Privacy Policy

This policy is also available in Bahasa Melayu: Baca Dasar Privasi dalam Bahasa Melayu.

Last updated: 4 October 2026

This Privacy Policy explains how Asia Green Travel Sdn Bhd (“Asia Green Travels”, “we”, “us”) collects, uses, shares, stores and protects personal data when you use this website, send an enquiry, contact us by email, phone or WhatsApp, or ask us to arrange tours, accommodation, transfers and other travel services in Sabah. It is our written notice to you under Malaysia’s Personal Data Protection Act 2010 (Act 709), as amended (the “PDPA”).

By submitting an enquiry or booking request, you agree that we may use the information you provide, as described in this policy, to respond to you and arrange the travel services you ask for.

• We collect information you send to us, such as your name, contact details, travel dates, number of travellers, pickup point and your message.
• We use it to reply and arrange services, including tours, accommodation at our own properties and with partner providers, transfers and guides.
• We share details only when needed with the property, guide, transport provider or park operator involved in your request, and with the service providers that run our website and email. We never sell your personal data.
• Analytics cookies are optional. They are used only if you accept them in our cookie banner, and you can change your choice at any time.
• You are in control. You can ask to access, correct or delete your data, or withdraw your consent. Email info@asiagreentravels.com with the subject “Personal Data Request” and we will respond within 21 days.

We collect only what we need to handle your enquiry and arrange your travel. Most of it comes directly from you.

Booking enquiry form (on our tour pages)

• Required: first and last name, mobile / WhatsApp number, email address, preferred travel date, pickup point and number of adults.
• Optional: room preference, dietary requirements, number of children, and your message or special requests.

Contact form

• Required: full name, email address and your message.
• Optional: phone / WhatsApp number, tour or destination of interest, preferred travel date and number of travellers.

We need the required details to reply to you, check availability and prepare a quote. If you leave them out, the form cannot be sent and we cannot deal with your request through the website, but you are always welcome to email, call or WhatsApp us instead. Optional details help us plan, and you can leave them blank. Both forms also ask you to confirm that you have read this policy and agree to us using your details for your enquiry.

Other information you give us. If you email, call or WhatsApp us, or go ahead with a booking, we keep your name, contact details, travel details (such as hotel pickup, flight details and the names and number of people travelling) and the messages you send, so that we can arrange your trip. If you give us details of other travellers, please make sure they know you are sharing them with us.

Health, dietary and accessibility information. You may choose to tell us about dietary needs, allergies, medical conditions or mobility needs. Health information is “sensitive personal data” under the PDPA. Please share only what we need to look after you. By giving it to us, you give your explicit consent for us to use it only to prepare and run your trip, and to share it only with the property, guide or provider who needs it. You can withdraw this consent at any time, although we may then be unable to cater for those needs.

Payments. We do not collect card or bank account details through this website. Payments are made off-site by bank transfer (Alliance Bank) or through PayPal. We keep only what we need to match and record your payment, such as the payer’s name, amount, date and reference.

Collected automatically. When you visit the website, we and our service providers receive technical information such as your IP address, browser and device type, and the pages you visit. See “Cookies and Website Analytics” below.

We use personal data for practical travel and customer-service purposes, including to:

• Respond to enquiries and booking requests.
• Check tour, room, transfer or guide availability and prepare quotes.
• Arrange accommodation, tours, transport, guides and related travel services, at our own properties and with partner providers.
• Confirm pickup, drop-off, meeting point and guest details, and cater for any dietary, health or accessibility needs you have told us about.
• Send booking-related messages, updates or follow-up information.
• Receive and record payments and keep proper accounts.
• Meet our legal obligations, such as accounting, tax and Tourism Tax record-keeping, and lawful requests from authorities.
• Keep our website and forms secure and protected from spam.
• Understand how the website is used, as statistics, so we can improve it (only if you accept analytics cookies).
• Handle feedback, complaints and disputes.

We use your data with your consent, or where it is necessary to take the steps you ask for before a booking, to carry out a booking, or to comply with the law, as the PDPA allows. We will not use your data for an unrelated purpose without telling you first and, where required, asking for your consent. We do not send marketing messages unless you have asked to receive them, and you can stop them at any time.

We share personal data only when needed, and only as much as is needed. We do not sell personal information, and we do not share your details with unrelated third parties for their own marketing.

Depending on your request, we may share relevant details with:

• Our properties and partner providers: Borneo Sepilok Rainforest Resort, Borneo Natural Sukau Bilit Resort, Hotel Hsiang Garden and Kolapis Water Village, and the partner hotels, lodges, guides, boat operators, transport providers, restaurants and park or permit operators involved in your trip. We share details with them only to provide the tours, stays and transfers you ask for, and they receive only what they need, such as names, travel dates, group size, pickup details and any relevant dietary or health needs.
• Service providers who process data on our behalf: our website and email hosting provider, A2 Hosting, which stores form entries and our email; Google (Google Analytics, Google Maps and Google Fonts); and Intuitive Machines, Inc. (hCaptcha spam protection). They may use your data only to provide their services to us.
• Payment providers: Alliance Bank and PayPal, when you choose to pay through them. They handle your payment under their own terms and privacy policies.
• Messaging services: if you choose to contact us on WhatsApp, your messages are carried by WhatsApp (Meta) under its own terms and privacy policy.
• Authorities and professional advisers: government agencies, the police, the Royal Malaysian Customs Department (for Tourism Tax), courts or regulators where the law requires or permits it, and our accountants, auditors or lawyers, who owe us a duty of confidentiality.

