Privacy Policy

Last updated: November 2026

This policy, together with our Terms and Conditions, sets out the basis on which any personally identifiable information ("Personal Data") we collect from you, or that you provide to us, will be processed by ARBA Travel & Tours Sdn Bhd (1093130-M) ("ARBA").

This policy applies to websites, applications, tools, promotions, email communications, login accounts, and all other services operated by ARBA.

By using our services, you are deemed to have consented to the use of your Personal Data in accordance with this policy.

Any changes to this policy will be posted on this page. You are advised to review this policy periodically.

Your Privacy

At ARBA, we are committed to protecting your privacy and ensuring the security of your personal, business, and travel information. This protection is our top priority.

We employ strict security measures and adhere to robust privacy principles to ensure your Personal Data is always protected and managed appropriately.

Personal Data Protection Act (PDPA)

Malaysia's Personal Data Protection Act ("PDPA") is the law that protects individual Personal Data in commercial transactions.

Personal Data refers to any information that can directly or indirectly identify an individual, including:

  • Name
  • Address
  • Identity Card Number
  • Passport Number
  • Email address
  • Other contact details

Sensitive Personal Data includes:

  • Physical or mental health information
  • Political opinions
  • Religious beliefs
  • Any offence or alleged offence

Commercial transactions include any commercial dealings, whether contractual or not, including the collection of data from prospective customers.

Data processing includes activities such as collecting, recording, storing, holding, or any operation carried out on Personal Data.

Under the PDPA, you have the right to:

  • Access your Personal Data
  • Correct data to ensure it is accurate, complete, and up-to-date
  • Withdraw consent for the use of data for marketing purposes

However, ARBA may still process your Personal Data to:

  • Provide the services you have subscribed to
  • Fulfil contractual obligations
  • Comply with legal or regulatory purposes

Types of Information We Collect

We collect the information you provide to us, such as:

  • Name
  • Email address
  • Password
  • User account details

When you make a booking, additional information may be required such as:

  • Address
  • Passport number
  • Credit or debit card details

We may also collect information when you engage with our services through:

  • Third-party applications
  • Social networking sites
  • Other websites

Use of Information

Your information is used for the following purposes:

  • Verifying authorisation for service access
  • Enabling you to use selected services
  • Personalising your experience (e.g. location, language, previous interactions)
  • System administration
  • Analysing user behaviour and trends
  • Responding to your enquiries or communications
  • Notifying service changes or updates
  • Sending booking confirmations, notifications, reminders, or newsletters

You may be asked to provide payment information either to ARBA or to the relevant booking partner when making a booking.

Disclosure of Your Information

ARBA will not sell your Personal Data to third parties.

However, we may share your data under the following circumstances:

  • To comply with law or regulatory requirements
  • To prevent or investigate illegal activities
  • To protect ARBA's rights and interests

We may also share information with:

  • Affiliate companies within the ARBA group
  • Travel service providers for booking purposes
  • Third parties who process data on our behalf
  • Promotional partners (with your consent)

In some cases:

  • Your data may be used to auto-fill information on third-party sites to facilitate bookings
  • Anonymised aggregate data may be shared for analytical purposes

ARBA is not responsible for the use of data by third parties after disclosure has been made in accordance with this policy.

Data Storage

All Personal Data is stored on secure servers.

We ensure that adequate technical and organisational measures are implemented to protect your data. Access to data is limited to employees who need the information to perform their duties.

However, data transmission over the internet is not completely secure. Any transmission is at your own risk.

Transfer of Personal Data Outside Malaysia

Some of the service providers who help us run our services store or process Personal Data outside Malaysia. Your Personal Data may therefore be transferred to, stored in or processed in other countries, but only for the purposes set out in this policy.

These providers are:

  • Customer records (CRM), which hold your enquiries and bookings: ConoHa by GMO Internet, with servers in Japan, and other hosting providers that may be outside Malaysia.
  • WhatsApp chats with our travel consultants and your contact details: SleekFlow and WhatsApp (Meta), which may store data outside Malaysia.
  • Backup copies of the forms you send on our website: Google (Google Sheets), which may store data outside Malaysia.
  • Alerts to our team about new enquiries and bookings: Telegram, which may store data outside Malaysia.
  • Feedback forms after your trip: Typeform, which may store data outside Malaysia.
  • Website analytics and advertising measurement: Google, Meta, TikTok and Microsoft, as described under Cookies and Tracking Tools below, which may process data outside Malaysia.
  • Airlines, hotels, cruise lines and tour operators in the countries you travel to, to arrange your trip.

Our website and its own database are hosted in Malaysia (Amazon Web Services, Malaysia region).

When your Personal Data is processed outside Malaysia, we take reasonable steps to keep it protected: we use established providers with their own security measures, give each one only the data it needs for its task, and limit who can access it.

Cookies and Tracking Tools

We use cookies and tracking tools to collect aggregated usage and demographic information.

We also use our own cookie to recognise a browser that returns to our website, so we can see which channels, such as an advertisement, a search engine or social media, led to your visits and to any enquiry you send us. It records the channel, the date and the page you arrived on, not your name or contact details, and it is linked to your enquiry only within our own records.

Cookies help to:

  • Improve user experience
  • Provide more relevant content
  • Understand which of our marketing channels bring visitors and enquiries

The tracking tools on our website are:

  • Google Tag Manager (Google): loads the other tools below on our pages.
  • Google Analytics (Google): counts visits and shows how visitors use our pages.
  • Google Ads (Google): measures which of our Google ads bring enquiries and payments.
  • Meta Pixel and Meta Conversions API (Meta): measure which of our Facebook and Instagram ads bring enquiries and payments. When you send an enquiry, our server may also tell Meta about it; any phone number or email it sends is first turned into a code (hashed) that cannot be read.
  • TikTok Pixel (TikTok): measures which of our TikTok ads bring enquiries and payments.
  • Microsoft Clarity (Microsoft): records how visitors scroll and click on our pages (session recordings and heatmaps), so we can fix pages that are hard to use.

You can block or delete cookies in your browser settings, though some parts of our website may then work less well. Your browser's tracking protection or a content blocker can also stop these tools from loading. To opt out of Google Analytics on every website, use Google's opt-out add-on at https://tools.google.com/dlpage/gaoptout. To limit ads based on your activity, change the ad settings in your Google, Facebook, Instagram or TikTok account.

Third-Party Websites

ARBA is not responsible for the privacy practices of third-party websites.

When you leave our site, you are advised to review the privacy policy of each site that collects your Personal Data.

We may also enable information sharing to:

  • Third-party applications
  • Social networking sites

Information shared may be accessible to other parties on those platforms. You are therefore advised to review the privacy policy of the relevant platform.

Accessing Your Personal Data

You have the right to know what Personal Data we hold about you.

Requests may be made to us in writing.

You also have the right to:

  • Object to the processing of data for marketing purposes
  • Stop receiving marketing communications at any time

If you have an account with us, you can manage some of your personal information and preferences through our website.

Contact Us

If you have any enquiries regarding this privacy policy, please contact us:

Email: hi [at] arbatravel.com
Phone: 03-8600 9808