This website is officially in English. Translations to other languages are generated by Google Translate and may contain errors. By proceeding, you acknowledge you are viewing machine-generated translations.
Effective Date: 9th August 2025
1. INTRODUCTION
1.1 Hippo Tours & Travel Sdn Bhd (200501034451) and its Affiliates (as defined below in Clause 3.1 below) (each, the “Company” and collectively, the “Group”, “we”, “us” or “our”) are committed to protecting all personal data held by us, in accordance with the Personal Data Protection Act 2010 of Malaysia (as may be amended from time to time, hereinafter referred to as the “PDPA”). This Personal Data and Privacy Notice (“Notice”) contains the policies and practices of the Group to comply with the PDPA. For the purpose of this Notice, unless the context requires otherwise, the terms “personal data” and “processing” shall have the meaning prescribed in the PDPA.
1.2 Any changes to this Notice will be updated by the Group. Any such revised Notice will continue to apply to all personal data that have previously been collected as well as information that has been stored or processed on an ongoing basis by the Group. Therefore, all employees, customers, contractors, consultants, sub-contractors, independent contractor, third party service provider, suppliers, vendors, agents, distributors and representatives should be encouraged to check the version of this Notice for any updates or changes.
1.3 Please read this Notice to understand how the Group should use and process the personal data the Group has collected or may collect from any individual.
1.4 This Notice describes the Group’s gathering, storing, dissemination and processing practices in respect of personal data of individuals through the individual’s access to the Group in any manner and/or use of all content, products, services and functionality provided by, available at or through the Group.
2. PERSONAL DATA
2.1 Type of Information
In order for the Group to fulfil one or more of our obligations listed herein, the Group will need to collect relevant personal data from an individual which may include (but is not limited to) the following:-
(i) name, age, gender, marital status, race, nationality, IC number, passport number, date of birth, photo, dietary requirements and medical needs;
(ii) contact details such as house number, mobile number, email, home address, correspondence address, delivery address, region or state of staying;
(iii) any data/information related to payment and/or transactional services that an individual uses, either to make a payment or receive any payment, including but not limited to billing information, bank account details, payment card or account identifier, payment card or account holder, sender and receiver details, products transacted and history of transactions;
(iv) bank statements and such other financial details and information;
(v) information such as files, pictures, graphics, videos, audios and/or messages that an individual store with the Group;
(vi) any travel preferences and booking history including but not limited to booking data, travel history, transaction data, customer feedback, behavioural data, loyalty program data, social media data, geospatial data, and external data; and
(vii) information about how an individual uses and interacts with the Website (as defined below) and the services via third party analytics services which may use Cookies (as defined below) to gather information such as the pages the individual visited, the individual’s IP address, a date/time stamp for the individual’s visit and the sites that redirected the individual to the Website.
Personal data does NOT cover an individual’s “business contact information” such as his/her position, title, business address, business email/ fax number.
The individual is required to furnish his/her personal data upon his/her request for any products and services available of the Group. If the need arises, the Company is required to obtain explicit consent from the individual to process sensitive personal data. We may however process personal data without an individual’s consent in limited circumstances as permitted by law.
2.2 Sources of Personal Data
An individual’s personal data will be obtained from the following sources, where applicable, or such other sources which the Group may see fit from time to time and/or the Group may collect personal data directly from the individual when:-
(i) an individual communicates with the Group (for example when an individual contacts the Group for any enquiries);
(ii) information provided or submitted by an individual through among others, our Affiliates (as defined in Clause 3.1 below), agents, contractors, official partners, the various types of registration form(s) required for commercial transaction with the Group including making a reservation for travel services such as flights, accommodations or travel tours, commence a business relationship with the Group or our partners of third party vendors (where applicable), register his/her interest or subscribe for information on our publications (for example newsletters), participate in any of our surveys, competitions, contests, loyalty programme, or seminar, respond to any materials the Group sends out (received via email, facsimile, manual submission, online), webpage(s), or provide feedback or reviews about their travel experiences;
(iii) when an individual visits our premises where CCTV may be deployed for security purposes;
(iv) as applicable, publicly available or publicly accessible information;
(v) such other written or verbal communications or documents delivered to us prior to and during the course of our dealings with the individual.
