Privacy Policy

Introduction and Scope

Tropical Charters Sdn Bhd, trading as "Mystravels" (“we”, “us”, “our”), is committed to protecting and respecting your privacy and complying with all applicable data protection laws.

This Privacy Policy sets out the basis and terms upon which Mystravels processes your personal data. This policy applies when you interact with us on our website (https://www.Mystravels.com) and/or the Mystravels App (together, “Mystravels Platform”), use services offered by Mystravels or our Operators through the Mystravels Platform (“Mystravels Services”), or collaborate with us to offer Mystravels Services.

Mystravels is wholly owned and operated by Tropical Charters Sdn Bhd, with its registered address at Lot 39, Kg Padang Ragut, Jalan Ulu Melaka, Mukim Ayer Hangat, 07000, Langkawi, Malaysia.

Please read this Privacy Policy carefully. Should you have any questions, you may direct them to contact@Mystravels.com. Data protection laws in certain countries and regions may require us to provide additional information, which you will find further below if applicable.

1. Collection of Personal Data

Mystravels collects personal data from you in the following ways:

2. Types of Personal Data Collected

Depending on your access and use of the Mystravels Platform, Mystravels may collect and process some or all of the following types of personal data:

• Identification information and contact details: Such as your first name and surname, date of birth, email address, phone number, postal address, country and region of residence. This information is often collected during user account creation or when signing up to become an Operator.
• Booking information: This includes your passport information (numbers, expiry date), nationality, government-issued identifiers, frequent flyer program membership number, Mystravels Credits, certification/qualification (e.g., diving certification, driving licenses), necessary billing and payment information (credit card details, billing address, bank account numbers), and insurance information.
• Travel preference and itinerary details: Information like your chosen destinations, flight details, accommodations, activities, and details relating to previous purchases and bookings.
• Health information (in exceptional cases only): Such as medical certificates or doctor notes, specifically when relevant to an individual’s health in relation to attending booked Mystravels Services.
• Content uploaded: This includes images (e.g., facial photographs), videos, recordings, and comments that you upload to the Mystravels Platform.
• Communications: Records of communications between Mystravels and you, or between you and Operators, which may occur via the Mystravels Platform, email, instant messaging, social media, or other channels.
• Survey information: Your feedback on and responses to surveys conducted relating to the Mystravels Services.
• Device information and technical data: Such as your IP addresses, device data, device type, unique device identification, device MAC address numbers, clickstream data, timestamp, cookie-IDs (including other tracking technologies), pages visited, and previous or subsequent sites visited.
• Location data: Information inferred from your IP address, name of telecommunication operator/carrier, SIM region and network, and other geo-positioning data.
  
  • When using mobile devices to visit the Mystravels Platform, we may collect location information if you have consented and configured your device to send us such data, or if you upload photos with location information.
  • This location information may be used to suggest nearby services during your travel or provide personalised content.
  • You can change your mobile device’s privacy settings at any time to deactivate location sharing. Please note that some features of the Mystravels Platform may be affected if you turn off this function.

3. Use of Personal Data

Mystravels processes your personal data for the following purposes:

• To manage your user account: Facilitating the creation and amendment of your user account on Mystravels Platform.
• To provide Mystravels Services to you: Fulfilling your reservations, rentals, and/or bookings; sending confirmations and reminders; ensuring eligibility for high-risk activities (e.g., diving, paragliding); notifying you of modifications to bookings; providing information and options about relevant insurance products; facilitating your purchase and claims of insurance products; and liaising with insurance providers on your behalf.
• To verify identity: In connection with the Mystravels Services you purchased.
• For marketing purposes: Providing you with marketing messages from Mystravels, as explained in more detail in section 5 below.
• For feedback and market research: Contacting you for feedback and responses to surveys conducted by Mystravels relating to your use of Mystravels Platform.
• To provide customer support: Responding to your enquiries and requests, troubleshooting, and providing assistance.
• To improve Mystravels Platform and the Mystravels Services: For enhancing Mystravels Services and ensuring the Mystravels Platform functions correctly and in accordance with your preferences.
• To comply with legal obligations and for administrative purposes: Verifying and processing payments, issuing invoices, screening against fraud, abusive bookings, money laundering, and other criminal activities; for accounting, billing, and audit purposes; developing, maintaining, and testing our systems; for claims handling; and for understanding, exercising, enforcing, or protecting our legal rights and those of others.

