Legal
Privacy policy
This policy explains what personal data LangkawiCruise.com collects, why, who receives it, how long we keep it and your choices. It is our notice under Malaysia’s Personal Data Protection Act 2010. Last updated 6 November 2026.
Who we are
LangkawiCruise.com is run by Sinergia Travels Sdn Bhd (Registration No. 201801011752 (1273768-A)), a licensed travel agency (MOTAC licence 10734), 507, Blk E, Phileo Damansara 1, 9 Jalan 16/11, 46350 Petaling Jaya, Malaysia. For any question about your personal data: contact@langkawicruise.com or WhatsApp +60 11-4301 2551. Contact for data protection questions: contact@langkawicruise.com.
What we collect
When you contact us through the enquiry form, our website chat, WhatsApp, Instagram, Facebook Messenger, LINE, Telegram, email or phone: your name, phone or WhatsApp number, email, the name and picture of your profile on that app, your messages, dates, group size, children’s ages, requests and the cruise or yacht you asked about.
WhatsApp calls. If you call us on WhatsApp (+60 11-4301 2551), the call is recorded and transcribed so that our team can follow up your request. If you prefer not to be recorded, write to us instead.
When you book: your booking details (cruise, date, guests, requests) and the payment status. Online card payments are handled by Stripe, and online banking (FPX) payments by Billplz; we never see or store your card number or your online banking login. For DuitNow and bank transfers we see the amount, date and reference from our bank. If we refund you by bank transfer, we ask for the account holder’s name, the bank and the account number, and use them only for that refund.
Booking messages on WhatsApp. If you agree, by ticking the box when you book online or by replying YES when we ask in the chat, we send your booking confirmation, the passenger list link and reminders about payment and boarding on WhatsApp, and we record when you agreed. Otherwise we send them by email, or our team confirms in the chat. You can ask us to stop at any time.
Passenger list. Before the cruise the boat operator needs a passenger list. For each guest we collect the full name as in the passport or IC, the passport or IC number, nationality, age, gender (male or female, as in the passport or IC) and menu choice and, if you choose to tell us, whether the guest needs a wheelchair or help to board. This answer can reveal health information: we record it only with the explicit consent of that guest (or, for a guest under 18, of a parent or guardian), confirmed on our passenger list page, and use it only so that the crew can prepare the boarding. We do not collect food allergies or dietary needs on the passenger list page. On a shared cruise, a guest with an allergy or any doubt about a dish asks the crew on board before eating. If you tell our team about a food allergy or a dietary need, for example for a private charter, we use it only to pass it to the boat operator for your cruise. If you book for a group, you can fill in the details of the other guests on our passenger list page; please tell them about this policy. A parent or guardian gives the details of guests under 18.
Where you came from: the page you arrived on, the website that sent you, the app that opened our page (for example Instagram or the Google app, as your browser reports it), campaign codes in the link (for example from Google Ads) and the Google ad click id (in the EU, EEA, UK and Switzerland only if you accept cookies; elsewhere unless you decline them). When you tap a WhatsApp, Telegram or LINE button on our site, the message includes a reference such as “Ref LC-E-7K2QXP” and we log the click (the reference, the page and how you reached our site, never your name or number) for 90 days, so that we can see which page your chat came from. If the chat came from a Google ad, we tell Google Ads that the ad led to a chat (the ad click id and the time only). You can delete the reference before you send the message.
Technical data: your browser and device type, the cookies described below and, when you use the website chat, a scrambled (hashed) copy of your IP address kept for two hours to limit abuse.
Our virtual assistant
Our website chat and our messaging channels (WhatsApp, Instagram, Facebook Messenger, LINE and Telegram) can be answered by the Langkawi Cruise virtual assistant, an AI system that says so when it answers. It reads your messages to answer your questions, check availability, create a payment link for an online booking or pass your request to our team. Our team can read the whole conversation and takes over when needed.
Why we use it
To answer your enquiry, recommend a cruise and send you a quote.
To book, confirm and arrange your cruise or activity with the operator, including the passenger list.
To take payments, issue invoices and keep our accounts.
To look after you on the day and handle changes, weather, cancellations and refunds.
If you do not reply to our offer or question, to send you up to two follow-up messages about your enquiry, and, if you ask us to come back later, up to two messages before the date you gave us. Tell us and we stop.
After your cruise, to ask how it went and, if you enjoyed it, to invite you to leave a Google review. Tell us and we stop.
To see which pages, ads and channels bring enquiries and bookings, and to improve our site.
Only if you tick the box on our enquiry form: to send you occasional offers by email or WhatsApp. You can unsubscribe at any time.
To meet our legal duties.
What you must give us
We need your contact details, date and group size to answer and to book, and the boat operator needs the passenger details before departure. Without them we cannot confirm the cruise. Everything else is optional.
Who receives it
The yacht owner or tour operator running your cruise or activity receives what they need to prepare it: names, date, group size, requests and the passenger list. Authorities receive personal data when the law requires it. Service providers that run our site and tools process it for us:
Framer: website, enquiry form and passenger list page (European Union, USA, worldwide network).
Cloudflare: our booking and enquiry servers, the click log (worldwide network, United States).
Chatwoot: our chat inbox for all channels, the virtual assistant, WhatsApp call recordings and transcripts (United States).
Meta (WhatsApp, Instagram, Facebook Messenger), LINE, Telegram: the messaging apps you choose to use; their own privacy policies also apply (their own data centres).
Stripe: online card payments (United States and other countries).
Billplz: online banking (FPX) payments, with your name, email or mobile number, the amount and a short description of your booking; its own privacy policy also applies (Malaysia and other countries).
