Notice and Choice Principle Statement

At Cuti Cuti Langkawi ("CCL," "we," "us," or "our"), we highly value the privacy and security of your personal data. The Personal Data Protection Act 2010 (PDPA) mandates that we inform you about your rights concerning the collection, use, and sharing of your personal data. This Personal Data Protection Notice explains how we handle your personal data in accordance with the PDPA.

We may update this Notice periodically. The updated Notice will be available on our website www.cuticutilangkawi.com and through other appropriate channels. Your continued engagement with CCL or use of our services after these updates signifies your acceptance of the revised Notice. This Notice is presented in both English and Bahasa Malaysia. In case of any discrepancies, the English version will take precedence.

Throughout your interactions with us, CCL will collect and process your personal data to effectively operate and deliver our services. We will only collect and process your personal data in compliance with the PDPA and this Notice. "CCL" refers to Cuti Cuti Langkawi and its affiliated entities. When we say "you" or "your," it also includes your employees, representatives, and agents if you represent a company or organization.

1. Collection of Personal Data

We collect personal data from you when you:

  • Purchase our products or services (e.g., ferry tickets, attraction tickets, tours, accommodations and more).
  • Create/register an account with us.
  • Participate in contests, surveys, or promotions.
  • Contact our customer service.
  • Use our website or mobile app.

The types of personal data we collect may include:

  • Identification Data: Name, NRIC/Passport number, date of birth, nationality, gender.
  • Contact Information: Address, phone number, email address.
  • Travel Information: Travel dates, destinations.
  • Payment Information: Credit/debit card details, bank account information.
  • Demographic Information: (Optional) Age range.
  • Technical Information: IP address, browser type, device information (when using our website/app).
  • Sensitive Personal Data: (With your explicit consent) May include health information (e.g., for accessibility needs) or dietary restrictions (e.g., for meal arrangements on tours). We will only collect sensitive personal data if it is necessary for the provision of our services and with your explicit consent.

2. Purposes of Processing Personal Data

We may use and process your personal data for the following purposes:

  • Providing Services: Fulfilling your bookings, processing payments/refunds, managing your travel arrangements.
  • Communication: Responding to your inquiries, providing customer support, sending booking confirmations and updates.
  • Personalization: Tailoring our services and offers to your preferences.
  • Improving Services: Analyzing user behavior to improve our website, app, and services.
  • Legal Compliance: Complying with legal and regulatory requirements.
  • Internal Operations: For internal administrative purposes, such as accounting, auditing, and record-keeping.

3. Disclosure to Third Parties

We may disclose your personal data to the following categories of third parties only when necessary for the purposes described above:

  • Service Providers: Ferry operators, product, tour operators, hotels, accommodation providers, transportation providers, payment gateways, IT service providers. We will ensure these parties are contractually bound to protect your data.
  • Government Authorities: When required by law or legal process.
  • Professional Advisors: Lawyers, accountants, auditors, only on a need-to-know basis.

We will never sell your personal data to third parties for marketing purposes without your explicit consent.

4. Data Security

We take reasonable steps to protect your personal data from unauthorized access, use, or disclosure. These steps include physical, technical, and administrative safeguards. However, no data transmission over the internet or electronic storage method is 100% secure.

5. Data Retention

We will retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law.

6. Your Rights

You have the following rights regarding your personal data:

  • Access: You can request access to the personal data we hold about you.
  • Correction: You can request correction of any inaccurate or incomplete personal data.
  • Withdrawal of Consent: You can withdraw your consent to the processing of your personal data (including marketing communications) at any time.
  • Objection: You can object to the processing of your personal data under certain circumstances.

To exercise these rights, please contact us using the contact information below.

7. Contact Us

If you have any questions or concerns about this Notice or our data processing practices, please contact our Data Protection Officer at: This email address is being protected from spambots. You need JavaScript enabled to view it.

8. Changes to this Notice

We may update this Notice from time to time. Any changes will be posted on our website. Your continued use of our services after such changes are posted constitutes your acceptance of the revised Notice.

9. Language

This Notice is issued in both English and Bahasa Malaysia. In the event of any inconsistencies between the two versions, the English version shall prevail.

Consent to Cuti Cuti Langkawi Processing Your Personal Data

By providing your personal data to Cuti Cuti Langkawi (CCL), you agree that CCL may process this data in accordance with this Notice. You confirm that the personal data you provide is accurate, complete, and current. Please inform CCL promptly of any changes to your personal data.

If you do not agree to CCL processing your personal data, please contact us using the details provided in this Notice.

If you are providing (or will provide) CCL with personal data about your family members, spouse, dependents, directors, shareholders, employees, representatives, agents (if you are representing a company or organization), or other individuals, you confirm that you have informed (or will inform) them that their data will be shared with and processed by CCL. You also confirm that you have obtained their consent for this processing (including disclosure and transfer) in line with this Notice.

For minors (individuals under 18) or those legally incapable of giving consent, you confirm that you are their parent, guardian, or person with parental responsibility, or someone appointed by the court to manage their affairs, or that they have authorized you to consent on their behalf to the processing (including disclosure and transfer) of their personal data according to this Notice.

We cannot distinguish the age of visitors to our Website. If you are a parent or guardian of someone under the age of majority in the territory you're residing in, who has provided us his/her Personal information without your knowledge and consent, you may request that we remove such information by contacting us.

Published at 23 November 2020. Latest update ** 2025-01-01