Privacy Policy

1. What Personal Data We Collect

We collect personal data only when it is necessary to provide our services or to communicate with you. The categories of data we may collect include:

• Identification data: Full name, nationality, and passport or identity card number (required for certain properties under Malaysian law).
• Contact data: Email address, phone number, and postal address.
• Stay data: Proposed travel dates, group composition, special requests, and preferences shared during the enquiry process.
• Financial data: Payment references sufficient to confirm receipt of cleared funds. We do not store full card numbers on our systems.
• Website data: IP address, browser type, pages visited, and session duration — collected via cookies and analytics tools where you have given consent.

Legal basis: Contract performance, legal obligation (under Malaysian property and tourism regulations), legitimate interest, and — for marketing communications — your explicit consent.

2. How We Use Your Personal Data

Your data is used only for the purposes described below. We do not sell personal data to third parties under any circumstances.

• Processing your enquiry and confirming availability at the property you are interested in.
• Preparing and administering your stay agreement.
• Coordinating pre-arrival arrangements with property staff on your behalf.
• Providing ongoing support during your stay.
• Sending service updates directly related to your booking (e.g., confirming an arrival time change).
• Complying with Malaysian legal obligations including property registration where required.
• Sending occasional updates about new properties or seasonal availability — only where you have opted in.

3. Data Retention

We retain personal data only for as long as necessary:

• Enquiry data where no booking results: deleted within 12 months of the last communication.
• Booking and stay records: retained for 7 years in line with Malaysian financial record-keeping requirements.
• Marketing consent records: retained until you withdraw consent, plus 12 months thereafter.
• Website analytics data: aggregated and anonymised after 26 months.

4. Who We Share Data With

We share the minimum data necessary with third parties in the following categories:

• Property staff: Name, arrival date and time, and relevant preferences are shared with the household team at your property to prepare for your stay.
• Payment processors: Payment data is handled by our payment provider and not retained by Langit Stays beyond confirmation of receipt.
• Legal authorities: Where required by Malaysian law or court order, we may be required to disclose data. We will notify you where possible and permitted.
• Analytics services: Anonymised website usage data may be processed by analytics providers such as Google Analytics where cookie consent has been given.

We do not share data with advertisers, data brokers, or any party for commercial purposes without your explicit consent.

5. How We Protect Your Data

We implement technical and organisational measures appropriate to the sensitivity of the data we hold:

• All data transmission is encrypted using TLS (HTTPS).
• Access to guest records is restricted to team members who require it to carry out their role.
• Passwords and credentials are stored using current hashing standards.
• In the event of a data breach affecting your personal information, we will notify you and the relevant Malaysian authority within the timeframes required by the PDPA.

6. Cookies

Our website uses cookies to ensure it functions correctly and, where you have consented, to understand how visitors use the site. Essential cookies are necessary for the website to operate and are set automatically. Analytics and preference cookies are only set following your consent. You can review and change your cookie preferences at any time via our Cookie Policy page.

7. Your Rights

Under the PDPA and where applicable to your circumstances, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you.
• Right of correction: Ask us to correct inaccurate or incomplete data.
• Right to withdraw consent: Withdraw marketing consent at any time without affecting the lawfulness of prior processing.
• Right to limit processing: Request that we restrict use of your data in certain circumstances.
• Right to complain: Lodge a complaint with the Department of Personal Data Protection Malaysia (PDPD) if you believe we have not handled your data appropriately.

To exercise any of these rights, write to us at [email protected]. We will respond within 21 days.

8. Third-Party Links

Our website may include links to third-party sites, such as map services or local activity providers. Once you leave our website, this privacy policy no longer applies. We recommend reviewing the privacy notices of any external sites you visit.

9. Children

Our services are directed at adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If you believe a minor has submitted data to us, please contact us at [email protected] so we can remove it promptly.

10. Changes to This Policy

We may update this privacy policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this page. Where changes are significant, we will notify active guests by email. Continued use of our services after any update constitutes acceptance of the revised policy.

11. Contact Us

If you have questions about this policy or wish to exercise your rights: