EPP Privacy Notice

September 2024 version

Notice

September 2024 version

INTRODUCTION

Ikhlas Com Travel Sdn Bhd (Registration No: 201801010997 (1273013-P))(“IKHLAS”) and Citaglobal Capital Sdn Bhd (Registration No: 200701025683 (783704-V))("CG Capital") are concerned about your right to privacy. This Notice is jointly issued by IKHLAS and CG Capital (“we”, “us”, “our”) as the data users pursuant to the Personal Data Protection Act 2010 (“PDPA”), and it shall apply to you as a data subject. We together with our subsidiaries and affiliates, pledge to be responsible when gathering your personal information and to protect your privacy in every possible way. This Notice serves to inform you about your rights in respect of your personal information that is being processed or that is being collected and further processed by us on or our behalf.

We reserve the right to change, amend and/or vary this Notice at any time and will only publish the most updated version. To distinguish the version between old and latest, we will include the date of publication at the beginning of the Notice. Any such amendments will be effective upon such notification. You are advised to keep up to date and read the latest version of the Notice. By continuing to engage with us and/or accessing our www.ikhlas.com website and IKHLAS mobile application (“the “Platform”), after the issuance of such amendment notice, you will be considered as having agreed to this Notice (as amended and updated).

Please note that this Notice is issued in both Malay and English languages and in the event of any inconsistency, the English version shall prevail.

By visiting IKHLAS’s Platform, you are deemed to have read and agreed to be bound by this Notice.

INFORMATION COLLECTION

We wish to inform that we will collect and maintain information that you enter on the Platform or give us in any other way (collectively, “Personal Information”). You can choose not to provide certain information, but you will not be able to enjoy all the features of the Platform and services provided by us. Personal Information we collect from you helps us to personalise and continually improve your online experience. Here are the types of Personal Information that we may collect:

Personally identifiable information e.g. Name, photo, facial features, gender, date of birth, nationality, passport/identification card number, passport expiry date, passport issuing country and country of residence;
Contact information e.g. address, email address and phone numbers;
Payment information e.g. credit or debit card information, including the name of cardholder, card number, card issuing bank, card issuing country, card expiry date and banking account details;
Travel information e.g. flight information, and currency, departure destination or other product preferences;
Health information, e.g. health issues relevant to your travel arrangement or medical records and requests;
Technical information e.g. IP address; and
Financial information e.g. employment information, income and liability details, necessary for the purpose of the Easy Payment Plan ("EPP") application.

When you interact with applications created by us or our affiliates, we shall collect information about your location and mobile device. The information shall be used to provide you with location-based services such as search results and marketing content. You may decline to share your Personal Information with us, or disable location services on your mobile device at any time.

COOKIES

Cookies are small files containing information which are downloaded to your device when you visit our Platform. We use cookies to recognise your preference information, keep track of your bookings and facilitate site administration. If you continue to browse the Website without changing your web browsers or device’s settings that control cookies, you agree to receive cookies when you use the services on the Platform.

Most web browsers automatically accept cookies, but, if you prefer, you may set your browser to prevent it from accepting cookies. The “help” portion of the toolbar on most browsers will tell you how to disable cookies.

There are 4 types of cookies used on the Platform:

Functionality: These cookies enable you to use our services. These cookies are essential to enable you to browse our services and use certain features. Disabling them may prevent you from using certain parts of the services. Without these cookies, services like login, booking and paying activity cannot be provided. These cookies also help keep our services safe and secure.
Preference: These cookies store information such as your preferred country, language selection and website preferences. Without these cookies, our services may not be able to remember certain choices you’ve previously made or personalise your browsing experience by providing you with relevant information.
Analytics: These cookies collect information about how you use our services such as which pages you visit regularly. These cookies are used to provide you high-quality experience by doing things such as tracking page load, site response times, and error messages.
Content/Advertising: These cookies gather information about your use of our services so we can improve your experience and provide you with more relevant content and advertising. They remember that you've visited our services and help us understand usage of our services. Some of these cookies are from third parties that collect information about users of our services in order to provide advertising (on our services and elsewhere) based on users’ online activities (so-called "interest-based advertising") on our services and elsewhere online. The third parties involved in interest-based advertising collect internet browsing information (e.g. websites visited, time of visit) across different websites and over time, and they can use the information they collect on our services to provide you ads (from us and other companies) across the internet.

