privacy Policy explains how Holiday Space Sdn. Bhd. ("Holiday Space", "we", "us" or "our") handles personal data when you visit holidayspace.my or holidayspace.com.my, book travel services with us online or at our outlet, or contact our customer support.

We are committed to processing personal data in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia. By using our website or services, you acknowledge that your personal data will be processed as described in this policy. This notice is provided in English; a version in Bahasa Melayu is available on request.

Depending on the services you use, we may collect the following personal data:

• Identity details: full name as shown on your passport or identity card, title, gender, date of birth and nationality.
• Travel document details: passport or identity card number, issuing country and expiry date, where required by an airline, hotel, tour operator or immigration authority.
• Contact details: email address, mobile number, WhatsApp number and postal address.
• Booking details: travel dates, destinations, itineraries, passenger and guest names, seat, meal and room preferences, special assistance requests and loyalty programme numbers.
• Payment details: billing name and address and transaction references. Card details are entered on the secure page of our payment service provider and are not stored by us.
• Account details: login credentials, booking history, saved travellers and communication preferences.
• Technical data: IP address, device and browser type, pages visited, approximate location and cookie identifiers.
• Communications: messages, emails, call notes, support tickets and attachments you send to us.

Some bookings require sensitive personal data, such as health or mobility information for special assistance, or religious dietary preferences. We only collect this with your explicit consent and only to fulfil your request.

If you provide personal data about other travellers (for example family members or colleagues), you confirm that you are authorised to do so and that they are aware of this policy.

We process personal data for the following purposes:

• To search, reserve, book, issue, change and cancel travel services on your behalf.
• To process payments, refunds and charges, and to prevent and detect fraud.
• To send booking confirmations, e-tickets, vouchers, itinerary updates and important service notices such as schedule changes.
• To provide customer support and respond to enquiries, complaints and feedback.
• To manage your account and verify your identity.
• To comply with legal, regulatory, tax, accounting and immigration requirements.
• To improve our website, services and security, including analysing how our website is used.
• With your consent, to send you newsletters, promotions and travel offers.

Providing your personal data is voluntary. However, if you do not provide the data a supplier or authority requires, we may be unable to complete your booking or provide the service you asked for.

We do not sell your personal data. We disclose it only where needed for the purposes above, to:

• Travel suppliers: airlines, hotels and accommodation providers, tour and activity operators, transport operators and their reservation systems, so they can provide the services you booked.
• Distribution partners: global distribution systems, consolidators and booking platforms that connect us to suppliers.
• Payment service providers, banks and card schemes, to process payments and refunds and to prevent fraud.
• Service providers who support our business, such as IT hosting, email and messaging, customer support and analytics providers, under contractual confidentiality obligations.
• Government agencies, immigration, customs, security and law enforcement authorities, where required by law or by the supplier for travel to a particular destination.
• Professional advisers such as auditors, lawyers and insurers, and any successor in the event of a merger, acquisition or restructuring.

Once your data is passed to a travel supplier, the supplier's own privacy policy also applies to its handling of that data.

Because travel is international, your personal data may be transferred to and processed in countries outside Malaysia, for example to an airline or hotel in your destination country or to technology providers that host data overseas.

Where we transfer personal data outside Malaysia, we do so as permitted under the PDPA, for example where the transfer is necessary to perform the contract you entered into with us, or where we have taken reasonable steps to ensure the data will be protected to a standard comparable to the PDPA.

Our website uses cookies and similar technologies to keep you signed in, remember your language and currency settings, keep items in your cart, measure website performance and understand how visitors use our pages.

• Essential cookies are needed for the website to work and cannot be switched off.
• Preference cookies remember choices such as language and currency.
• Analytics cookies help us understand traffic and improve our services.

You can block or delete cookies in your browser settings. If you block essential cookies, some parts of the website, such as sign-in and checkout, may not work properly.

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including to meet legal, accounting, tax and reporting requirements and to resolve disputes.

Booking and transaction records are generally kept for up to seven (7) years after the booking. When personal data is no longer needed, we delete or anonymise it securely.

We take practical technical and organisational measures to protect personal data from loss, misuse, unauthorised access, modification or disclosure. These include encrypted connections (HTTPS) on our website, access controls limited to staff who need the data, and the use of established payment service providers for card payments.

No method of transmission over the internet is completely secure. Please keep your account password confidential and contact us immediately if you suspect unauthorised use of your account.

Subject to the PDPA, you have the right to:

• Request access to the personal data we hold about you.
• Request correction of personal data that is inaccurate, incomplete, misleading or out of date.
• Withdraw consent to, or limit, the processing of your personal data, including opting out of marketing at any time using the unsubscribe link or by contacting us.

To make a request, contact us using the details below. We will respond within the period required by the PDPA (generally 21 days). We may need to verify your identity and, where the law allows, charge a prescribed fee for data access requests.

Withdrawing consent may mean we cannot continue to provide some services, for example where a supplier requires the data to keep your booking.

Our services are intended to be booked by adults. Personal data of children travelling with you is collected from the parent or guardian making the booking and used only to provide the travel services booked.

We may update this Privacy Policy from time to time. The latest version will always be posted on this page with the "Last updated" date. Where changes are significant, we will take reasonable steps to let you know.

For questions, requests or complaints about this policy or your personal data, please contact our Personal Data Protection Officer:

• Email: hello@holidayspace.my
• Phone: +60 7 571 0057
• WhatsApp: +60 10 400 8840
• Post or in person: Holiday Space Sdn. Bhd., 15, Jalan Selesa 1, Taman Selesa, 81400 Senai, Johor, Malaysia