Privacy Policy

Terrapuri Heritage Resort
Privacy Policy

Last updated: 2025-09-04

This Privacy Policy explains how Palms Garden Beach Resort Sdn. Bhd. (Company No. 714058-D), trading as “Terrapuri Heritage Resort” (“Terrapuri”, “we”, “our”, “us”), collects, uses, discloses, and protects your personal data. We are based in Malaysia and serve guests from Malaysia and internationally.

By using our website, contacting us, making a reservation, purchasing any products or services, visiting our premises, or otherwise providing personal data to us, you acknowledge and agree to the practices described in this Privacy Policy. If you do not agree, please do not use our services or provide personal data to us.

Contact details:
– Address: Terrapuri Heritage Resort, Kampung Mangkuk, 22120 Setiu, Terengganu, Malaysia
– Phone: +60 9-624 5020
– WhatsApp (Reservations): +60 12-988 8399 (Maslina), +60 19-221 5341 (Darrius)
– Email (privacy/data requests): info@terrapuri.com or sales@terrapuri.com
– Website: www.terrapuri.com

1) Scope and legal framework

– This Privacy Policy applies to personal data we process in relation to:
– Guests and day visitors, diners, spa patrons, event clients, and tour participants
– Website visitors, online check-in users, and other online services we operate or control
– Prospective customers, vendors, partners, and job applicants

– Malaysia: We process personal data in accordance with the Malaysian Personal Data Protection Act 2010 (“MY PDPA 2010”) and its subsidiary legislation.

– International guests (including EEA/UK): We provide an Addendum for EEA/UK residents (see Section 13) to address EU/UK GDPR transparency, legal bases, and rights.

– This Policy supplements any service-specific terms, booking conditions, house rules, and notices we provide at the point of data collection. In case of conflict, specific notices prevail for that processing activity.

2) The personal data we collect

Depending on your interactions with us, we may collect the following categories of personal data:
– Identification and contact: full name, NRIC/passport/visa details, nationality, date of birth, gender, residential address, email, phone/WhatsApp contact
– Guest stay and booking details: reservation/booking identifiers, villa details, companions/occupants, special requests, arrival/departure dates, transport or transfer details
– Payment and billing: payment method, masked card details or tokenized identifiers, billing address, transaction records, invoices and receipts; we use third-party payment processors and do not store full card PAN/CVV on our systems
– Preferences and notes: dietary needs, pillow/room preferences, occasion notes, activity/adventure choices, communication preferences, marketing preferences/consents
– Government/authority-required data: details needed to comply with local laws (e.g., hotel guest registration, tourism tax eligibility, immigration or public health rules)
– Tours/adventures information: fitness or medical disclosures voluntarily provided to assess suitability and safety, emergency contact details
– CCTV and security: CCTV footage in common areas, incident/accident reports, key/entry logs (where applicable)
– Online/device data: IP address, device/browser type, cookie identifiers, analytics data, approximate location derived from IP, pages viewed, actions taken on our sites
– Recruitment/vendor data: CVs, qualifications, references, company and contact details, banking/payment references (for vendors)

We may also receive personal data about you from third parties such as online travel agencies (OTAs), travel agents, card/payment providers, event organizers, tour operators, transport providers, social media or messaging platforms (e.g., WhatsApp), and public authorities.

3) How we collect personal data

We collect personal data:
– Directly from you (online booking forms, WhatsApp, email, phone, in-person at reception, order or consent forms, event/tour forms, feedback forms, business cards)
– Automatically via our website and cookies/SDKs (see Section 9)
– From third-party booking platforms, travel agents, payment processors, tour operators, transport partners
– From CCTV and access controls on premises
– From publicly available sources where appropriate and lawful