USE OF INFORMATION COLLECTED

Personal Information obtained from you may be used as follows:

to provide you with products and/or services which you have subscribed for and to notify you about important changes or developments to the features;
to send you information on the products and services, and special promotional offers, newsletters or customer survey forms and questionnaires;
to provide you with services, benefits, information, to manage or process any transactions you have undertaken on any programs (e.g. reward programs, or in respect of any programs with our respective partners including co-brand programs and/or other business collaborations);
to process your payment transactions and for other operational and administrative purposes, including without limitation, sending you notifications, and managing your account;
to provide you with services, benefits, information, to manage or process any transactions with any of our partners and respective group companies, including but not limited to our shareholders, related corporations, affiliates, subsidiaries, fellow subsidiaries and associates in relation to the services, benefits and/or privileges provided to you;
updating and managing the accuracy of our records; prevention, detection or prosecution of crime, and complying with legal and regulatory obligations;
to conduct assessment and analysis behaviour scoring, market, product and trend analysis and market research;
to conduct internal activities, administrative, operational, marketing, planning, product or service development, troubleshooting and research requirements;
to administer your participation in contests or campaigns that we shall run from time to time;
to provide you with information on products and our services and that of our related corporations, affiliates, subsidiaries and associates;
to provide you with information on products and services of our business partners;
cross selling, marketing and promotions including administering offers and competitions;
to manage your account including taking the necessary action in relation to any irregular or suspicious activities in respect thereto;
communications and ensuring customer satisfaction, which shall include conducting surveys to improve the quality of our products and services, responding to inquiries and complaints and to generally resolve disputes or to enforce our terms and conditions, including the terms and conditions relating to our products and/or services;
maintaining your member account history for present and future reference (if any);
enabling an actual or proposed assignee of us, or participant or sub-participant of us to evaluate your transactions which are intended to be the subject of the assignment, participation or sub- participation (if any);
protecting our interests and other ancillary or related purposes;
with regards to interaction with applications created by us, the information collected with regards to your location and mobile device can be used to provide you with location-based services such as search results and marketing content;
for such other purposes as set out in any other terms and conditions (including product terms and conditions and campaign terms and conditions);
to check on your credit worthiness or perform a check on any outstanding litigation
to obtain and verify any information relating to your credit intelligence, profile and other credit information;
to obtain and verify any information about you as CG Capital in CG Capital's sole discretion shall deem fit, including for the purpose of complying with anti-money laundering laws;
to disclose any information and data relating to you to Bank Negara Malaysia (BNM), any governmental or regulatory agency or authority, any credit bureau, any credit reporting agency, and any other individual to whom disclosure is permitted and/or required by law;
to make available promotions, offers, products or services, which may or may not belong to us but relate to the products or services you have elected to obtain from us; or
for any purpose made known to you at the time of collection of your personal information (Collectively referred to as “Purpose”)

We may keep your personal data for a reasonable period to enable us to fulfil the Purpose.

If you have elected to be a member of IKHLAS, you will also be a participant in the AirAsia membership and BIG Loyalty Program that is administered by IKHLAS's subsidiary BIGLIFE Sdn Bhd (Registration No: 201001040731 (0924656-U)). In such cases, your Personal Information may also be used to administer your membership and offer you the perks which you are eligible for under this program.

Please note that it is necessary for us to process your personal information for the Purpose, and without which we will not be able to provide the product and/or service that you have requested from us or to perform and/or carry out any of the above-mentioned Purpose. If you fail to provide us with Personal Information stated in the paragraph above, we may not be able to perform and/or carry out any of the Purpose.

When you interact with applications created by us or our affiliates, we may collect information about your location and mobile device. The information shall be used to provide you with location-based services such as search results and marketing content. You may decline to share your Personal Information with us, or disable location services on your mobile device at any time. You can choose not to provide certain information, but you will not be able to enjoy all the features of the Platform and services provided by us.

SHARING OF INFORMATION COLLECTED

You hereby consent that we may also process and disclose your Personal Information with IKHLAS's parent company Capital A Berhad, AirAsia Group of Companies, and any of its respective subsidiaries, our subsidiaries and affiliates and/or any third parties (within or outside Malaysia) processing the Personal Information for and on behalf of us for the Purpose, such as credit card verification providers, data analytics, marketing agency, travel service providers, travel-related businesses, partner airlines, airport authorities, customs, immigration authorities, safety and security personnel, parties which have business or contractual dealings with us and our subsidiaries or affiliates. Save for the foregoing (which you hereby give your consent), your Personal Information will not be knowingly disclosed to any other third party.

You also consent that your Personal Information may also be disclosed or transferred to any of our actual and potential assignee, transferee or acquirer (including our affiliates and subsidiaries), or in connection with any corporate restructuring or exercise including our restructuring to transfer the business, assets and/or liabilities.