The Group may also obtain the personal data from third-parties we deal with or who are connected with the individual and from such other sources where the individual has given his/her consent for the disclosure of information relating to him/her, and/or where otherwise lawfully permitted, including but not limited to, government or other regulatory authorities who have the power and/or authority to disclose such information.
As the accuracy of the personal data depends largely on the information the individual provides to us, all individuals shall inform the Group as soon as practicable if there are any errors in the personal data or if there have been any changes to the information provided.
2.3 Consent and Authorisation
(i) If the individual provides the Group with the personal data of any third parties (including but not limited to the end-customers who purchase products and/or services from the Group’s agent, contractors and/or official partners, as well as the individual’s spouse or children or any persons for whom the individual is designated as the person in charge of an organisation or company), the individual hereby warrants, represents and confirms that:
(a) he/she has obtained the necessary consent and permissions from such individuals to share and transfer their personal data to the Group, and for the Group to collect, store, use, disclose or otherwise process the relevant personal data in accordance with this Notice and PDPA, and such disclosure shall not violate the PDPA. The individual has also informed such persons to read this Notice; and
(b) such personal data shall not be used, shared or sold for any unauthorised purposes, including but not limited to tele-marketing, promotional, or direct marketing purposes, unless with the explicit consent of such individuals or as otherwise permitted under the PDPA.
(ii) The individual agrees to fully indemnify, defend and hold the Group harmless from and against any and all claims, actions, proceedings, losses, damages, penalties, fines, cost and expenses (including client-solicitor’s fees) arising from or in connection with any breach of his/her obligations set out in Clause 2.3(i).
2.4 Obligatory Personal Data and Failure to Supply
(i) All information and personal data requested for in the relevant forms is obligatory to be provided by the individual unless stated otherwise.
(ii) The failure to supply such information as may be needed may:-
(a) result in the Group being unable to provide the individual with the notices and/or services/activities requested;
(b) affect the Group’s ability to effect the necessary processes relating to the supply of our services and/or products;
(c) result in the Group’s reduced effectiveness in approaching individuals through customer support, as there will be a lack of necessary information about the individual’s account;
(d) result in the Group being unable to fulfil its obligations (for example, causing cancellations or delays in travel arrangements);
(e) result in the Group being unable to update the individual on our latest initiatives, promotions, events and/or launches; and/or
(f) result in the Group rejecting and/or unable to process a proposed transaction.
2.5 Purposes of Collecting and Processing Personal Data
Personal data provided will be processed by the Group for, amongst others, the following purposes as applicable:-
(i) to verify the individual’s identity;
(ii) to manage and arrange bookings for tours, flights, and other related services, and to manage matters in connection with the legitimate purposes for the business and operations of the Group in the ordinary course of business;
(ii) to provide the individual with any service and/or product the individual has requested;
(iv) for the delivery, update and the individual’s participation in our various events, campaigns, notices, updates and any activities, which the Group may consider to be interesting to the individual time to time;
(v) in order for the individual to participate and/or enter into the necessary agreement and/or contract in relation to our services and/or products;
(vi) to conduct market research and surveys, internal marketing analysis, customer profiling activities to determine customer location, preferences and demographics to improve our services, delivery and individual’s customer experience;
(vii) for our internal record management in the ordinary course of business including account management, billing and collection, audits, reporting and investigations;
(viii) to enable the Group to send the individual information by e-mail, telecommunication means (telephone calls or text messages) about services and/or products provided by the Group, our related companies and business partners, authorized third parties which may include but are not limited to the abovementioned purposes which the Group thinks may interest the individual;
(ix) to establish and better manage any relationship the Group has with the individual;
(x) to process any communication the individual sends to the Group (for example, answering any queries and dealing with any complaints and feedbacks);
(xi) for customer service related matters;
(xii) to notify the individual about benefits and changes to the features of our services and/or products;
(xiii) to detect, investigate, report or prevent crime, such as money laundering, terrorist financing, bribery, corruption, abusive behavior, fraudulent activity, criminal or other unlawful activities;
(xiv) to meet any legal or regulatory requirements relating to our initiatives, programmes, and activities and to make disclosure under the requirements of any applicable law, regulation, direction, court order, by-law, guideline, circular, code applicable to us or any of our Affiliates;
(xv) for audit, compliance and risk management purposes;
(xvi) to share the personal data with third party vendors for the purposes of including without limitation to conduct credit reference checks and establishment of his/her credit worthiness;
(xvii) for digital marketing purposes, including but not limited to social media, display advertising and/or push notifications;
(xviii) other related services such as security management and insurance procurement; and
(xix) such purposes specifically provided for in any particular services and/or products offered by the Group.
