Privacy Policy

1. Introduction

ssundas ("we", "our", or "us") is committed to protecting the personal information of those who interact with our services. This Privacy Policy explains how we collect, use, store, and protect personal data in connection with our yacht tour operations based in Langkawi, Kedah, Malaysia.

This policy applies to all personal data collected through our website at sundaran, by phone, by email, and through any other means of direct communication. By submitting your information to us, you acknowledge the practices described here.

For questions, contact us at: [email protected]

2. Data We Collect

Information you provide

When you make an enquiry or booking, we may collect:

• Full name
• Email address
• Phone number
• Nationality and passport details (for cross-border voyages requiring permit processing)
• Dietary requirements and health information relevant to tour safety
• Communication records (emails, messages sent to us)

Information collected automatically

When you visit our website, we may collect standard technical information such as IP address, browser type, device type, pages visited, and time spent on the site, through cookies and similar technologies. Please see our Cookie Policy for more detail.

3. Legal Basis for Processing

We process personal data on the following legal bases under applicable Malaysian data protection law (Personal Data Protection Act 2010) and, where relevant, equivalent international standards:

• Contractual necessity: To process your booking and deliver the tour service you have requested.
• Legitimate interest: To manage our operations, communicate with guests, and improve our services.
• Consent: For marketing communications, where you have explicitly opted in.
• Legal obligation: Where required by Malaysian law, immigration regulations, or maritime authority requirements.

4. How We Use Your Data

• Processing bookings and managing tour logistics
• Communicating regarding your tour, including pre-tour information and post-tour follow-up
• Processing border permit documentation for cross-border voyages
• Ensuring health and safety during the tour
• Responding to enquiries and providing customer support
• Sending relevant updates or newsletters, where consent has been given
• Complying with legal and regulatory requirements

We do not use your personal data for automated profiling or decision-making.

5. Data Sharing

We do not sell your personal data to third parties. We may share your data with:

• Malaysian and Thai immigration and maritime authorities, where required for cross-border voyage permits
• Service providers who assist our operations (such as payment processors), under data processing agreements
• Authorities if required by law, court order, or to protect the safety of guests or crew

Any third party who receives personal data from us is required to handle it in accordance with applicable data protection law.

6. Data Retention

We retain your personal data for as long as necessary to fulfil the purpose for which it was collected, and as required by applicable law. Booking records are typically retained for seven years for financial compliance purposes. Health and dietary information is deleted within 30 days of the tour's completion unless there is an ongoing safety or legal reason to retain it.

7. Data Protection Measures

We take reasonable technical and organisational measures to protect your personal data from unauthorised access, loss, or misuse. These include secure email communication, access controls on internal systems, and limited staff access to personal data on a need-to-know basis.

In the event of a data breach that poses risk to individuals, we will notify affected parties and relevant authorities within the timeframes required by Malaysian law.

8. Cookies

Our website uses cookies to function correctly and to understand how visitors use the site. Please see our Cookie Policy for details, including how to manage your preferences.

9. Your Rights

Under Malaysia's Personal Data Protection Act 2010, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Withdraw consent for processing where consent is the legal basis
• Request that we cease processing your data for direct marketing
• Lodge a complaint with the Personal Data Protection Commissioner of Malaysia

To exercise your rights, please contact: [email protected]

10. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites and recommend you review their policies separately.

11. Children

Our services are directed at adults (18 years and over). Where guests under 18 participate in tours, personal data is provided and consented to by a parent or legal guardian.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated effective date. Continued use of our services after changes constitutes acceptance of the revised policy.

13. Contact

For any privacy-related questions, requests, or concerns, please contact:
Email: [email protected]
Address: ssundas, 14 Jalan Pandak Mayah, 07000 Langkawi, Kedah, Malaysia