Privacy Policy
Guidlaysia Platform
Effective Date: 4 July 2026
Last Updated: 4 July 2026
1. Introduction
Guidlaysia ("we", "us", "our", or the "Platform") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, store, and protect your personal data when you use our platform and services.
This Privacy Policy is issued in compliance with the Personal Data Protection Act 2010 (PDPA) [Act 709] of Malaysia and its subsidiary regulations, including:
- Personal Data Protection Regulations 2013
- Personal Data Protection (Class of Data Users) Order 2013
- Personal Data Protection Standards 2015
By accessing or using the Platform, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.
2. Data Controller
The data controller responsible for your personal data is:
Guidlaysia
Email: support@guidlaysia.com
Website: www.guidlaysia.com
For any inquiries regarding this Privacy Policy or your personal data, please contact our Data Protection Officer at: dpo@guidlaysia.com
3. Personal Data We Collect
Under the PDPA, "personal data" means any information that relates directly or indirectly to a data subject who is identified or identifiable from that information.
3.1. Information You Provide Directly
| Data Category | Specific Data | Purpose |
|---|---|---|
| Account Information | Name, email address, username, password | Account creation and authentication |
| Profile Information | Gender, date of birth, country, city, occupation, bio, profile picture, cover photo | Profile personalization |
| Contact Information | Phone number, WhatsApp number, address | Communication and service delivery |
| Authentication Data | Google OAuth tokens (if using Google sign-in) | Secure authentication |
| Application Data | University/institute application details | Education application services |
| Content Data | Posts, comments, reviews, blog contributions | Community participation |
| Marketplace Data | Listings, transaction details | Marketplace services |
| Communication Data | Messages, connection requests | User-to-user communication |
3.2. Information Collected Automatically
| Data Category | Specific Data | Purpose |
|---|---|---|
| Device Information | Device type, operating system, browser type | Service optimization |
| Usage Data | Pages visited, features used, time spent | Service improvement |
| Log Data | IP address, access times, error logs | Security and troubleshooting |
| Location Data | General location (derived from IP or city selection) | Location-based services |
| Analytics Data | Interaction patterns, feature engagement | Platform analytics |
3.3. Information from Third Parties
- Google OAuth: Name, email address, and profile picture (when you choose to sign in with Google)
- Service Providers: Tour operators, accommodation providers, or educational institutions may provide information related to your bookings or applications
4. Sensitive Personal Data
Under Section 40 of the PDPA, we are mindful of sensitive personal data. We do NOT intentionally collect:
- Physical or mental health information
- Political opinions
- Religious beliefs
- Criminal records
- Any other data classified as sensitive under the PDPA
If we inadvertently receive sensitive personal data, we will delete it promptly unless we have obtained your explicit consent for its processing.
5. Purpose of Processing
We process your personal data for the following purposes (in accordance with Section 6(1) of the PDPA):
5.1. Primary Purposes (Necessary for Service Delivery)
- Creating and managing your Account;
- Providing the Services you have requested (education information, tour bookings, accommodation, events, community features, marketplace);
- Processing applications to educational institutions;
- Facilitating communication between Users;
- Processing bookings and transactions;
- Providing customer support;
- Ensuring platform security and preventing fraud.
5.2. Secondary Purposes (With Your Consent)
- Sending promotional materials and newsletters;
- Personalized content recommendations;
- Platform analytics and improvement;
- Research and statistical analysis (using anonymized data);
- Sharing relevant opportunities (events, tours, educational programs).
You may withdraw your consent for secondary purposes at any time through your Account settings or by contacting us.
6. Legal Basis for Processing
Under the PDPA, we process your personal data based on:
6.1. Consent (Section 6(1)): Your explicit consent given during Account registration and through your privacy settings (show_email, show_phone, is_private).
6.2. Contractual Necessity: Processing necessary for the performance of a contract (e.g., processing a tour booking you have made).
6.3. Legal Obligation: Processing required to comply with Malaysian law (e.g., record-keeping requirements).
6.4. Legitimate Interests: Processing necessary for our legitimate interests (e.g., platform security, fraud prevention), provided such interests do not override your fundamental rights.
7. Your Privacy Controls
We provide you with granular privacy controls:
| Setting | Description | Default |
|---|---|---|
| Show Email | Controls whether your email is visible to other Users | Off |
| Show Phone | Controls whether your phone number is visible to other Users | Off |
| Private Account | When enabled, only your photo and name are visible to others | Off |
You can modify these settings at any time through your Account profile settings.
8. Data Disclosure and Sharing
8.1. We May Share Your Data With:
- Service Providers: Third-party companies that assist us in operating the Platform (hosting, analytics, email services), bound by data processing agreements;
- Educational Institutions: When you submit applications through the Platform;
- Tour/Accommodation Operators: When you make bookings;
- Other Users: According to your privacy settings (Section 7);
- Legal Authorities: When required by Malaysian law, court order, or to protect our legal rights.
8.2. We Will NOT:
- Sell your personal data to third parties;
- Share your data with third parties for their direct marketing without your explicit consent;
- Disclose your personal data to parties outside Malaysia without ensuring adequate safeguards (in compliance with Section 129 of the PDPA).
