Privacy Policy

Introduction

kelpsynas operates yacht charter services from Semporna, Sabah, Malaysia. This privacy policy explains how we collect, use, store, and protect personal information provided by charter guests and website visitors. We are committed to protecting your privacy and handling your data in accordance with Malaysian Personal Data Protection Act 2010 (PDPA).

By using our charter services or website, you acknowledge that you have read and understood this privacy policy. If you have questions or concerns about how your data is handled, please contact us at [email protected].

Data Collection Information

Personal Data We Collect:

• Contact Information: Name, email address, phone number
• Booking Details: Charter date, service selection, number of guests, special requirements
• Payment Information: Billing address, payment method details (processed securely through third-party providers)
• Correspondence: Messages sent through contact forms or email communications
• Technical Data: IP address, browser type, device information, website usage patterns

How We Collect Data:

• Directly from you when filling out booking forms or contacting us
• Automatically through cookies and analytics tools when you visit our website
• From third parties such as payment processors when completing transactions

Legal Basis for Processing:

We process personal data based on:

• Contract Fulfillment: Providing charter services you have booked
• Consent: Marketing communications you have opted into
• Legitimate Interest: Improving services, preventing fraud, ensuring safety
• Legal Obligation: Compliance with maritime regulations and tax requirements

Data Retention:

Booking records are retained for seven years to comply with financial and maritime safety requirements. Contact form submissions are kept for two years. Marketing preferences are stored until you request removal. Website analytics data is aggregated and anonymized after 14 months.

Data Usage Explanation

How We Use Your Personal Data:

• Service Delivery: Processing bookings, coordinating charters, managing permits
• Communication: Sending booking confirmations, charter details, weather updates
• Payment Processing: Handling transactions, issuing receipts, managing refunds
• Safety Compliance: Meeting maritime authority requirements, maintaining crew records
• Service Improvement: Analyzing feedback, identifying operational enhancements
• Marketing: Sending promotional offers about charter services (opt-in only)

Data Sharing With Third Parties:

We share personal data with:

• Sabah Parks: Required information for marine park permits and Sipadan access
• Payment Processors: Secure transaction handling (they maintain their own privacy policies)
• Email Service Provider: For sending booking confirmations and communications
• Analytics Services: Google Analytics for website improvement (anonymized data)

We do not sell or rent personal data to third parties. Data sharing is limited to operational necessities and service providers bound by confidentiality agreements.

Marketing Communications:

You can opt in to receive promotional emails about charter services, seasonal offers, and company updates. These communications include an unsubscribe link in every message. You can also contact us directly to update your marketing preferences at any time.

Data Protection Measures

Security Measures:

• Encryption: SSL/TLS encryption for data transmission on our website
• Secure Storage: Password-protected databases with restricted access
• Access Controls: Only authorized personnel can access personal data
• Regular Audits: Periodic security reviews and software updates
• Staff Training: Crew and office staff trained on data protection requirements

Breach Notification:

In the event of a data breach affecting personal information, we will notify affected individuals within 72 hours of becoming aware of the breach, as required by Malaysian PDPA. Notifications will include the nature of the breach, potential impact, and steps being taken to address the situation.

Cookie Information

Our website uses cookies to improve functionality and analyze usage patterns. Cookies are small text files stored on your device when you visit our website. We use both session cookies (deleted when you close your browser) and persistent cookies (remain for a specified period).

Types of Cookies We Use:

• Essential Cookies: Required for website functionality, booking forms, and security
• Analytics Cookies: Track website usage to improve user experience
• Preference Cookies: Remember your settings and choices

For detailed information about cookies and how to manage them, please see our Cookie Policy.

User Rights

Under the Malaysian Personal Data Protection Act 2010, you have the following rights regarding your personal data:

• Right to Access: Request a copy of personal data we hold about you
• Right to Rectification: Correct inaccurate or incomplete personal information
• Right to Erasure: Request deletion of your personal data (subject to legal retention requirements)
• Right to Withdraw Consent: Opt out of marketing communications or data processing based on consent
• Right to Object: Object to processing based on legitimate interests
• Right to Data Portability: Receive your data in a structured, commonly used format
• Right to Lodge Complaint: File a complaint with the Personal Data Protection Commissioner of Malaysia

To exercise these rights, contact us at [email protected]. We will respond to requests within 21 days as required by Malaysian law. Proof of identity may be required to process requests.

Third-Party Links

Our website may contain links to external websites, including payment processors, social media platforms, or tourism information sites. We are not responsible for the privacy practices or content of these third-party websites. We encourage you to review the privacy policies of any external sites you visit.

Children's Privacy

Our charter services are not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. Charter bookings require contact information from an adult responsible for the group. If we become aware that we have collected data from a child without parental consent, we will delete that information promptly.

International Data Transfers

Your personal data is primarily stored and processed in Malaysia. Some third-party service providers (such as email platforms or analytics tools) may process data in other countries. When data is transferred internationally, we ensure appropriate safeguards are in place through contractual agreements or certification schemes.

Policy Updates

This privacy policy may be updated to reflect changes in our practices, services, or legal requirements. The "Last Updated" date at the top of this page indicates when the most recent changes were made. Significant changes will be communicated through email to charter guests who have bookings or through prominent notice on our website. Continued use of our services after policy updates constitutes acceptance of the revised terms.

Contact Information

For questions, concerns, or requests regarding this privacy policy or how we handle your personal data, please contact: