Privacy policy – Rahmat Borneo Tours

This policy explains how Rahmat Borneo Tours handles personal data when you visit this website or contact me. It is written to meet the EU/UK General Data Protection Regulation (GDPR) and Malaysia’s Personal Data Protection Act 2010 (PDPA).

Who is responsible

Rahmat Borneo Tours – Rahmat, a local tour guide based in Sandakan, Sabah, Malaysia. You can reach me on WhatsApp or by phone using the details in the contact section.

What this website collects

No cookies and no advertising tracking. The website does not set cookies, does not use advertising or social-media pixels and does not create visitor profiles.
Technical logs. The hosting provider (Cloudflare, Inc.) processes technical data such as your IP address, browser type and the page requested in order to deliver the website and protect it against attacks. These logs are kept only for a short time. Legal basis: legitimate interest in a secure, working website (GDPR Art. 6(1)(f)).
Visitor statistics. To see how many people visit, from which countries, and which buttons are used (for example the WhatsApp button), the website sends anonymous page views and clicks to Umami Cloud (Umami Software, Inc.). No cookies are set, no profiles are built and you cannot be identified; your IP address is used only to derive the country and is not stored. Legal basis: legitimate interest in improving the website (GDPR Art. 6(1)(f)). Data is kept for up to 6 months.
Language preference. If you close the language suggestion, your browser remembers this in its own local storage. Nothing is sent to me.
Google reviews. If the reviews section shows live Google reviews, your browser loads the reviewers’ profile pictures directly from Google, which can see your IP address.
Links to other services. Links to WhatsApp, Facebook, Instagram, Google and APE Malaysia lead to their own websites; their privacy policies apply there.

When you contact me

When you write to me on WhatsApp or call me, I receive your name, phone number and whatever you tell me about your trip (dates, number of people, wishes and, if you choose to share it, information about diet or health). I use this only to reply to you, plan and run your trip and handle payment.

Legal basis (GDPR): steps before a contract and performance of the contract (Art. 6(1)(b)); for health information you share voluntarily, your explicit consent (Art. 9(2)(a)), which you can withdraw at any time.
PDPA: by contacting me you consent to processing for these purposes. Providing data is voluntary, but without it I cannot arrange a trip.
Retention: messages about enquiries that do not lead to a trip are deleted no later than 12 months after our last contact; information about a booked trip is kept only as long as needed for the trip and as required by law.

Who else receives data

WhatsApp (Meta) or your phone operator, as the communication service you choose.
Partners needed for your trip (for example parks, boat operators or accommodation) – only when necessary and only the details they need, such as names for a booking.
Authorities, where the law requires it.

Some of these providers are located outside Malaysia and the EU (for example in the USA). Where the GDPR applies, transfers are based on the EU–US Data Privacy Framework or standard contractual clauses.

Your rights

You can ask for access to your data, its correction or deletion, restriction of processing and data portability, object to processing, and withdraw consent at any time. Under the PDPA you have the right of access and correction and may limit processing. Just send me a message on WhatsApp; I will reply within 21 days. You can also complain to your national data-protection authority (in the EU/UK) or to the Personal Data Protection Commissioner of Malaysia.

Changes

I may update this policy; the date at the top shows the current version.