JOMhotel

PERSONAL DATA PROTECTION NOTICE

Effective Date: 21 July 2025

This Personal Data Protection Notice ("Notice") is issued by Bamboo Hospitality Travel Sdn. Bhd. (formerly known as Bamboo Hospitality Platform Sdn. Bhd.), including its subsidiaries, related and affiliated companies, joint ventures, and any of its authorised representatives, agents, and/or service providers (hereinafter collectively referred to as "JOMhotel", "we", "us", or "our") to all valued individuals, customers, partners, vendors, users, employees, clients, applicants and any other persons whose personal data is being processed by us in accordance with the Personal Data Protection Act 2010 [Act 709] of Malaysia ("PDPA").

This Notice is intended to inform you, as a data subject, of your rights in respect of your personal data that is being processed or that is to be collected and further processed by us and to notify you of the manner in which your personal data is collected, processed, disclosed, transferred and retained by JOMhotel.

1. Acknowledgement and Consent

1.1 By engaging with us, registering for or using our services, accessing our website(s) or platform(s), using our mobile application, entering into any agreement or contractual arrangement with us, or by otherwise voluntarily providing your personal data to us, you acknowledge that you have read and understood the contents of this Notice and hereby provide your explicit consent for the processing of your personal data in accordance with the terms and conditions set out herein.

1.2 Kindly note that we reserve the right to amend, modify, revise, or update this Notice from time to time as may be deemed necessary or appropriate to reflect changes in law, business operations, or privacy practices. The latest version of this Notice shall be made available on our website. Your continued use of our services or access to our website shall constitute your acknowledgement and acceptance of such amendments.

1.3 In the event that you do not agree with this Notice or any subsequent amendments, we may not be able to provide you with the full range of our services, and it may be necessary for us to discontinue our engagement with you.

2. Personal Data Collected

2.1 For the purposes of this Notice, the term "Personal Data" shall include any information in our possession or control that relates directly or indirectly to an individual, from which that individual may be identified or identifiable, whether from such information alone or in combination with other information to which we have or are likely to have access. This includes but is not limited to:

  • Full name
  • Identification number (NRIC/passport)
  • Contact details (telephone number, mailing address, email)
  • Date of birth, gender, nationality
  • Occupation, employer information
  • Financial information including bank account details
  • Travel preferences, booking history, loyalty programme data
  • Technical information (e.g. IP address, device ID); cookies and browsing behaviour

3. Sources of Collection

3.1 Your Personal Data may be collected by us through various means, including but not limited to:

  • Direct submission via our website, mobile application, email, or in-person interactions
  • Forms filled or submitted on our platform (e.g. registration forms, hotel listings)
  • Engagements at events, roadshows, surveys, contests or promotions conducted by us or our partners
  • Third-party referrals, partner programmes or affiliate networks
  • Cookies and automated tracking on our websites or digital platforms
  • Information obtained from credit reference agencies, regulators, government bodies, service providers or publicly available sources

4. Purposes of Processing

4.1 Your Personal Data is collected, processed and retained for the following purposes (collectively referred to as the "Purposes"), which may include but are not limited to:

  • Verifying your identity and performing necessary background checks;
  • Administering your registration and account with JOMhotel;
  • Managing, processing and fulfilling your hotel bookings and transactions;
  • Communicating with you on matters relating to our services or your engagement with us;
  • Processing payments, refunds, disbursements, commissions and accounting;
  • Responding to your queries, feedback, or complaints;
  • Facilitating onboarding and collaboration with hotel owners, vendors or business partners;
  • Sending marketing, promotional materials, newsletters, offers or other information (subject to your consent);
  • Conducting research, analytics, surveys, service improvement and statistical analysis;
  • Maintaining records for internal administrative, operational and audit purposes;
  • Managing loyalty or rewards programmes and promotional campaigns;
  • Preventing, detecting, and investigating fraud, security breaches or illegal activities;
  • Complying with applicable laws, regulatory requirements, court orders or lawful requests from authorities;
  • Enforcing contractual rights and obligations;
  • For recruitment, employment, or staff administration purposes;
  • Any other purpose necessary, ancillary, related or incidental to the above or any other purpose which is either expressly stated at the point of collection or as required or permitted under Malaysian laws.