8.3. Cross-Border Data Transfer
If your personal data is transferred outside Malaysia, we will ensure that:
- The receiving country provides an adequate level of data protection; or
- Appropriate safeguards are in place (contractual clauses, consent); or
- The transfer is necessary for the performance of a contract between you and us.
This is in compliance with Section 129 of the PDPA and the Personal Data Protection (Transfer of Personal Data to Places Outside Malaysia) Order.
9. Data Retention
9.1. We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law.
9.2. Retention periods:
| Data Type | Retention Period |
|---|---|
| Active Account Data | Duration of Account + 90 days after archival |
| Archived Account Data | 90 days from archival date, then permanently deleted |
| Transaction Records | 7 years (as required by Malaysian tax laws) |
| Log/Security Data | 12 months |
| Analytics Data (anonymized) | Indefinitely |
| Communication Records | 2 years or until Account deletion |
9.3. Upon expiry of the retention period, your data will be securely deleted or anonymized.
10. Data Security
We implement appropriate technical and organizational measures to protect your personal data, in accordance with the Personal Data Protection Standards 2015:
10.1. Technical Measures:
- Encryption of data in transit (TLS/SSL);
- Secure password hashing;
- OAuth 2.0 for third-party authentication;
- Regular security assessments;
- Access controls and authentication mechanisms.
10.2. Organizational Measures:
- Staff training on data protection;
- Data access limited to authorized personnel on a need-to-know basis;
- Incident response procedures;
- Regular review of security policies.
10.3. Breach Notification: In the event of a personal data breach that may cause significant harm, we will:
- Notify the Personal Data Protection Commissioner as soon as practicable;
- Notify affected Users without undue delay;
- Take immediate steps to mitigate the breach.
11. Your Rights Under the PDPA
Under the PDPA, you have the following rights:
11.1. Right of Access (Section 30)
You have the right to request access to your personal data held by us. We will respond to your request within 21 days.
11.2. Right of Correction (Section 34)
You have the right to request correction of any personal data that is inaccurate, incomplete, misleading, or not up-to-date.
11.3. Right to Withdraw Consent (Section 38)
You may withdraw your consent to the processing of your personal data at any time. Note that withdrawal of consent may affect our ability to provide certain Services to you.
11.4. Right to Prevent Processing (Section 42)
You have the right to request that we cease processing your personal data if it is causing or likely to cause substantial damage or distress.
11.5. Right to Prevent Direct Marketing
You have the right to opt out of receiving marketing communications at any time.
11.6. How to Exercise Your Rights
To exercise any of these rights, please:
- Email us at: dpo@guidlaysia.com
- Use the in-app privacy settings
- Write to us at our registered address
We will respond to all legitimate requests within 21 days. We may require verification of your identity before processing your request.
12. Cookies and Tracking Technologies
12.1. We use cookies and similar technologies to:
- Maintain your session and authentication state;
- Remember your preferences;
- Analyze Platform usage;
- Improve our Services.
12.2. Types of cookies we use:
| Cookie Type | Purpose | Duration |
|---|---|---|
| Essential | Authentication, security, basic functionality | Session |
| Functional | User preferences, language settings | 1 year |
| Analytics | Usage statistics, performance monitoring | 1 year |
12.3. You can control cookies through your browser settings. Disabling essential cookies may affect Platform functionality.
13. Children's Privacy
13.1. Our Platform is not directed at children under the age of 13.
13.2. We do not knowingly collect personal data from children under 13. If we become aware that we have collected personal data from a child under 13, we will take steps to delete such data.
13.3. Users aged 13-17 may only use the Platform with parental or guardian consent and supervision.
14. Third-Party Links and Services
14.1. The Platform may contain links to third-party websites or services (e.g., university websites, tour operator sites, Google services).
14.2. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies before providing any personal data.
15. Changes to This Privacy Policy
15.1. We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons.
15.2. We will notify you of material changes through:
- Email notification to your registered email address;
- A prominent notice on the Platform;
- An in-app notification.
15.3. The "Last Updated" date at the top of this policy indicates when it was last revised.
15.4. Your continued use of the Platform after any changes constitutes your acceptance of the updated Privacy Policy.
16. Complaints
16.1. If you are dissatisfied with how we handle your personal data, you may:
- Contact us directly at dpo@guidlaysia.com;
- Lodge a complaint with the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi) Malaysia:
- Website: www.pdp.gov.my
- Address: Aras 6, Kompleks Kementerian Komunikasi dan Multimedia, Lot 4G9, Persiaran Perdana, Presint 4, 62100 Putrajaya, Malaysia
17. Governing Law
This Privacy Policy is governed by and construed in accordance with the laws of Malaysia, specifically the Personal Data Protection Act 2010 (Act 709).
18. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Guidlaysia
Email: support@guidlaysia.com
Data Protection Officer: dpo@guidlaysia.com
Website: www.guidlaysia.com
This Privacy Policy is effective as of 4 July 2026.
Acknowledgment and Consent
By creating an Account on Guidlaysia, you acknowledge that:
- You have read and understood this Privacy Policy;
- You consent to the collection, use, and processing of your personal data as described herein;
- You understand your rights under the Personal Data Protection Act 2010;
- You may withdraw your consent at any time, subject to legal and contractual restrictions.