Voluntary Provision of Personal Data

• Providing your personal data to Mystravels is always on a voluntary basis.
• By providing us with your personal data, you consent to Mystravels collecting, using, disclosing, and/or processing your personal data as set out in this Privacy Policy, unless an exception under the law permits Mystravels to do so without consent.
• However, if you choose not to provide us with certain personal data, we might not be able to provide you with certain Mystravels Services. For example, we cannot open your user account or make reservations, rentals, and/or bookings for you if we do not collect your name and contact details.

4. Sharing of Personal Data

Mystravels will share some of your personal data with third parties, who may be located outside your home country or region, as described below:

• Operators: Mystravels may share your personal data with Operators (including but not limited to tour operators, activity providers, restaurants, shops, transportation companies, hotels, car rental companies, insurance companies, intermediaries) so they can deliver or provide Mystravels Services and complete your reservations, rentals, and/or bookings.
• Mystravels group companies: Your personal data may be shared with other Mystravels group companies to be used on our behalf for the purposes set out in section 3 (e.g., for processing payments).
• Third-party service providers: Mystravels may engage third-party service providers to use personal data on our behalf to fulfil the purposes and perform activities set out in section 3, such as web hosting, cybersecurity services, data analysis, payment services, marketing, market research, and customer support services.
• Government and regulatory bodies: Your personal data may be disclosed to governments and regulatory authorities, and to other individuals, bodies, and organisations (e.g., dispute resolution, law enforcement, legal advisors, auditors, fraud check organisations) for the purpose of complying with our legal obligations, as required by applicable law and/or court order, and to protect the rights and property of Mystravels.
• Corporate reorganisation: In the event of a corporate transaction (e.g., sale, merger, acquisition, or other corporate restructuring), Mystravels may disclose your personal data to the new controlling entity or its authorised third party for carrying on our business.
• Other third parties: In any other case, to any third parties with your prior written consent or otherwise in accordance with applicable laws.

Your personal data will not be sold, transferred, or communicated to parties other than to the parties listed above.

Mystravels may share aggregate, pseudonymous, or anonymous information with other third parties, including advertisers. Such information does not contain any personal data and will not directly identify you. However, it is possible that these third parties may possess information about you or obtain your information from other sources, and when combined with Mystravels’s aggregate information, they may be able to identify you personally. In such cases, it is their responsibility to inform you, and their privacy policies will apply.

5. Marketing

• Mystravels may use your personal data for direct marketing purposes, such as sending you new deals, special savings, and promotions.
• We may also use your personal data to analyse your preferences and trends and derive insights, which we may use to tailor the types of services and offers that we present to you.
• We also use advertising services and products provided by third-party service providers (such as marketing agencies and social media platforms) for marketing and promotional purposes, which may involve us sharing personal data that we hold about you with them.
• We may send direct marketing communications to you by post, telephone, or online (including by email or through your mobile device) and, where required, we will ask you for your consent at the time we collect your data.
• You may withdraw your consent at any time. Mystravels provides an option to unsubscribe or opt out of further communication on any direct marketing communication sent to you. You may also withdraw your consent by contacting Mystravels at contact@Mystravels.com, or by filing a written request to Tropical Charters Sdn Bhd at Lot 39, Kg Padang Ragut, Jalan Ulu Melaka, Mukim Ayer Hangat, 07000, Langkawi.

