Global Privacy Standards

This Global Privacy Policy explains how Wise Lee Holidays Sdn. Bhd. collects, processes, stores, and protects personal data when users access or use the online cruise booking platform located at https://cruise.xqholidays.com.my.

The website operates as an online booking platform facilitating reservations for cruise tours and maritime experiences operated by independent cruise operators located in Langkawi, Malaysia.

This policy applies to users, buyers, and passengers located in Malaysia and internationally, including users located in the European Economic Area.

Personal data processing complies with:

Personal Data Protection Act 2010

General Data Protection Regulation

Personal data may be collected when users browse the website, make a booking, communicate with the company, or submit information through booking forms.

• Passenger identification information including full name, nationality, NRIC for Malaysian citizens, passport number for foreign nationals.
• Contact information including email address and telephone number.
• Booking information including cruise selection, travel date, number of passengers, and reservation details.
• Payment transaction information processed through secure payment gateways.
• Technical information including IP address, device type, browser type, and website usage data.

Full payment card details are not stored by the company.

Personal data is processed for legitimate operational purposes including:

• processing cruise bookings
• confirming reservations with cruise operators
• communicating booking confirmations and updates
• complying with port authority or maritime regulations
• providing customer support
• detecting fraudulent transactions
• improving platform performance and security

Personal data may also be used for internal administration, accounting, and legal compliance.

Personal data may be disclosed to third parties where necessary to complete booking services or comply with legal obligations.

• cruise operators responsible for delivering the cruise service
• payment gateway providers
• insurance providers where applicable
• port authorities or maritime authorities requiring passenger verification
• government authorities when legally required
• technology service providers supporting system infrastructure

These parties are required to process personal data responsibly and only for operational purposes.

Passenger information submitted during booking may be transmitted to the cruise operator's reservation system through secure system integration.

The cruise operator is responsible for managing passenger lists, operational verification, and boarding procedures.

Once transmitted, the cruise operator may process passenger data in accordance with its own operational and regulatory obligations.

Because the platform accepts international travelers, personal data may be transferred outside the European Economic Area when necessary to process bookings and coordinate with cruise operators located in Malaysia.

Appropriate safeguards are implemented to protect personal data during such transfers.

Personal data will only be retained for as long as necessary to fulfill operational purposes and comply with legal obligations.

Booking and transaction records may be retained for administrative, accounting, and regulatory requirements.

When personal data is no longer required, it will be securely deleted or anonymized.

Reasonable administrative, technical, and organizational measures are implemented to protect personal data against unauthorized access, disclosure, alteration, or destruction.

Security measures may include secure hosting environments, restricted system access, and encryption used by payment processors.

Users acknowledge that no internet transmission system can guarantee complete security.

Individuals may request access to personal data held by the company and request corrections where information is inaccurate or incomplete.

For users located in the European Economic Area, additional rights may apply under the GDPR including the right to request deletion of personal data, restriction of processing, or withdrawal of consent.

Requests must be submitted using the contact information provided below.

Identity verification may be required before requests are processed.

The website may use cookies and similar technologies to improve functionality and analyze website performance.

Cookies may be used to maintain booking sessions, remember user preferences, and measure website traffic.

Users may disable cookies through browser settings, although this may affect certain features of the platform.

Users may receive communications related to booking confirmations, operational updates, and customer service responses.

Where permitted by applicable law, promotional information about travel services may also be sent.

Users may request to stop receiving marketing communications by contacting the company.

Wise Lee Holidays Sdn. Bhd. may update this Privacy Policy when necessary to reflect legal requirements or operational changes.

Updates will be published on the website and take effect upon publication.

Continued use of the website constitutes acceptance of the updated policy.