The Group may share and permit the sharing of personal data with third parties and our Affiliates, for any of the purposes herein mentioned, including but not limited to, facilitating the use of our services, products, completing a transaction with an individual, managing its account and our relationship with the individual, marketing and fulfilling any legal or regulatory requirements and requests as deemed necessary by the Group. In sharing the personal data with them, the Group endeavours to ensure that the third parties and our Affiliates keep the personal data secure from unauthorised access, collection, use, disclosure, or similar risks and retain the personal data only for as long as they need the personal data to achieve the purposes.
2.6 Storage and Retention of Personal Data
The Group uses appropriate technical and organisation measures to protect the personal data that we collect and process in accordance with applicable laws. The measures we use are designed to provide a level of security appropriate to the risk of processing the personal data. We monitor our systems for possible vulnerabilities and attacks. However, no data transmission over the internet can be guaranteed to be 100% secure. Accordingly, despite our efforts to protect the individual’s personal data, we cannot ensure or warrant the security of any information that the individual transmit to us, or to or from our products and services. All such transmission of information is carried out at the individual’s own risk. However, once we receive the individual’s transmission, we will make reasonable efforts to ensure its security in our systems.
The personal data will be stored for such period as may be necessary to fulfil the purposes stated above after which the Group will cease to retain the personal data, or remove the means by which the data can be associated with the individual, as soon as it is reasonable to assume that such retention no longer serves the purposes for which the personal data was collected, and is no longer necessary for any legal or business purpose.
2.7 Data Breach Notification
While the Group is committed to ensuring the security of the individual’s personal data, in the event the Group determines or has reason to believe that a personal data breach has occurred which has caused or is likely to cause significant harm to the individual, the Group shall notify the affected individual and the personal data protection commissioner without undue delay and undertake all reasonable steps to rectify the breach.
In the event the individual becomes aware of, suspects, or anticipates the likelihood of a personal data breach, the individual is advised to promptly notify the Group’s data processing officer in accordance with the manner set out in Clause 5.1 without undue delay.
3. DISCLOSURE OF PERSONAL DATA
3.1 Our Affiliates
Personal data provided to the Group may be processed by our Affiliates (in or outside of Malaysia).
In this Notice, “Affiliate” means, with respect to any entity, any other entity controlling, controlled by or under our common control. For the purpose of this definition, "control" (including the terms "controlling", "controlled by" and "under common control with") means the possession, direct or indirect, of the power to direct or cause the direction of the management and policies of the entity in question, whether through the ownership of voting securities, by contract or otherwise and “Affiliates” shall be construed accordingly.
3.2 Classes of Third Parties
Personal data may be disclosed to relevant third parties (in or outside of Malaysia) as required under law, pursuant to relevant contractual relationship (for example, where we appoint third party service providers) or for the purposes stated in Clause 2.5 above (or directly related to those purposes).