4) Purposes for which we use personal data

We use personal data for:
– Reservations and stays: processing and confirming bookings, check-in/out, room and service assignments, billing and payments, tourism tax administration
– Guest services and operations: providing dining, spa, tours/adventures, transfers, concierge, customer support, lost-and-found management
– Safety and compliance: meeting legal obligations (e.g., hotel registration, tax reporting, regulatory inspections), ensuring safety and security (including CCTV), incident management
– Communications: responding to enquiries, pre-arrival/arrival/post-stay messages, itinerary updates, service notifications, changes/cancellations
– Personalization: honoring preferences, enhancing guest experience, managing complaints and feedback
– Marketing (with consent or as permitted by law): sending offers, news, promotions, surveys; managing opt-ins/opt-outs
– Business operations: IT administration, fraud monitoring, preventing misuse, audits, analytics, reporting, training, quality assurance
– Events: venue bookings, vendor coordination, guest lists, logistics, and compliance with venue policies
– Recruitment and vendors: assessing candidates, managing contracts, supplier onboarding, payments, due diligence

For EEA/UK data subjects, our legal bases include contract performance, legal obligation, legitimate interests (e.g., service improvement, security, analytics), vital interests (safety), consent (e.g., certain marketing/cookies), and public interest where applicable. See Section 13.

5) Direct marketing and your choices

– We may send you marketing communications (email/WhatsApp/SMS/calls) if you have provided consent or as otherwise permitted by applicable law.
– You can opt out at any time by:
– Using the unsubscribe link (email) where available
– Informing us on WhatsApp that you wish to opt out
– Emailing info@terrapuri.com or sales@terrapuri.com
– Opting out of marketing will not affect service-related communications (e.g., booking confirmations, operational notices).

6) Disclosures and international transfers

We may disclose personal data, only as necessary and appropriate, to:
– Our company and authorised staff who need access for the purposes set out in this Policy
– Service providers: IT/hosting, website, analytics, reservation engines, payment processors, card networks, banks, document management, communications platforms, security/CCTV, logistics, customer support
– Operations partners: tour/adventure operators, transfer/transport providers, marine park or boardwalk ticketing, event vendors, restaurants/caterers, insurance assistance providers
– Professional advisors and auditors: legal, accounting, consulting, risk and compliance
– Business counterparties: in the context of a sale, merger, or reorganisation, subject to confidentiality
– Government, regulators, law enforcement, courts: as required by applicable law or to protect our legal rights, safety of guests/staff, or in emergencies

International transfers:
– Our guests are both Malaysian and international, and our providers/servers may be located outside Malaysia. Where we transfer personal data abroad, we will do so in accordance with MY PDPA 2010 requirements (e.g., consent, contractual necessity, or appropriate safeguards) and, where applicable, GDPR requirements for EEA/UK data subjects (e.g., Standard Contractual Clauses or equivalent safeguards).
– By engaging with us, you acknowledge such transfers may occur for the purposes set out in this Policy.

7) Retention

– We retain personal data only for as long as necessary to fulfill the purposes for which it was collected and to satisfy legal, regulatory, tax, accounting, or reporting requirements (e.g., statutory guest registration retention).
– Criteria used include the nature and sensitivity of the data, risk of harm, our operational needs (e.g., dispute resolution), and legal obligations.
– When data is no longer needed, we take reasonable steps to anonymize or securely delete it.

8) Security

– We implement reasonable administrative, technical, and physical safeguards to protect personal data, including access controls, encryption-in-transit where appropriate, network and system monitoring, staff confidentiality obligations, and secure disposal practices.
– Payments are processed through vetted payment providers; we do not store full card PAN/CVV on our systems.
– No method of transmission or storage is 100% secure. We cannot guarantee absolute security but strive to protect your data and will act promptly on suspected incidents in accordance with applicable laws.

9) Cookies and similar technologies

– We use cookies and similar technologies on our website to:
– Enable essential functions (strictly necessary cookies)
– Measure and improve performance and user experience (analytics)
– Personalize content and, where applicable, deliver offers or ads (marketing)
– You may manage your cookie preferences via your browser settings and, where available, our cookie banner controls. Blocking non-essential cookies may affect site functionality.
– For EEA/UK visitors, we will seek consent for non-essential cookies as required by law.

10) CCTV and on-premise notices

– For safety, asset protection, and incident management, CCTV operates in common areas. Signage is displayed where feasible. Footage may be reviewed by authorized staff or disclosed to authorities when required by law.