Google: Google Analytics and Google Ads measurement, maps, our booking sheet (where the passenger list is kept) and calendar (United States and other countries).
Microsoft: our email, contact@langkawicruise.com (USA).
Brevo: the emails we send you and our offers list (European Union).
Zoho: invoices and accounting (United States).
AI tools, Anthropic (Claude), OpenAI (ChatGPT), Google (Gemini) and Microsoft (Copilot): assistants our team uses to prepare replies and documents, run our systems and check bookings, payments and invoices (United States and other countries). We use them with settings that stop them from using your data to train their models, and we do not enter passport or IC numbers, payment details or food allergies into them.
We do not sell your personal data.
Transfers outside Malaysia
Several of these providers store data outside Malaysia, mainly in the United States and the European Union. We use them because they are needed to provide the service you ask for, and we choose providers that protect personal data to a standard comparable to the Personal Data Protection Act 2010.
Cookies and similar technologies
Analytics and ad measurement (Google Analytics). Counts visits, enquiries, WhatsApp clicks and bookings, and tells Google Ads which ads led to them. Our banner offers Accept and Decline. In Malaysia and everywhere outside Europe, measuring starts on your first visit; in the European Union, the UK and Switzerland it starts only after you accept. If you decline, or have not yet accepted in Europe, no analytics cookie is set and your visits are not linked to you or to each other; Google may still receive anonymous counts that cannot identify you. To change your choice at any time, use Cookie settings at the bottom of every page.
What is kept in your browser
| Name | Set by | What it does | Kept for |
|---|---|---|---|
| Your cookie choice (browser storage) | Our site | Your cookie choice | Until you change it in Cookie settings or clear your browser data |
| Google Analytics cookies | Google Analytics | Tells visits apart and counts them; set only after Accept in Europe, and not after Decline anywhere | 2 years |
| Google Ads click cookies (only after a click on one of our Google ads) | Links a booking or enquiry to the ad you clicked | 90 days | |
| How you reached us (browser storage) | Our site | How your visit reached us (page, referring site, campaign codes, Google ad click id) and the app that opened our page | 30 days after Accept. Until you close the tab if you have not chosen yet (outside the EU, EEA, UK and Switzerland only). Not kept after Decline. |
| Website chat (browser storage) | Our site | Keeps your chat conversation so that you can continue it | Until you clear your browser data |
| Your booking in progress (session storage) | Our site | The cruise you looked at, and your date and guests while you book | Until you close the tab |
| Stripe payment cookies | Stripe, on our payment page checkout.langkawicruise.com | Fraud prevention during payment (see Stripe's privacy policy) | 1 year and 30 minutes |
| Google Maps cookies | Set by Google when a map loads (see Google's privacy policy) | Set by Google |
Maps. Some pages show Google Maps. When a map loads, Google receives your IP address and may set its own cookies; see Google’s privacy policy.
How long we keep it
Passport and IC numbers: deleted 30 days after the cruise, and from our backup copies within 3 months.
Answers on help to board: deleted with the passport numbers, 30 days after the cruise.
Bookings, invoices, payment records and the written messages in which your booking was agreed or changed: 7 years, as Malaysian accounting and tax law requires and for as long as a claim can be made.
WhatsApp call recordings and transcripts: 2 years after the call, unless needed for an open dispute.
Enquiries and chats without a booking: 2 years after your last message.
Click log of the WhatsApp, Telegram and LINE buttons: 90 days.
Offers list: until you unsubscribe.
Google Analytics: 14 months.
Security
Only the team members who need your personal data can see it, and we use providers that secure their systems to recognised standards. If a data breach is likely to cause you significant harm, we inform the Personal Data Protection Commissioner and you, as the law requires.
Your rights
You can ask us to show you the personal data we hold about you and give you a copy, including in a format you can take to another provider; to correct it; to withdraw a consent you gave us; to stop using it for offers; or to delete it once we no longer need it. Write to contact@langkawicruise.com. We may ask you to confirm your identity first. We reply within 21 days, free of charge. You can also complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi, pdp.gov.my).
If you are in the European Union, the United Kingdom or Switzerland
We are based in Malaysia and the Personal Data Protection Act 2010 applies to us. If you contact us or book from the European Union, the United Kingdom or Switzerland, the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection may also apply, and this section gives the additional information those laws ask for. Legal bases: we use your data to answer you and to perform your booking (contract); to meet legal duties such as accounting and the passenger list the boat operator must hold (legal obligation); to measure our site and ads, to prevent abuse, to follow up your enquiry and to ask for your feedback after the cruise (our legitimate interests, and your consent for analytics cookies); and to send offers only with your consent. Whether a guest needs help to board can reveal health information, which is special category data: we record it only with the explicit consent of that guest, or of a parent or guardian for a guest under 18, confirmed on our passenger list page. If you tell our team about a food allergy, we use it only to pass it to the boat operator for your cruise. Transfers: your data is processed in Malaysia and by the providers listed above, some of them outside the European Economic Area; these transfers are necessary to provide the service you ask for (Article 49(1)(b) GDPR), and our providers apply their own safeguards, such as the EU standard contractual clauses, which we can describe on request. Your rights: in addition to the rights above, you can ask us to restrict or object to processing and to receive your data in a portable format, and you can complain to the data protection authority of your country.
Children
Our cruises are booked by adults. We collect the details of children only from a parent or guardian, for the passenger list and to price the booking.
Changes
We may update this policy. The date at the top shows the current version.
Check availability
Tell us your date and your group
Send the form and we reply on WhatsApp or by email with availability, the departure point and the total for your group. Nothing is charged at this stage.
Prefer to chat straight away?
Message us on WhatsApp