Personal data may, from time to time, be disclosed to the following classes of third parties:-
(i) our related corporations, agents, contractors, official partners and employees who assist to provide the products and services, and/or address the individual’s queries and requests in relation to our products and services, the individual’s accounts and billing or order arrangements with us, or for customer support, service improvement, development, processing or storage;
(ii) third parties appointed by us to provide services to us or on our behalf (such as banks or financial institutions, software vendors, auditors, lawyers, company secretary, consultants, contractors, professional advisors, printing companies, conference/training/event organizer, payment gateway providers, other advisers, insurance companies, investigators, service providers who provide operational services in connection with our business such as courier/logistic services, marketing, telecommunications, debt collection, administration services, customer services, information technology providers, web hosting, data analysis, payment and billing processing, technical services, call centre, security or other services to us, etc);
(ii) our business partners or Affiliates who may jointly provide the service and/or products requested for;
(iv) utility companies;
(v) law enforcement agencies, government authorities, tax authorities, courts, tribunals, regulatory bodies, statutory agencies or bodies, local council and/or industry regulators to detect, prevent, or otherwise address fraud, security or technical issues;
(vi) financial institutions, such as banks and/or credit card companies for purposes of collection or refund of any monies due or payable in connection with the individual’s commercial transactions with us;
(vii) in connection with an actual or potential merger, sale, acquisition, investment, assignment, reorganisation, joint venture, or transfer of all or part of our business, assets, affiliates, including if we should ever file for bankruptcy or a related proceeding, provided that we inform the relevant third party it must use the personal information only for the purposes disclosed in this Notice; and
(viii) any other person with the individual’s consent to the disclosure.
3.3 Disclosure Without Consent
The Group may collect, use or disclose an individual’s personal data without his/her consent in the following circumstances:
(i) the collection, use or disclosure is necessary to respond to an emergency that threatens the life, health or safety of the individual or another individual;
(ii) the personal data is publicly available;
(iii) the collection, use or disclosure is necessary for any purpose which is clearly in the interests of the individual, if consent for his/her collection, use or disclosure cannot be obtained in a timely manner;
(iv) the collection, use or disclosure is necessary for any investigation or proceedings;
(v) the collection, use or disclosure is necessary for evaluative purposes; and/or
(vi) in any other circumstances set out in the PDPA.
4. RIGHT TO ACCESS, CORRECT AND TRANSMIT PERSONAL DATA
4.1 An individual have the right and shall be given access to the personal data held by the Group and correct the personal data where in personal data is inaccurate, incomplete, misleading or not up-to-date. In this respect, the individual may in writing:-
(i) check whether we hold and process his/her personal data;
(ii) request access to such personal data;
(iii) request correction of wrong personal data;
(iv) request explanation on our policies and procedures in relation to personal data handled by us;
(v) communicate to us his/her objection to the use of his/her personal data for marketing purposes; and
(vi) withdraw, in full or in part, his/her consent given previously subject to applicable legal requirements/restrictions, our contractual obligations and a reasonable time frame.
Prior to providing the access or making the correction to the individual, the Group may require the individual to provide the necessary information to verify his/her identity.
4.2 An individual also have the right to request the Group to transmit the personal data to another data controller by giving a notice in writing by way of email to our data processing officer (the details of which are stated in Clause 5.1 below) subject always to the technical feasibility and compatibility of the data format of the personal data. Upon receiving the individual’s valid request, the Group will carry out the transmission of the personal data within the prescribed period.
4.3 Please note that if the individual communicates his/her withdrawal of his/her consent to our use or disclosure of his/her personal data for the purposes and in the manner as stated above, or request the deletion or anonymisation of his/her personal data, we may not be in a position to continue to provide our products or services to him/her or perform on any contract we have with him/her, and we will not be liable in the event that we do not continue to provide our products or services to, or perform our contract with him/her. Our legal rights and remedies are expressly reserved in such an event.
4.4 The individual is responsible for informing us about any changes to his/her personal data to enable us to keep his/her data accurate and current.
4.5 Upon receipt of the individual’s request for correction of personal data, we will take reasonable steps to rectify the personal data which is inaccurate, incomplete and not up-to-date unless we consider there are justifications for refusing to comply with the individual’s request.
4.6 The individual will be liable for any loss that results from any failure to notify us of such a change as a result of undue delay, the individual’s gross negligence or fraud. Where the individual fails to inform of any change in his/her address, we shall be discharged from all liabilities upon sending of any notice or document to the last known address.
4.7 The Group reserves the right at any time to satisfy itself as to the individual’s identity and personal details provided including for the purposes of preventing fraud and/or money laundering and pending verification, the Group may withhold the individual’s access to his/her personal data. In addition, at the time of the individual’s application or at any time in the future, the individual authorises us to perform identity verification checks directly or using relevant third parties.