11) Children and minors

– Our services are generally directed to adults. Minors should be accompanied by a responsible adult. We collect minors’ data only as needed to provide services (e.g., guest registration) and with appropriate consent from a parent/guardian where required by law.

12) Your rights and how to contact us

Malaysia (MY PDPA 2010):
– You may request access to and correction of your personal data we hold.
– You may withdraw consent for processing where consent is the basis (note: this may affect our ability to provide services).
– You may object to direct marketing at any time.
How to exercise your rights:
– Email: info@terrapuri.com or sales@terrapuri.com
– WhatsApp: +60 12-988 8399 / +60 19-221 5341
– We may need to verify your identity. We will respond within a reasonable period (typically within 21–30 days) and inform you of any applicable administrative fees permitted by law for access requests.

Complaints (Malaysia):
– If you believe your data protection rights have been infringed, please contact us first. You may also lodge a complaint with the Malaysian Personal Data Protection Department (Jabatan Perlindungan Data Peribadi, JPDP).

13) Addendum for EEA/UK residents (GDPR/UK GDPR)

Controller: Palms Garden Beach Resort Sdn. Bhd., trading as Terrapuri Heritage Resort.

Legal bases we rely on (Article 6 GDPR/UK GDPR):
– Contract (Art. 6(1)(b)): to process bookings, stays, payments, tours/transfers, and related services
– Legal obligation (Art. 6(1)(c)): guest registration, tax, accounting, regulatory reporting, safety obligations
– Legitimate interests (Art. 6(1)(f)): service improvement, security (including CCTV), fraud prevention, analytics, business operations, customer support; we perform balancing tests as appropriate
– Consent (Art. 6(1)(a)): certain marketing communications, non-essential cookies/trackers, and processing of health-related preferences you voluntarily share for service customization
– Vital interests (Art. 6(1)(d)): emergencies and safety
– Public interest (Art. 6(1)(e)): where applicable (e.g., public health measures)

International transfers:
– Where we transfer your data outside the EEA/UK, we rely on appropriate safeguards such as Standard Contractual Clauses (or UK-approved equivalents) and supplementary measures as necessary, or your explicit consent where suitable.

Your EEA/UK rights:
– Access, rectification, erasure, restriction, portability, and objection (including to processing based on legitimate interests and to direct marketing)
– Withdraw consent at any time where consent is the legal basis, without affecting prior lawful processing
– Lodge a complaint with your local supervisory authority

Contact for EEA/UK data subjects:
– Email: info@terrapuri.com (Subject line: “Privacy – EEA/UK Request”)
– We currently do not maintain an EU/UK establishment; we will engage with you directly via the above contact.

14) Messaging platforms (e.g., WhatsApp)

– We commonly communicate with guests via WhatsApp for reservations and service coordination. Using such platforms means your personal data may be processed by those platforms under their own terms and policies. Please avoid sharing sensitive information via unsecured channels. You may request to switch to email.

15) Links and third-party sites

– Our website may link to third-party sites or services. We are not responsible for their privacy practices. Review their privacy notices before providing personal data.

16) Changes to this Policy

– We may update this Privacy Policy from time to time to reflect operational, legal, or regulatory changes. The “Last updated” date indicates the latest version. Material changes may be notified via our website or direct communication where appropriate. Continued use of our services after changes indicates acceptance.

17) Governing law; language

– This Privacy Policy is governed by the laws of Malaysia. If translated, the English version prevails in case of inconsistency.

Quick reference (non-exhaustive, subject to change)
– Typical data we collect: identity, contact, passport/visa, booking/stay details, payment references, preferences, CCTV, online identifiers
– Typical uses: bookings and stays, payments, guest services, safety/CCTV, legal compliance, communications, marketing (with consent), analytics
– Typical disclosures: service providers (IT, payments, analytics), tour/transfer operators, event vendors, authorities when required by law
– Your choices: access/correction, withdraw consent (where applicable), opt out of marketing, manage cookies
– Contact: info@terrapuri.com / sales@terrapuri.com, +60 9-624 5020, WhatsApp +60 12-988 8399 / +60 19-221 5341

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us using the details above.