Your data, handled
under the PDPA 2010.
Tioman SpeedBoat is committed to respecting and protecting your privacy in accordance with the Personal Data Protection Act 2010 of Malaysia. This policy explains what we collect, why, how long we keep it, and your rights.
For all our services, the data controller responsible for your privacy is Tioman SpeedBoat Sdn. Bhd. This Privacy Policy should be read together with our Terms of Use, Terms and Conditions of Carriage, and Refund Policy.
1. Our Legal Basis for Processing Your Personal Information
We will only process your personal information where we have a legal basis to do so under the PDPA and other applicable Malaysian laws.
2. Personal Information We Collect
We collect personal information only with your knowledge and consent — when you use our website, make a booking, contact us, or otherwise interact with our services.
Full name, gender, date of birth, nationality, identification number (NRIC for Malaysians, passport number for foreigners), email, phone, and address.
Travel itinerary, departure and destination jetties, sailing date and time, seat selection, and other booking details.
Card details (cardholder name, card number, expiry, issuing bank), FPX bank details, e-wallet identifiers (TNG, GrabPay, Boost), and transaction records. Sensitive payment data is processed by HitPay and is not stored on our servers.
When you book on behalf of others, we collect their personal information for the purposes of completing the booking and submitting passenger manifests.
Details of any past bookings, including any customer service interactions or feedback.
IP address, browser type and version, operating system, language preferences, and content viewed on our website (collected via cookies and similar technologies).
3. Why We Use Your Personal Information
Your personal information is used for the following purposes:
- To process and confirm your booking and deliver ferry services;
- To send booking confirmations, e-tickets, departure reminders, and other service communications;
- To submit the passenger manifest to the Marine Department of Malaysia (JLM) as required by Malaysian maritime law;
- To verify identity at boarding;
- To process refunds, reschedules, and customer service requests;
- For accounting, billing, auditing, and tax purposes;
- For safety, security, and emergency response on our vessels;
- To send marketing communications (only with your consent and where you have not opted out);
- To improve our website, products, and services through analysis and research.
4. Marketing Communications
With your consent, we may send you marketing messages via email or SMS to keep you updated on:
- Latest fare promotions and seasonal offers;
- Schedule changes and new route announcements;
- Monsoon schedule updates;
- Reminders about upcoming travel dates.
You can unsubscribe from marketing messages at any time by:
- Clicking the “unsubscribe” link in any marketing email;
- Replying to a marketing email with the request to unsubscribe;
- Contacting our customer support team at hello@tiomanspeedboat.com.
We will action your unsubscribe request within 2 business days.
5. When We Share Your Information
We may share your personal information with the following parties:
6. Cookies
We use cookies to recognise your device on subsequent visits, personalise your experience, and improve our website. Cookies do not store sensitive information such as payment details or passwords. We use two types of cookies:
- Session cookies
- Expire when you close your browser.
- Persistent cookies
- Remain on your device until they expire or until you delete them.
You may configure your browser to prompt you before accepting cookies, or to reject all cookies. However, certain features of our website (such as logging in or completing a booking) require cookies to function. Refer to your browser documentation for instructions on managing cookies.
7. Your Rights Under the PDPA
Under the Personal Data Protection Act 2010 of Malaysia, you have the following rights:
Request a copy of any personal information we hold about you.
Request correction of inaccurate or incomplete information.
Withdraw your consent for marketing or other consent-based processing at any time.
Request that we limit the processing of your information in certain circumstances.
Request your data in a portable format.
To exercise any of these rights, please email hello@tiomanspeedboat.com with your full name, booking reference (if applicable), and details of your request. We will respond within 30 business days as required under the PDPA. We may request additional information to verify your identity before responding.
8. Data Retention
We retain your personal information for the following periods:
| Data category | Retention period |
|---|---|
| Booking records | schedule7 years from last booking |
| Passenger manifest data | gavelAs required by JLM |
| Marketing consent records | campaignUntil consent withdrawn |
| Customer service records | support_agent3 years from last interaction |
After these periods expire, your personal information is anonymised or securely deleted.
9. Data Security
We implement industry-standard technical, physical, and managerial safeguards to protect your personal information from unauthorised access, accidental loss, alteration, or destruction. These include:
Encryption for all data transmission between your device and our servers.
Encrypted database storage for all personal data at rest.
Limiting employee access to personal data on a strict need-to-know basis.
Regular security audits and dependency updates across our infrastructure.
For payment processing through our payment partners.
10. Changes to This Policy
We may occasionally update this Privacy Policy to reflect changes in how we process your data or to comply with new legal requirements. Significant changes will be communicated via our website or by email. The “Last updated” date at the top of this policy indicates when it was most recently revised.
11. Contact for Privacy Matters
For any queries, requests, or complaints regarding your personal information or this Privacy Policy, please contact:
26820 Kuala Rompin, Pahang, Malaysia
Want to access or delete your data?
Email us with your full name and booking reference. We respond to all PDPA requests within 30 business days.