4.8 The Group aims to maintain the personal data in a manner that protects information from accidental or malicious destruction. As such, after an individual corrects, changes or updates information of his/her personal data, the Group may not immediately delete residual copies from its active servers and may not remove information from its systems.
5. LIMITING THE PROCESSING OF PERSONAL DATA, FURTHER ENQUIRIES AND CONTACT POINT
5.1 If an individual would like to obtain further information on how to limit the processing of his/her personal data, he/she may contact our data processing officer with details as follows:-
Department : Head of Department, Compliance Department
Tel : +603 - 3323 3330
Email Address : corporate@hippoholidays.com.my
Address : No.2, Jalan Bayu Tinggi 2/KS 6, Batu Unjur, 41200 Klang, Selangor Darul Ehsan. Malaysia.
5.2 Please include the name, identification number (IC number or passport number) and contact number in any of the written request which may be used to identify the individual.
5.3 If the individual would like us to cease processing his/her personal data in a specified manner, the individual is entitled to submit a written request for such restriction of the processing of his/her personal data. However, the withdrawal of consent will not affect the previous collection, use, processing or disclosure of the personal data by us for which the individual have already given consent.
5.4 The Group will take reasonable endeavours to comply with the individual’s request. We may however refuse to comply with the requests under circumstances as permitted by law.
6. COOKIES
6.1 The Group may use cookies, web beacons, tags, scripts, local shared objects such as HTML5 and Flash (sometimes called “flash cookies”), advertising identifiers (including mobile identifiers such as Apple’s IDFA or Google’s Advertising ID) and similar technology (“Cookies”) in connection with the individual’s use of the Group’s website (“Website”). Cookies may contain unique identifiers and may be stored in various locations, including (but not limited to) the device used by the individual to access the Website, within emails sent by the Group to the individual, and on the Website. Cookies may transmit information about an individual and the individual’s use of the Group’s products and/or services, such as the individual’s browser type, search preferences, IP address, data relating to advertisements displayed to or clicked on by the individual, and the date and time of the individual’s access or use. Cookies may be either persistent or session-based.
6.2 The Website is secured with Secure Sockets Layer (SSL) encryption to help protect the transmission of data between the individual’s browser and the Group’s servers. This encryption helps ensure that any personal data submitted via the Website is securely transmitted and protected from unauthorised interception. The individual may verify the security of his/her connection by checking for a padlock icon in the browser’s address bar and confirming that the Website Uniform Resource Location (URL) begins with “https://”, indicating that a secure, encrypted connection is in place.
6.3 If the individual does not wish for the individual’s personal data to be collected via Cookies on the Website, the individual may deactivate Cookies by adjusting the individual’s internet browser settings to disable, block or deactivate Cookies, by deleting the individual’s browsing history and clearing the cache from the individual’s internet browser. The individual may also be able to limit the Group’s sharing of some of this information through the individual’s mobile device settings. However, it is important to remember that many of the services on the Website may not function properly if cookies are disabled.
7. TRANSFER OF PERSONAL DATA OUTSIDE MALAYSIA
7.1 It may be necessary for the Group to transfer the individual’s personal data outside Malaysia if any of our Affiliates, service providers or strategic partners (“overseas entities”) who are involved in providing part of our services are located in countries outside Malaysia or if the Group uses the services from a country other than Malaysia. The Group shall take reasonable steps to ensure that any such overseas entities are contractually bound not to use the individual’s personal data for any reason other than to provide the services they are contracted by us to provide and to adequately safeguard his/her personal data. The Group will not sell any raw data that contains the individual’s personal data.
8. CONFLICT
8.1 In the event of any conflict between this English language Personal Data and Privacy Notice and its corresponding Bahasa Malaysia Personal Data and Privacy Notice, the terms in this English language Notice shall prevail.
9. RIGHTS TO MAKE CHANGES
9.1 The Group reserves the right at any time and at its sole discretion to revise, change, alter or vary the contents and terms and conditions of this Notice as herein contained. The Group will notify the individual of such revision, modification or change by emails or other methods deem fit by the Group.
