Who controls your personal data
Awan Emas Travel & Tours Sdn. Bhd., Company No. 202201021083 (1466780-P), is the data controller for personal data that we collect for our own services. Our office is at Lot E-1-2, Plaza Tanjung Aru, Block E, 1st Floor, Jalan Mat Salleh, 88100 Kota Kinabalu, Sabah.
Contact awanemastraveltours@gmail.com or 088 276 537 for a privacy enquiry. Payment confirmations must be sent only to 011 3324 8670.
Personal data we may collect
We may collect your name, contact details, organisation, destination, travel dates, passenger count, preferences, booking and ticket details, payment reference, invoice and receipt references, quarterly rewards entries, receipt images or PDF copies, complaint details, incident dates and locations, supporting evidence, verified purchase amounts, points, ranking status, communications and service history. For an insurance enquiry, we may also collect information relevant to eligibility and underwriting, such as occupation, age, travel plans, vehicle, property, group or claims information.
After initial review, a supplier or insurer may require identity document, nationality, date of birth, health or other sensitive information. We will request this only where reasonably necessary and through an appropriate method. The public quotation form does not ask for a full MyKad number, passport number, payment card details or medical records.
How data is collected
We collect data directly from you through this website, WhatsApp, email, telephone, forms, documents, payments and in person communication. We may also receive data from a person booking on your behalf, an employer or group organiser, an airline, travel supplier, insurer, authorised intermediary, payment provider or public authority.
If you give us another person's data, you confirm that you are authorised to do so, the information is accurate and the person has been shown this notice.
Purposes of processing
We may process personal data to:
- answer enquiries and prepare quotations;
- verify identity, authority, eligibility and service requirements;
- arrange travel, reservations, tickets, accommodation and related services;
- submit an insurance proposal or renewal request to an authorised insurer;
- receive or verify an authorised payment and issue records;
- verify receipts, prevent duplicate or fraudulent entries, calculate points and administer the quarterly achievement rewards programme;
- support policy administration, changes, cancellation, refunds or claims;
- communicate service, safety, schedule and regulatory information;
- prevent fraud, manage security and comply with legal obligations;
- handle complaints, disputes, audits and business records; and
- send marketing only where permitted and subject to your right to opt out.
Required and optional information
Fields marked as required are needed to review the request. Other information is optional at the first quotation stage. If you do not provide information required by a supplier, insurer or law, we may be unable to quote, book, issue, renew, administer or assist with the service.
Where consent is required for sensitive data or another specific purpose, you may withdraw consent subject to legal and contractual restrictions. Withdrawal does not affect earlier lawful processing and may prevent us from continuing the requested service.
Who may receive the data
We may disclose only relevant data to airlines, reservation systems, hotels, tour operators, transport providers, attractions, guides, visa support providers, insurers, takaful operators, authorised agents or intermediaries, medical or assistance providers, payment providers, banks, professional advisers, technology service providers and public authorities.
These recipients may act as independent data controllers under their own privacy notices. We do not sell personal data. We may disclose information where required by law, to prevent harm or fraud, or in connection with a lawful business transfer.
When Billplz payment is selected, we provide Billplz with the payer name, email, mobile number, payment amount, service description and quotation or invoice reference needed to create and reconcile the bill. Billplz and the selected bank, card network or electronic wallet process the payment credentials under their own security and privacy requirements. AETTSB does not receive or store the full card number, online banking password or one time security code entered on that payment page.
Quarterly rewards receipt files are stored privately and may be viewed only by authorised AETTSB personnel and service providers that support secure hosting, verification, audit, fraud prevention or legal compliance. They are not published on the leaderboard. The public leaderboard shows only a masked participant name, or “Peserta dirahsiakan”, a masked receipt reference, the verified receipt count, points, cumulative amount and progress. A participant may ask us to hide the masked name without losing private participation, subject to verification of the request.
International transfers
International travel and global supplier systems may require personal data to be processed outside Malaysia, including in a destination or transit country. Privacy protections in another country may differ. We will take reasonable steps and apply applicable legal requirements when arranging such transfers. If a transfer is not acceptable to you, tell us before asking us to proceed, although the service may then be impossible to provide.
Retention and security
We retain personal data only as long as reasonably necessary for the service, customer support, legal obligations, accounting, tax, insurance, complaints, fraud prevention and dispute records. Different records may have different legal retention periods. Data is deleted, anonymised or securely disposed of when no longer required.
Rewards submissions are retained for the campaign, final reconciliation, reward fulfilment, accounting, complaints, fraud investigation and any period required by law. A rejected receipt copy will be deleted or securely disposed of when it is no longer reasonably required for those purposes.
We use reasonable administrative, technical and physical safeguards appropriate to the data and risk. No email, messaging service or online system is completely secure. If a personal data breach occurs, we will assess it, contain it and notify the relevant authority and affected persons where Malaysian law requires.
Your choices and rights
Subject to applicable law, you may request access to or correction of personal data, withdraw consent, object to direct marketing, ask about processing, and exercise any applicable data portability right. We may verify identity, charge a fee permitted by law, request clarification or decline a request where law allows.
To make a request, email awanemastraveltours@gmail.com with your name, contact details, request and relevant reference. You may also complain to the Personal Data Protection Commissioner if you believe your rights have not been respected.
Messaging, links and website data
When you choose WhatsApp or email, the message is handled by that provider and subject to its terms and privacy practices. Check the recipient before sending. This website may transfer you to the Billplz payment page or link to supplier or regulator websites that we do not control. Check the merchant name, amount and reference before proceeding.
Basic technical data may be processed for security, reliable delivery and site operation. If optional analytics or advertising cookies are introduced later, we will update this notice and provide any choice required by law.
Children and updates
A parent, guardian or authorised group organiser must provide and approve information for a child where required. We may request evidence of authority before processing.
We may update this notice when services, suppliers or law change. The effective date will be revised and a material change will be communicated where required. Contact us before proceeding if you need this notice explained in another format.