However, to ensure that you will not receive unwanted communications, only information with regards to promotions, offers, products or services which are relevant to your transaction with us, or that you have selected or marked as interested in your member profile, will be shared with the respective business partners, service providers or third parties.

In the circumstances set out in this Notice where we share your Personal Information to a third party, we will ensure that the security measures that such party has in place in relation to the processing of your data are at least as stringent as those employed by us, if not better. This does not apply where we are required by law to pass your information to a third party.

In the event we go through a business transition, such as sale of part or all of our assets, merger or acquisition, your information will likely form part of this transition and be transferred.

We do not sell or rent any of your Personal Information on the Platform to any other parties.

For inquiries on management of Personal Information disclosed to, or shared with us and/or third parties hereunder, please see “Contact Information” section below.

DATA STORAGE

Our headquarters are located in Malaysia. However, we may transfer and store your Personal Information on our servers located overseas. Such transfers are necessary pursuant to our contract with you and/or our contract(s) with the relevant third parties. You hereby consent that your Personal Information may be transferred to any place outside Malaysia for the purposes of Data Storage stated herein.

We will secure the storage in compliance with the minimum-security measures prescribed under the PDPA, its regulation and standards, in the following manners:
register those who have access to the storage;
control and limit access based on necessity;
maintain proper record of access and transfer of Personal Information;
ensure all employees of ours protect confidentiality;
conduct awareness programmes to educate employees on responsibility to protect Personal Information;
establish physical security procedures;
bind third parties involved in processing of Personal Information; and
do not use removable devices and cloud computing services to transfer or store Personal Information without written consent from our senior management.

YOUR CONSENT

We or any third-party service providers engaged by us will obtain your consent to collect and use your Personal Information at the time of collection, subject to certain legally prescribed circumstances where your consent is not required. Where required by law, we will adopt an ‘opt-in' policy to obtain your express written consent when collecting your Personal Information. You shall be asked, for example, to sign a form or tick a box.

Generally, in using the Platform, you consent to the collection and use of your Personal Information by us in the ways described above (which shall change from time to time) unless and until you inform us to the contrary. You shall submit a request to withdraw your consent at any time by contacting us. If you have provided us Personal Information of third-party individuals in your travel party, you are required to obtain the individual's prior consent and you represent and warrant that you had or have their consent or are otherwise entitled to provide their personal information to us. By providing us Personal Information of third-party individual(s), you also warrant that the individual(s) is informed of and confirm that the individual has appointed you to act on his/her behalf and has agreed that you can consent to the terms of this Notice.

In most instances, it is obligatory for you to provide us with your Personal Information in order to allow us to satisfy your request or provide you with the service that you have requested for.

However, we will provide you with an avenue to opt-out or unsubscribe from receiving marketing, communications, promotional offers, newsletters or any other communications from us.

ACCESS TO AND CORRECTION OF YOUR PERSONAL INFORMATION

You shall access your Personal Information by logging-in to your Member Profile on www.airasia.com or the Mobile App. You shall ensure that the Personal Information that you provide to us is accurate, complete and not misleading and that such Personal Information is kept up-to-date, and you shall promptly keep us informed in the event the Personal Information is inaccurate, incomplete, misleading or not up-to-date and to then provide us the true, accurate, complete, and updated Personal Information. If there are errors or changes to be made, please contact us and we will work towards either correcting it or discussing alternative actions with you. We will not correct your Personal Information upon request of a third party, unless such third party is able to demonstrate that you have provided the authority to such third party to work with us to correct your Personal Information.

We will be able to provide you your stored Personal Information upon receiving a request via our e-form.

MINORS* UNDER THE LEGAL AGE TO CONTRACT

We cannot distinguish the age of visitors to the Platform. If you are a parent or guardian of someone under the legal age in your respective countries, who has provided us his/her Personal Information without your knowledge and consent, you shall request that we remove such information by contacting us.

LINK TO OTHER SITES

The Platform contains links to other sites (“Third Party Sites”). Please be aware that we are not responsible for the privacy practices or content of those Third Party Sites. We encourage you to read the privacy statements or notices of each site that collects information from you before submitting any personal information. Our Notice applies solely to information collected by us and does not apply to Third Party Sites.

CONTACT INFORMATION

For any queries, concerns or complaints in relation to our handling of your Personal Information or our Notice, please contact IKHLAS’s Compliance Officer at [email protected].

TERMS OF USE

With reference to the terms of use of the Platform, please refer to our Terms of Use for further information.