5. Disclosure of Personal Data

5.1 Subject always to the PDPA and other applicable laws, we may disclose or share your Personal Data with the following categories of parties, including but not limited to:

  • Related companies, affiliates, joint venture partners and entities within our group;
  • Property partners, vendors or travel service providers to facilitate your bookings;
  • Banks, payment gateways, financial institutions and insurers;
  • Auditors, legal counsels, professional advisors, consultants;
  • Regulatory bodies, enforcement agencies, government departments and other authorities;
  • Outsourced service providers such as IT support, data centres, call centres, cloud storage providers, marketing agencies and courier companies;
  • Any party to whom you have authorised or consented to the disclosure;
  • Potential assignees, acquirers or successors in the event of merger, sale or transfer of business or assets.

5.2 We will take reasonable steps to ensure that such third parties are contractually bound to protect your Personal Data and to use it only for the intended purposes.

6. International Transfer of Data

6.1 Your Personal Data may be stored or transferred outside Malaysia for the Purposes set out herein, including to jurisdictions that may not have equivalent data protection laws. In such cases, we shall take reasonable steps to ensure that adequate safeguards are in place to protect your Personal Data in accordance with this Notice and the applicable laws.

6.2 By providing us with your Personal Data, you hereby expressly consent to such transfer, storage and/or processing outside Malaysia.

7. Retention of Personal Data

7.1 Your Personal Data will be retained only for as long as it is necessary to fulfil the purpose for which it was collected, or as may be required by law, regulation, or our internal policies.

7.2 When such data is no longer necessary or if you withdraw your consent, we will take reasonable steps to securely delete or anonymise your Personal Data.

8. Accuracy and Completeness

8.1 We rely on you to ensure that your Personal Data provided to us is accurate, complete, and up to date. It is your responsibility to notify us of any changes to your Personal Data.

8.2 You represent and warrant that all Personal Data provided by you is accurate and not misleading and that you have obtained the necessary consent for any third-party data submitted.

9. Your Rights Under PDPA

9.1 Subject to the provisions of the PDPA, you may:

  • Request access to your Personal Data;
  • Request correction or update of your Personal Data;
  • Withdraw (in whole or in part) your consent given previously to us;
  • Request us to cease direct marketing to you;
  • Make a complaint to the Personal Data Protection Commissioner.

9.2 Please note that we may charge a prescribed fee for processing your access request and may refuse access or correction where permitted to do so under the PDPA.

10. Cookies and Tracking Technologies

10.1 Our website and platform may use cookies, web beacons, and other similar technologies to enhance user experience, analyse site performance, and enable certain functionalities.

10.2 You may choose to disable cookies through your browser settings, but this may impact the usability of our services.

10.3 Information collected through cookies does not usually contain Personal Data, but where it does, we treat it in accordance with this Notice.

11. Children and Minors

Our services are not intended for individuals under the age of 18. We do not knowingly collect or process personal data of children without parental or guardian consent. If you are a parent or guardian and believe we may have collected your child's personal data without consent, please contact us immediately.

12. Third-Party Sites

Our website or platform may contain links to third-party websites or applications. We are not responsible for the content, policies, or practices of such external sites. We encourage you to read their privacy statements before providing your Personal Data.

13. Security of Personal Data

We take reasonable precautions and implement appropriate technical and organisational measures to safeguard your Personal Data from loss, misuse, unauthorised access, disclosure, alteration or destruction. However, we cannot guarantee absolute security over the internet and accept no liability for unauthorised access beyond our control.

14. Contact Information

For any inquiries, feedback, complaints, or requests relating to this Notice or the exercise of your rights under the PDPA, you may contact us in writing at:

Bamboo Hospitality Travel Sdn. Bhd. (formerly known as Bamboo Hospitality Platform Sdn. Bhd.)
Address: Menara SCP Societe, 23, Jalan 19/70a,
Desa Sri Hartamas, 50480 Kuala Lumpur,
Wilayah Persekutuan Kuala Lumpur
Email: hello@jomhotel.com