GENERAL PRINCIPLE (S.6 OF PDPA)

Rebak Island Marina Berhad operating as ‘Rebak Island Resort & Marina’ (“the Hotel”), its shareholders, associates, jointly controlled entities and affiliates (collectively referred to as “the THR Group”), respect the privacy of individuals with regard to personal data.

This Privacy Notice is formulated in accordance with the Personal Data Protection Act 2010 (“Act”). For the purpose of this Privacy Notice, “Personal Data” shall have the meaning as ascribed to it in the Act, “we” and “us” shall refer to any of the companies within the THR Group and “you” shall refer to yourself and/or such other persons or companies represented by you of which you are providing the Personal Data.

Your consent for us to process your Personal Data is important to us. We collect your consent in the following manner:

• By using the Website or other online channels;
• By giving consent in writing to us physically during your interactions with us.

Upon receiving your consent in writing, we will proceed to collect your Personal Data in accordance with this Privacy Notice.

By using our website (‘’Website”) and/or willingly providing information to us, upon accessing this Privacy Notice and upon receiving your voluntary consent, you are deemed to have consented to us in writing in processing your Personal Data, which may include Personal Data that relates to your identity (including your name, title, National Registration Identification Card/Passport details, gender, nationality, marital status and date of birth); your contact information (including your telephone numbers, email and mailing addresses), payment information (including but not limited to payment card numbers, billing address and bank account information), sensitive personal information under the privacy laws of some jurisdictions (e.g. food allergies, medical conditions, biometric information, credit card information, location data depending on the definition of sensitive personal information under the relevant jurisdiction).

The sensitive information will only be processed if and to the extent permitted or required by applicable law (e.g. so that we can ensure we tailor our services to you accordingly in terms of food allergies and medical conditions and etc). This would extend to all forms of information collated during your stay with us. However, in view that this information is not mandatory, you may opt not to provide us with such information.

This Privacy Notice applies to the Personal Data we collect through:

Online collection:

Websites owned or controlled by us, web and mobile applications, social media pages, HTML-formatted email messages, Wi-Fi connectivity and other digital channels; and

Physical interactions:

when you visit or stay as a guest at one of our properties, attend events and activities hosted by us, reach out to our call center, or through other offline interactions.

Collectively, we refer to the above as our “Services.”

How we collect your data

We collect your information in a number of ways, potentially over an extended period of time.

Offline collection

• When you visit or stay as a guest at our hotel, we will collect registration information at check-in.
• We will also collect information when you call our hotel telephone operators or contact our hotel sales agent.
• When you or your attendees attend banquets, weddings, meetings, seminars or other activities in our hotel, our hotel may take photos or capture the atmosphere of the event.

During your stay, we may collect information you share with our teams including your preferences, as well as information collected as part of our standard hotel safety and security processes (CCTV, key card logs and other security systems).

Online collection

If you use our Website to make a reservation, we receive and store the information you enter through our secure third-party booking engines. Some of this information is required (name, contact), but some is optional and for you to decide if you would like to share it.

We require payment information in order to guarantee a reservation. Should you be making a reservation on behalf of another person, we understand that you are permitted and authorized to offer their information and that it is accurate.

For restaurant reservations online, your information is collected by third party solutions providers that store your information and share your requirements with our hotels.

When you use our hotel Website, we will automatically collect anonymous data of your interactions during your Website visit, as well as automatically collecting general information such as which city/country you are accessing from and what browser or device type you are using, as is common for most websites.

We will collect your email address if you subscribe for our hotel newsletter or other communication channels on our websites.

When you sign up for any of our Hotels loyalty programs, your registration will include information that we will use to offer the benefits to which members are entitled.

Third parties may share your information with us. This may include information from your travel agent or airline.

