MaldivesQuest privacy notice and traveller consent

This notice explains how MaldivesQuest processes personal data under Malaysia's Personal Data Protection Act 2010 (PDPA) and its 2024 amendments. For a shorter, step-by-step walk-through, read how MaldivesQuest handles your enquiry data.

It applies to the enquiry form, WhatsApp messages to us and the website. It forms part of our trust and transaction clarity policies, alongside the terms of website use.

1. Who we are

MaldivesQuest is an independent Maldives travel research and trip-planning website for people in Malaysia. For this notice, MaldivesQuest is the data user (data controller) for briefs sent to us.

The licensed Malaysian travel provider that prepares quotations becomes responsible for your data once you consent to sharing and it receives your brief.

2. Personal data we collect

We collect:

• trip details, such as dates, departure airport, number and ages of travellers, budget and trip style;
• your name;
• phone or WhatsApp number and/or email address;
• preferences, such as dietary needs, room type and activities;
• your consent choices and the date you gave them.

The form does not ask for passport numbers, IC numbers or dates of birth.

When analytics is enabled, we use Cloudflare Web Analytics, which measures page visits without advertising cookies.

3. Why we use it

4. Who we share it with

We share your brief with the licensed travel provider only if you tick the quotation consent box. The provider's name and licence are shown on the enquiry page once appointed.

Data is stored on Cloudflare infrastructure, which acts as our service provider. Personal data is used only for the purposes in section 3.

5. How long we keep it

We keep briefs and contact details for up to 24 months after your last contact, unless you ask us to delete them sooner. Consent records are kept for the same period so we can show what you agreed to.

6. How we protect it

Data is stored securely on Cloudflare infrastructure, with access limited to the people who need it to reply to briefs. We collect only what is needed to plan a trip, which keeps the risk low.

7. Data breaches

If a personal data breach occurs, MaldivesQuest will report it to the Personal Data Protection Commissioner as required by the PDPA, as amended in 2024. Where the breach is likely to cause you significant harm, you will also be told without unnecessary delay, with an explanation of what you can do.

8. Your rights

Under the PDPA you may:

1. access the personal data we hold about you;
2. correct data that is inaccurate, incomplete or out of date;
3. withdraw consent for quotation sharing or marketing at any time;
4. ask for deletion before the end of the retention period;
5. ask for data portability, receiving the data you gave us in a commonly used format, where technically feasible;
6. limit processing for direct marketing.

To use any right, reply to any message from us or use the contact route on the enquiry page. We may ask you to confirm your identity before acting.

9. Data protection officer

The 2024 amendments require data controllers to appoint a data protection officer. Questions for our data protection officer can be sent through the contact route on the enquiry page, and will be answered by the person responsible for data protection at MaldivesQuest.

10. Data held by the travel provider

Once the licensed travel provider receives your brief with your consent, it uses the data to prepare your quotation and, if you book, to issue and manage the booking. For booked trips it will need further traveller details, such as passport information, which it collects directly from you.

The provider is responsible for that data under its own PDPA obligations. Its own privacy notice explains how long it keeps booking records and how to contact it.

11. Changes to this notice

We will update this notice when our practices or the law change, and show the new "Last reviewed" date at the top. Significant changes are recorded in our corrections log.