6. Data Security

• Mystravels implements appropriate technical and organisational measures to protect your personal data in accordance with applicable data protection laws.
• However, we cannot guarantee that data transmission over the Internet is secure from intrusion.
• The personal data we collect from you may be stored in our servers or the servers of our third-party service providers. Mystravels maintains appropriate physical, electronic, and organisational procedures to ensure that your personal data is stored securely and protected against unauthorised access or unauthorised alteration, disclosure, or destruction.
• We endeavour to anonymise or aggregate your data if we intend to use it for analytical purposes or trend analysis.
• All payment transactions carried out by us or our chosen third-party provider of payment processing services will be encrypted using online encryption technology.
• You are responsible for keeping any information that we send to you confidential and for complying with any other security procedures we notify you of; in particular, you should keep your chosen password confidential and not share it with any third party.

7. International Transfer of Data

• Your personal data may be transferred to, stored, and processed outside of your home country or region, including countries and regions that have different data protection standards.
• We have taken appropriate steps and put safeguards in place to ensure that any access, processing, and/or transfer of your personal data remains protected to a level at least comparable to your home country or region.

8. Data Retention

• Mystravels will only retain your personal data for as long as is necessary to serve the purposes as set out in section 3, or to comply with the relevant legal requirements.
• When it is no longer necessary for us to process your Personal Information, we will either securely delete or anonymise the data.

9. Cookies

• Cookies and other tracking technologies are used by Mystravels to make the Mystravels Platform work more efficiently, to provide the Mystravels Services, and to personalise content.
• When you visit the Mystravels Platform, Mystravels and/or third parties may process some of your personal data transmitted by your device or browser via cookies.

10. Your Rights

You have the following rights regarding the personal data that Mystravels holds about you:

• Right to Access: You have the right to access personal data that Mystravels holds about you and request Mystravels to send you a copy of such personal data processed. We may charge a reasonable fee for processing any data access request in accordance with the applicable data protection laws in your country or region.
• Right to Rectification: You have the right to correct any personal data that is inaccurate or incomplete.
• Right to Withdraw Consent: You have the right to withdraw consent and request that Mystravels stops using and/or disclosing your personal data for any of the purposes listed under sections 3 and 5. Please note that exercising the right to withdraw consent does not affect Mystravels’s right to continue to collect, use, and disclose personal data where such collection, use, and disclosure without consent is permitted or required under applicable data protection laws.
• Right to Object to Direct Marketing: If you object to processing for direct marketing purposes, your personal data shall no longer be processed for such purposes.

To exercise these rights, you may contact Mystravels at contact@Mystravels.com or file a request in writing to our privacy team at Lot 39, Kg Padang Ragut, Jalan Ulu Melaka, Mukim Ayer Hangat, 07000, Langkawi.

• Upon receipt of your written request, Mystravels may require reasonable time (depending on the complexity of the request and its impact on our relationship with you) for your request to be processed and for Mystravels to notify you of the consequences of us acceding to the same, including any legal consequences which may affect your rights and liabilities to us.
• Depending on the nature and scope of your request, Mystravels may not be able to continue providing our goods and services to you, and Mystravels shall, in such circumstances, notify you before completing the processing of your request.
• You also have the right to lodge a complaint about our processing of your personal data with the data protection authority in your country or region.

11. Links to Third-Party Websites

• There may be links present on the Mystravels Platform which could result in you leaving the Mystravels Platform and/or being redirected to other third-party websites.
• You should note that any personal data you provide to these third-party websites is not protected by this Privacy Policy but is covered by the privacy policies available on such third-party websites.
• Mystravels is not liable for any losses, damages, costs, or expenses which you may suffer or incur in connection with you providing or making available personal data or other data to such third-party websites.

12. Region-Specific Privacy Rights

EUROPE (If you are based in the European Economic Area (EEA))

• Special Categories of Personal Data: Mystravels collects special categories of personal data, such as health-related data (as outlined in section 2). If necessary, we will require your explicit consent for such processing in accordance with European data protection law (including GDPR).
• Legal Bases for Use of Personal Data: European data protection law requires us to link each purpose identified under section 3 of the Privacy Policy to a specific legal basis.