NOTICE & CHOICE PRINCIPLE (S.7 OF PDPA)

Where applicable, we will process your personal data for the following purposes:

To facilitate your reservation for stay or events and all other processes, including but not limited to the registration process for activities in relation to your stay at our Hotel, in relation to your stay at our hotel;

• For general contact purposes;
• For billing and payment purposes;
• For verification, security and access;
• For internal administrative purposes including auditing, accounting, tax and data analysis;
• For maintenance of customer databases and customer service-related purposes including but not limited to membership programs;
• To respond to any enquiries and complaints, including to obtain feedback;
• To comply with legislative and statutory requirements;
• To protect or enforce our rights including to recover any debt owing to us
• To investigate complaints and suspected suspicious transactions;
• For general administrative and management purposes; and
• For all other purposes in relation or incidental to the above.

We may disclose your personal data to the following parties (including those within and outside Malaysia):

• to organisations which own, manage or operate the spas, restaurants, health clubs, and other outlets at our properties so they can provide their services;
• your agents and advisors (including but not limited to professional advisers) and any other person notified by and authorised by you;
• government agencies / statutory bodies/authorities;
• our assignees or potential assignees, acquirers or potential acquirers and successors-in-title;
• any person, who is under a duty of confidentiality who has undertaken the responsibility to keep such data confidential;
• Our related and associated companies and affiliates; and other parties, in respect of whom you have consented to the disclosure of your Personal Data;
• to third parties not affiliated with the THR Group when we have your consent to do so; and,
• to any third parties to the extent necessary with respect to a sale of all or part of our business operations or assets.

SECURITY PRINCIPLE (S.9 OF PDPA)

We implement reasonable administrative, organisational and technical safeguards and security measures to protect personal information within our control from unauthorized access, acquisition, disclosure, destruction or alteration, accidental loss, misuse or damage. We will review and monitor such safeguards and security measures occasionally.

RETENTION PRINCIPLE (S.10 OF PDPA)

To the extent permissible by applicable law, we will retain your Personal Data for such period as necessary to satisfy or to fulfil the following:

• the purposes for which that Personal Data was provided,
• an identifiable and ongoing business need, including record-keeping
• a specific legal or regulatory requirement, and/or
• a requirement to retain records that may be relevant to any notified regulatory investigations or active legal proceedings.

Where there is no sufficient justification to retain such Personal Data, such personal information will be safely and securely deleted, disposed of, anonymised and/or, where permitted by applicable law, blocked

DATA INTEGRITY PRINCIPLE (S.11 OF PDPA)

The THR Group uses a number of mechanisms to protect the security and integrity of your Personal Data.

ACCESS PRINCIPLE (S.12 OF PDPA)

Under the Act, you have the right of access to your Personal Data held by the THR Group on payment of a prescribed fee and you may request the THR Group to correct or update any of your Personal Data that is inaccurate, incomplete or out-of-date, subject to any applicable legal restrictions and contractual conditions.

If you have any questions regarding this Privacy Notice or if you wish to request access to your Personal Data or if you wish to correct or update your Personal Data or if you wish to withdraw your consent for the processing of your Personal Data, you may send your request in writing to the following address:

Address: Rebak Island Resort & Marina, Pulau Rebak Besar, 07000, Langkawi, Kedah.

Person in charge: PDPA Officer

Email: enquiry@rebakislandresort.com

Tel No: +604-9665566

Please note that notwithstanding the withdrawal of your consent, the THR Group may still proceed to process your Personal Data in circumstances recognised and permitted by law and as required under contractual conditions.

The THR Group reserves the right to charge you a reasonable fee for the processing of any data access request.

Language

This Privacy Notice is written in both the English Language and National languages. In the event of any inconsistency between the two versions of this Policy, the English version shall prevail.

Changes to Privacy Notice

The effective date of this current Privacy Notice is 1st January 2024. This Privacy Notice will be subject to change from time to time. Any changes to our Privacy Notice will become effective upon posting of the revised Privacy Notice on the Website. Use of the Website following such changes constitutes your acceptance of the revised Privacy Notice then in effect.