English
01Purpose and scope
This notice explains how Zahin Travel Sdn. Bhd. collects, uses, retains, discloses and protects personal data when you interact with our official Facebook, Instagram, Messenger, Threads, Meta Lead Ads, website and CRM channels.
If your information is later needed for a quotation, booking, visa, insurance or travel service, the relevant general travel notice and booking terms also apply.
02Data we may process
We do not obtain Meta passwords, PINs, OTPs or complete payment-card numbers through this app. MyKad, passport, health data or sensitive documents are not requested at the initial enquiry stage.
- Names, usernames, profile photographs, telephone numbers, email addresses and account identifiers.
- Page, account, post, media, comment, reply, conversation, campaign, advertisement, form and lead identifiers.
- Messages, comments, replies, mentions, reactions, content and attachments you send.
- Travel interests such as destination, dates, budget, party size, language and service requirements.
- Consent status, marketing preferences, event times, CRM, security and audit records.
03Sources and purposes
Data may come directly from you, from Meta through authorised APIs or webhooks, from Zahin Travel personnel, or from a representative you authorise.
- Answer enquiries and prepare package suggestions or quotations.
- Connect messages, comments and leads to the correct CRM record.
- Record consent and channel or marketing preferences.
- Use approved, minimised and, where practical, de-identified conversation content to evaluate and improve the accuracy, safety and communication style of our customer-service AI.
- Prevent spam, fraud, unauthorised access and duplicate processing.
- Meet legal, accounting, security and regulatory obligations.
04Automation and AI
The system may automatically classify and route enquiries. For at least the first 30 days of an approved observation period, AI operates in shadow mode: it observes approved conversations between personnel and customers and may prepare internal drafts, but it does not send replies.
After that minimum period, Zahin Travel may separately authorise customer-facing AI only when documented privacy and risk assessments, data minimisation, accuracy and safety testing, monitoring, customer disclosure, human escalation, and immediate pause and takeover controls are in place. Completing 30 days does not by itself activate automated replies.
AI must not make final decisions about bookings, payments, refunds, cancellations, visa eligibility, travel fitness or other significant matters without review by authorised personnel. You may ask to speak with a person at any time.
05Disclosures and transfers
Necessary data may be accessed by authorised Zahin Travel personnel, Meta Platforms, approved CRM, database, webhook, hosting and security providers including Supabase, and authorities or advisers where required.
Providers may process data outside Malaysia. Zahin Travel will rely on an applicable condition under section 129 of Act 709, take reasonable precautions and due diligence, minimise transferred data and assess recipient protections.
06Retention
Longer retention may apply for law, complaints, claims, audits, security or authority instructions. At expiry, data is securely deleted or irreversibly anonymised.
- Leads, enquiries and customer-service content: up to 24 months after the last meaningful interaction or trip completion.
- Technical webhook logs without message content: 90 days.
- Security, administrator-access and audit logs: 12 months.
- Marketing contacts: until consent is withdrawn or 24 months without engagement.
- Consent and privacy-request records: 7 years.
- Privacy-request identity copies: 30 days after closure; encrypted backups: up to 90 days.
07Security
We use role-based access, authentication, encryption, webhook-signature validation, duplicate prevention, audit records and restrictions on raw data.
08Your rights and choices
Subject to applicable law, you may request access, correction, updating, withdrawal of consent, restriction or deletion. You may opt out of marketing without affecting necessary service communications. You may also ask for human assistance or object to AI handling where applicable.
Contact Fazila Binti Ismail at admin@zahintravel.com or +60 17-316 5822 with the subject “Personal Data Request”. We aim to acknowledge within 3 business days and complete within 21 calendar days after verification; a valid access request may receive written notice of an extension of up to 14 days.
09Changes
The current version is published on Zahin Travel's official website. Its effective date and last-updated date are 15 August 2026. Material changes will be recorded with a new last-updated date.