Profiling and Automated Decision Making:

• Profiling: This refers to the automated processing of personal data to evaluate certain personal aspects relating to you, in particular to analyse or predict aspects concerning your personal preferences. We engage in profiling activities to enhance the quality of our services and to provide you with personalised experiences and offerings.
• Automated decision-making: This occurs when an electronic system uses your personal data to make a decision without human intervention. We utilise automated decision-making in our operations to make decisions more efficiently and to ensure you receive swift responses to your requests and inquiries. This may include personalised experiences and offerings.
• Export Outside of the EEA: Your personal data may be transferred outside of the EEA. If such transfer takes place to a country or region that does not provide an equivalent level of protection, Mystravels will use reasonable endeavours to ensure that appropriate safeguards are in place. Such safeguards include (i) standard contractual clauses of the European Commission, or (ii) the EU-US, Switzerland-US, EU-UK privacy shield.
• Your Additional Rights: In addition to the rights set out in section 10, you also have the following rights under European data protection law:
  
  • Right to erasure: In certain circumstances, you have the right to ask Mystravels to erase your personal data.
  • Right to restriction of processing: In certain situations, you have the right to ask Mystravels to restrict the processing of your personal data.
  • Right to object: You have the right to object to the processing of your personal data by Mystravels when that personal data is processed on the basis of legitimate interest. Mystravels shall then no longer process this personal data unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights, and freedoms or for the establishment, exercise, or defence of legal claims on behalf of Mystravels.
  • Right to data portability: You have the right to receive the personal data concerning you, which you have provided to Mystravels, or request to provide your personal data to a third party.
  • Right to withdraw consent: Where the processing of your personal data under this Privacy Policy is based on consent, you have the right to withdraw your consent at any time.

You may exercise these rights by contacting Mystravels at the contact details set out in section 10 of this Privacy Policy. Please note that we do not charge a fee when we deal with your requests in exercise of any of these rights, and Mystravels will aim to respond to your requests in due course.

In addition, if you believe your data protection rights are not being respected, you can lodge a complaint at your local competent authority or file a complaint with the competent data protection authority.

UNITED STATES (If you are based in the US)

• Sensitive Personal Information: Some of the personal data we collect may be considered “sensitive personal data” under US data protection laws. Where we collect sensitive personal data (such as health-related information), this data is only collected where relevant to the services we provide and in accordance with applicable laws. We will not collect sensitive personal data without your consent. If you do not provide consent, you will not be able to participate in the relevant services.
• Sale Disclosure: Mystravels does not sell your personal data or transfer personal data to third parties to use for their own benefit. However, we may allow certain companies to place tracking technologies, like cookies, on our websites. Those companies receive information about your interaction with our websites that is associated with your browser or device and may use that data to serve you relevant ads on our websites or others. For more information, please see sections 4 and 9 above.
• Your Additional Rights: Where required by local law, you may have additional rights under applicable laws in the US state in which you live. You may have the right to access, request a copy of, update, transfer or port, restrict the processing of, or request that we delete your personal data. You may also have the right to object to our processing of your personal data in certain instances. To exercise these rights, please email us at contact@Mystravels.com. When we receive a request to exercise one of these rights, we will indicate what personal data we require from you to validate your identity, and you have the right to appeal a denial of your request.

13. Updates to the Privacy Policy

• This Privacy Policy is dated 08/06/2025. This Privacy Policy is originally in English, and translations are provided for convenience. In case of any conflict, the English version will prevail.
• Mystravels, a Hong Kong incorporated company at Lot 39, Kg Padang Ragut, Jalan Ulu Melaka, Mukim Ayer Hangat, 07000, Langkawi, Malaysia, reserves the right to update, amend, or modify the terms of the Privacy Policy from time to time at its sole discretion.
• When substantive changes are made to the Privacy Policy, Mystravels will provide you with an updated version via the website or the app, or Mystravels may choose to inform you of such changes by email.
• Mystravels will change the date set out above so that you stay informed of the most recent changes. Mystravels recommends regularly checking the available Privacy Policy.