Cookies are small files that a website stores on your device. Our website uses the following:

• Google Analytics 4 (Google LLC), added through the MonsterInsights plugin. It shows us, as statistics, which pages are visited, how long visits last, the type of device and browser used, the general location (country or city) and how visitors found us. It sets cookies such as _ga and _ga_G5FQZGKV08, which can last up to 2 years. We do not use it to identify you, and Google Analytics 4 does not store IP addresses. Analytics data is kept for 14 months.
• hCaptcha (Intuitive Machines, Inc., United States) protects our forms from spam and bots. To check that a real person is sending the form, it processes information such as your IP address, browser and device details and how you interact with the page, and it may use cookies or similar technologies. It is needed for the forms to work securely. See the hCaptcha Privacy Policy.
• Google Maps: our Contact page shows an embedded Google Map. When the map loads, Google receives your IP address and may set its own cookies.
• Google Fonts: our pages load typefaces from Google’s servers, so Google receives your IP address and browser details when you view the website. See the Google Privacy Policy.
• Essential cookies: short-lived technical cookies that keep the website working and secure and remember your cookie choice. They are not used to track you.

Your choice. When you first visit, a cookie consent banner lets you accept or decline analytics cookies. Analytics cookies are set only if you accept them, and you can change your choice at any time through the cookie settings on the website.

You can also block or delete cookies in your browser settings, or install the Google Analytics Opt-out Browser Add-on to stop Google Analytics recording your visits on any website. Declining analytics cookies will not affect how the website works. If you block hCaptcha, our forms may not send, but you can still reach us by email, phone or WhatsApp.

We keep personal data only for as long as it is needed for the purposes in this policy or as required by law. After that, we delete or anonymise it.

• Enquiries that do not lead to a booking: deleted within 12 months of our last contact with you.
• Website form entries stored on our website: cleared after 12 months.
• Booking, payment and accounting records: 7 years, as required for tax, accounting and Tourism Tax purposes.
• Health and dietary notes: deleted after your trip.
• Google Analytics data: 14 months, then deleted automatically.
• Website backups: overwritten on our normal backup cycle.

If there is a complaint, dispute or legal claim, we may keep the relevant records until it is resolved.

We take practical steps to protect personal data from loss, misuse, unauthorised access, alteration or disclosure. These include encrypted (HTTPS) connections for our website and forms, limiting access to the people who need the information to handle enquiries, bookings and operations, spam and bot protection on our forms, regular software updates and backups, and using service providers who are bound to keep data secure.

No website, email or messaging service can be guaranteed completely secure. Please do not send passport scans or card numbers through our forms or by email, and contact us if you believe your information has been sent to us by mistake.

Data breaches. If a personal data breach happens, we will act promptly to contain it and reduce any harm. Where the PDPA requires it, we will notify the Personal Data Protection Commissioner within 72 hours and inform the people affected without unnecessary delay, explaining what happened and what they can do.

Under the PDPA, you have the right to:

• Access: ask whether we hold personal data about you and get a copy of it.
• Correction: ask us to correct data that is inaccurate, incomplete, misleading or out of date.
• Withdraw consent: withdraw your consent to our use of your data at any time. This does not affect what we did before you withdrew. If we need the data to handle a booking or meet a legal duty, we will explain what withdrawing means for you.
• Limit processing: ask us to stop or limit using your data, including for any direct marketing.
• Data portability: ask us to send your data to you or to another organisation in a commonly used format, where technically feasible.
• Deletion: ask us to delete data we no longer need, unless the law requires us to keep it.

How to make a request. Email info@asiagreentravels.com with the subject “Personal Data Request”, or contact us by phone or WhatsApp. Our designated person at Asia Green Travel Sdn Bhd will handle your request. We may need to verify your identity first. We will respond within 21 days of receiving your request, as the PDPA requires; if we need more time, we will tell you in writing before then and explain why. We do not normally charge. For an access request, the law allows a small fee, never more than the prescribed maximum, and we will tell you before charging anything. Some information may need to be kept for booking, accounting or legal reasons.

Complaints. If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Personal Data Protection Commissioner, Malaysia: www.pdp.gov.my.

For privacy questions or personal data requests, please contact the designated person at Asia Green Travel Sdn Bhd (Asia Green Travels):

• Email: info@asiagreentravels.com (subject: “Personal Data Request”)
• Phone / WhatsApp: +60 16-841 1414
• Address: Batu 1 1/2, Jalan Leila, c/o Hsiang Garden Hotel, Sandakan 90717, Sabah, Malaysia

We may update this Privacy Policy from time to time to reflect changes in our website, services, legal requirements or operational practices. The latest version will always be posted on this page with the “Last updated” date shown above. If we make a significant change to how we use your personal data, we will take reasonable steps to let you know.

Contact our team if you need help with a privacy request or want to understand how your enquiry details are handled.