Helmara ("we", "us", "our") is committed to protecting the personal data of our guests and website visitors. This policy explains what information we collect, how we use it, and what rights you have in relation to it. It applies to our website at heellmarat.cyou and to the booking and communication processes associated with our yacht tours. Our operations are based in Melaka, Malaysia. This policy is written in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA).
1. Data We Collect
We collect the following personal data:
- Contact information: Name, email address, phone number — provided when you submit an enquiry or booking request.
- Communication records: Messages sent through our contact form or via email.
- Usage data: Pages visited, time on site, browser type — collected via analytics cookies only if you have consented.
- Cookie data: Preferences stored in your browser, as described in our Cookie Policy.
We do not collect sensitive personal data such as identification numbers, financial account details, or health information.
2. How We Use Your Data
- Responding to booking enquiries and providing voyage information
- Processing confirmed bookings and sending departure details
- Communicating schedule changes or weather-related adjustments
- Improving our website through aggregated, anonymised usage analysis
- Complying with legal obligations under Malaysian law
We do not use your data for automated profiling or for any purpose unrelated to the services you have contacted us about.
3. Legal Basis for Processing
- Consent: For analytics and non-essential cookies, collected via our cookie consent mechanism.
- Contract performance: Processing necessary to fulfil a booking or respond to a service enquiry.
- Legitimate interest: For communication related to confirmed bookings and customer service.
- Legal obligation: Where required to comply with Malaysian law or regulatory authority requests.
4. Data Retention
- Enquiry records: 12 months from the date of last contact if no booking is confirmed.
- Booking records: 5 years from the date of the voyage, for financial and legal compliance.
- Analytics data: Retained in anonymised, aggregated form; raw usage logs deleted after 90 days.
5. Data Sharing
We do not sell or rent your personal data. We share data only in the following limited circumstances:
- Service providers: Email delivery services and analytics platforms. These providers are bound by data processing agreements.
- Legal requirements: If disclosure is required by a court order or Malaysian law enforcement.
We do not share personal data with third parties for marketing purposes.
6. Cookies
We use cookies on our website. Essential cookies are necessary for the site to function. Optional analytics and preference cookies are only placed with your consent. Please refer to our Cookie Policy for full details.
7. Your Rights Under PDPA 2010
- Right of access: Request a copy of the personal data we hold about you.
- Right of correction: Request correction of inaccurate or incomplete data.
- Right to withdraw consent: Withdraw consent at any time without affecting the lawfulness of prior processing.
- Right to cease processing: Request that we stop using your data for certain purposes, including marketing.
- Right to lodge a complaint: Submit a complaint to the Department of Personal Data Protection Malaysia (JPDP).
To exercise any of these rights, contact us at [email protected]. We will respond within 21 days.
8. Data Security
We use industry-standard security measures to protect your personal data, including encrypted data transmission and restricted access controls. In the event of a data breach that affects your rights and interests, we will notify the relevant authorities and affected individuals as required under PDPA 2010.
9. Third-Party Links
Our website may contain links to external sites. We are not responsible for the privacy practices of those sites. We encourage you to review their privacy policies independently.
10. Children's Privacy
Our services are intended for individuals aged 18 and above. We do not knowingly collect personal data from children under 18 without parental consent. If you believe we have inadvertently collected data from a minor, please contact us and we will take steps to remove it.
11. Changes to This Policy
We may update this policy from time to time. When we make material changes, we will update the date at the top of this page. Continued use of our website or services following an update constitutes acceptance of the revised policy.
12. Contact
For any questions or requests related to this policy or your personal data:
- Email: [email protected]
- Post: Helmara, 36 Jalan Laksamana, 75000 Melaka, Malaysia