Privacy Policy

1. Introduction

Senja Estate ("we", "us", "our") is committed to handling personal data responsibly and transparently. This Privacy Policy describes what personal information we collect from guests and website visitors, how we use it, and the choices available to you. It applies to our website at senjaestbx.site and to enquiries and bookings made directly with the estate.

For questions about this policy, please contact us at [email protected].

2. Data We Collect

We collect personal data when you submit an enquiry through our website contact form, communicate with us by telephone, or stay at the estate as a guest. The categories of data we collect include:

• Name and contact details (email address, telephone number)
• The room you are enquiring about and your proposed dates
• Passport or identity document details, required by Malaysian law for guest registration at accommodation premises
• Payment information (processed securely; we do not retain full card details)
• Website usage data collected via cookies (see Section 6 below)

3. Legal Basis for Processing

We process personal data on the following legal bases:

• Contract: To respond to your enquiry and to fulfil the terms of a confirmed booking
• Legal obligation: To comply with the requirements of the Malaysian Tourism and Hospitality regulations regarding guest registration
• Legitimate interests: To manage the estate's operations, respond to communications, and maintain security records
• Consent: For any optional marketing communications, which you may withdraw at any time

4. How We Use Personal Data

• To respond to enquiries and confirm room availability
• To manage your stay and provide the services described in your booking
• To maintain the guest register required under Malaysian accommodation regulations
• To process payments
• To communicate necessary information about your booking or stay
• To improve the estate's website and services (using anonymised analytics data)

We do not sell personal data to third parties. We do not use personal data for automated decision-making or profiling.

5. Data Retention

We retain guest registration records for seven years, as required under Malaysian financial and regulatory obligations. Enquiry records for stays that did not proceed to booking are retained for twelve months. Website analytics data is retained in aggregated, anonymised form.

6. Cookies

Our website uses cookies to store your cookie consent preference and to support basic site functionality. Analytics cookies may also be used to understand how the site is used. For full details, see our Cookie Policy. You may manage your cookie preferences at any time through the Cookie Policy page.

7. Data Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. Guest data is stored on password-protected systems. Physical guest records are kept in a secured location on the premises accessible only to the resident manager.

In the event of a data breach that affects your personal data, we will notify you and, where required, the relevant supervisory authority within the timeframes required by applicable law.

8. Third Parties

We use limited third-party services for website analytics. These services may set cookies and receive anonymised usage data. We do not share identifiable guest data with advertising networks or data brokers. We may share data with Malaysian government authorities where required by law (for example, the Penang State Tourism Action Council or law enforcement).

9. Your Rights

Under the Personal Data Protection Act 2010 (PDPA) of Malaysia, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete personal data
• Withdraw consent for processing where consent is the legal basis
• Request that we limit the use of your data in certain circumstances
• Make a complaint to the relevant authority

To exercise any of these rights, write to us at [email protected]. We will respond within 21 days. There is no fee for a reasonable access request.

10. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites. We recommend reviewing the privacy policy of any external site you visit.

11. Children

Our services are directed at adults aged 18 and over. We do not knowingly collect personal data from persons under 18. If you believe a minor has submitted personal data to us, please contact us so that we can take appropriate action.

12. Supervisory Authority

The data protection supervisory authority for Malaysia is the Personal Data Protection Department (JPDP), under the Ministry of Communications and Digital. If you have unresolved concerns, you may contact the JPDP at www.pdp.gov.my.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the date at the top of this page. Continued use of the website or estate services after a change constitutes acceptance of the updated policy.

14. Contact

Data Controller: Senja Estate
Address: 25, Lebuh Acheh, 10200 George Town, Pulau Pinang, Malaysia
Email: [email protected]
Telephone: +60 4-261 9374