Privacy policy
Last updated: 11 August 2026. This policy explains what personal data maliaubasin.com.my collects, why, and what happens to it.
Who we are
maliaubasin.com.my is operated by Mudah Templates Sdn Bhd, company registration number 202301043800 (1537716-D), of Kota Kinabalu, Sabah, Malaysia. In this policy "we" and "us" mean that company.
Data protection enquiries: please use our contact page.
What we collect
Information you give us. When you submit an enquiry form we collect your name, email address, phone or WhatsApp number, country of residence, and the trip details you provide: package interest, applicable rate, number of travellers, preferred month, date flexibility, group fitness and any free-text message.
Information collected automatically. Our forms record the page you enquired from, the referring website, and campaign identifiers passed in the URL such as utm_source, utm_medium, utm_campaign, gclid and fbclid. This tells us which pages and campaigns produce enquiries.
Analytics. We use Google Analytics 4 to understand how the site is used. This may involve cookies or similar technologies and may collect IP address, device and browser information, and pages viewed. See "Cookies" below.
Why we use it, and the legal basis
- To respond to your enquiry and pass it to a licensed tour operator so they can quote and check availability. This is the primary purpose and the reason the form exists.
- To administer any resulting booking and any commission due to us.
- To improve the site, through aggregate analytics.
- To meet legal and accounting obligations.
Submitting an enquiry constitutes your consent to your details being shared with a licensed tour operator for the purpose of responding to it. If you do not want that, do not use the form — you can approach an operator or Yayasan Sabah directly.
Who we share it with
Licensed tour operators. Enquiry details are passed to the licensed Sabah tour operator handling the trip, so they can respond. They become responsible for the data they hold and process it under their own privacy terms.
Service providers. Hosting, email and analytics providers acting on our instructions.
Where required by law.
We do not sell personal data, and we do not pass enquiry details to third parties for their own marketing. Our commercial model is set out here.
Transfers outside Malaysia
Some service providers may store or process data outside Malaysia. Our hosting is based in Malaysia; Google Analytics 4 may process data on Google's servers outside Malaysia, including in the United States. Where that happens we take reasonable steps to ensure an appropriate level of protection.
How long we keep it
Enquiry records are retained only for as long as necessary to fulfil the purposes described in this policy, after which they are deleted, unless a longer period is required for legal, accounting or dispute-resolution purposes.
Security
We take reasonable practical steps to protect personal data against loss, misuse, unauthorised access, alteration and disclosure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Your rights
Subject to the Personal Data Protection Act 2010 and applicable exceptions, you may:
- request access to the personal data we hold about you
- request correction of data that is inaccurate, incomplete or out of date
- withdraw consent to further processing
- limit processing for direct marketing purposes
- make a complaint about how your data has been handled
To exercise any of these, get in touch via our contact page. We may need to verify your identity, and a fee may apply to data access requests as permitted by law.
Note that once an enquiry has been passed to a tour operator, requests concerning the data they hold should be directed to that operator.
Cookies
This site uses cookies and similar technologies for analytics (Google Analytics 4) and, where campaign parameters are present, attribution. These cookies do not identify you by name and are used only in aggregate to understand site usage. Most browsers let you refuse or delete cookies; doing so may affect how parts of the site work.
Children
This site is not directed at children and we do not knowingly collect personal data from minors. If you believe a child has provided data, contact us and we will delete it.
Changes
We may update this policy. The date at the top of this page shows when it was last revised. Material changes will be reflected here.
Complaints
Contact us first via our contact page. If you are not satisfied, you may complain to the Personal Data Protection Commissioner, Malaysia.