1About this notice#
This notice explains how Amazing Borneo Tours & Events Sdn Bhd (“ABT”, “we” or “us”) collects, uses, stores, discloses and protects your personal data when you subscribe to marketing emails from MountKinabalu.com.
MountKinabalu.com is operated by Amazing Borneo Tours & Events Sdn Bhd, the controller of your personal data. If you subscribed through a different source site or brand, we will tell you the subscription source and the brand that will send emails to you. That source site or brand does not become a separate data controller merely because it is a subscription source.
This notice is specific to email subscription and marketing activity managed through ABT’s EDM system. Data processed for bookings, payments, enquiries or travel services may also be subject to the relevant privacy notice or terms of service.
2Personal data we collect#
We may collect and process:
- your email address;
- your name, if provided;
- the brand, site or form that was the source of your subscription;
- your subscription preferences, consent status and unsubscribe records;
- the date and time of the action, Internet Protocol (IP) address, browser or device information and user-agent string associated with your consent;
- email delivery information, including delivery status, bounces and spam complaints; and
- interaction data such as opens of our marketing emails or clicks on the tracked links in some of them, only where it is lawfully permitted, including the type of email app or device used and the approximate country, both derived from the open or click.
We obtain this data directly from you through subscription or enquiry forms, from your actions on a preference or unsubscribe page, and from our email service provider in connection with message delivery. Our email service provider may also record whether service emails you receive from us are opened; we do not use that information for marketing.
3Purposes and basis of processing#
We process your personal data to:
- send travel offers, trip ideas, updates and other marketing content from MountKinabalu.com that you have chosen to receive;
- manage subscription preferences, unsubscribe requests and suppression lists so that your choices are respected;
- send welcome emails and manage email deliverability, bounces and complaints;
- keep minimal evidence of consent, withdrawal of consent and suppression for compliance and the handling of legal claims; and
- measure campaign effectiveness through opens and tracked links in our marketing emails, only where it is lawfully permitted.
Email marketing is carried out on the basis of your consent. Where the European Union General Data Protection Regulation (“GDPR”) applies, the basis is consent under Article 6(1)(a). We may keep minimal evidence of consent, withdrawal and suppression on the basis of legitimate interests under Article 6(1)(f), and to the extent necessary for the establishment, exercise or defence of legal claims under Article 17(3)(e).
We will rely on a legal obligation as a basis for processing only where a specific applicable obligation can be identified.
4Your choices and the consequences of not providing data#
Providing data for a marketing subscription is voluntary. If you do not provide an email address or do not consent to receive marketing, we will not be able to register you for marketing emails. That decision will not prevent you from making a booking or an enquiry, and necessary service messages about a booking or enquiry do not depend on marketing consent.
Your subscription starts when you press Subscribe, unless MountKinabalu.com uses a two-step confirmation process. Where two-step confirmation is used, the subscription starts only after you confirm your email address through a link sent to you.
5Unsubscribing#
You can withdraw consent and unsubscribe at any time using the unsubscribe link in any marketing email. No sign-in is required. You can choose to unsubscribe from MountKinabalu.com only or from all ABT brands, subject to the options presented.
After you unsubscribe, you will not receive further marketing emails within the scope of that choice. We may still send necessary messages about your bookings, payments, security or enquiries. Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.
6Disclosure to data processors#
We do not sell your personal data. We may disclose the necessary data to:
- Linode/Akamai, for hosting the EDM application and database in Singapore;
- Postmark and its subprocessors, for email delivery and the handling of delivery status, bounces and complaints, including processing in the United States;
- Cloudflare, Turnstile or R2, where used in the production environment, for content delivery networking, bot protection, request security or asset storage; and
- public authorities, regulators, professional advisers or other parties where permitted or required by law.
Service providers are only permitted to process data for the specified purposes and are subject to the relevant contractual and security obligations.
7Cross-border transfers of personal data#
Your personal data may be transferred to and processed outside Malaysia, including in Singapore and the United States. Where GDPR applies, restricted transfers outside the European Economic Area are protected through data-processing agreements and Standard Contractual Clauses, where applicable. For transfers from Malaysia, ABT will apply the conditions and safeguards available under section 129 of the Personal Data Protection Act 2010 and the cross-border transfer guidelines in force.
You can request further information about the recipients, destination countries and the relevant safeguards through info@mountkinabalu.com.
8Email tracking and analytics#
Our emails contain a small pixel, and some of our marketing emails use tracked links, so that we can measure whether a message was opened or a link was clicked. We collect and use this information for our marketing emails, and only where it is lawfully permitted; it is applied uniformly to every recipient, regardless of the country in which the recipient is located, and ABT does not operate a separate tracking practice for particular territories. Our email service provider may also record whether service emails you receive from us (such as a booking or account email) were opened; we do not use that information for marketing. If you do not wish to receive tracked marketing emails, you can stop them at any time through the preference or unsubscribe link included in every marketing email.
Email-open data is approximate and does not necessarily prove that a person has read a message.
9Data retention#
We keep data only for as long as necessary for the purposes set out in this notice:
- minimal evidence of consent, withdrawal and suppression is kept for up to six years after consent is withdrawn or the relevant relationship ends, whichever is later, subject to documented necessity;
- active marketing profiles are anonymised approximately 24 months after last activity when that data is no longer needed; and
- email interaction events are kept for approximately 24 months before being aggregated into statistics.
When you unsubscribe or request deletion, we may keep a minimal, pseudonymised suppression record so that the address is not accidentally re-added or contacted for marketing. This record is still treated as personal data and protected accordingly.
10Security of personal data#
We use reasonable technical and organisational security measures to protect personal data against loss, misuse, alteration, unauthorised access, disclosure or destruction. Access to data is restricted to staff and service providers who need it to carry out authorised tasks.
11Your rights#
Subject to applicable law, you may:
- request access to your personal data;
- request correction of data that is inaccurate, incomplete, misleading or out of date;
- withdraw consent and unsubscribe;
- request deletion of data that is no longer needed;
- object to or request restriction of certain processing;
- request data portability, where that right applies; and
- lodge a complaint with the relevant data protection authority.
Some rights are subject to legal exceptions. Where we need to keep a suppression record or minimal evidence after deleting an active profile, we will limit that record to the data needed to respect your choice and to handle legal claims.
To exercise your rights, contact info@mountkinabalu.com. We may ask for reasonable information to verify your identity and the scope of your request.
12Complaints#
If you have a question or complaint, please contact us first through info@mountkinabalu.com.
You may also contact:
Personal Data Protection Commissioner of Malaysia
Level 8, Galeria PjH
Jalan P4W, Persiaran Perdana, Presint 4
Federal Government Administrative Centre
62100 Putrajaya, Malaysia
Email: aduan@pdp.gov.my
Where GDPR applies, you may also lodge a complaint with the relevant data protection supervisory authority in the country of your residence or place of work, or the place where the alleged infringement occurred.
13Changes to this notice#
We may update this notice to reflect changes in our practices, technology or applicable law. The latest version will be published at https://edm.mountkinabalu.com/privacy/mountkinabalu together with its effective date. Where a change materially affects how we use data on the basis of consent, we will obtain fresh consent where required.
14Contact information#
Amazing Borneo Tours & Events Sdn Bhd
L1.39, 1st Floor, Kompleks Asia City
Jalan Asia City
88000 Kota Kinabalu, Sabah, Malaysia
Privacy email: info@mountkinabalu.com