Personal Data Protection Notice

1. Purpose of This Notice

This Personal Data Protection Notice ("Notice") is issued by Xiao Qiang Holidays Sdn Bhd (Company Registration No. 201301017811), trading as XQ Car Rental ("the Company"), in accordance with the Personal Data Protection Act 2010 ("PDPA").

This Notice informs you of the personal data we collect, the purposes for which we use it, your rights, and how you may contact us regarding your personal data.

This Notice should be read together with our Privacy Policy, which provides more detailed information about our data practices.

2. Personal Data We Collect

The Company collects and processes the following categories of personal data:

• Identification data: full name, date of birth, gender, nationality, identification document numbers (passport, MyKad, or equivalent), and copies of such documents.
• Driving credentials: driving licence number, issuing country, expiry date, and International Driving Permit details.
• Contact data: residential address, postal address, email address, and telephone number.
• Financial data: payment card details (processed through PCI-compliant payment gateways), billing address, and transaction history.
• Booking and rental data: booking history, vehicle preferences, pickup and return locations, and rental periods.
• Vehicle usage data: GPS location, mileage, telematics data, and incident records (where the Vehicle is fitted with such systems).
• Visual data: photographs taken at vehicle handover and return, and CCTV footage at our premises.
• Communication data: correspondence with our customer service team, including emails, WhatsApp messages, and call records.
• Emergency contact data: name and contact details of the person you nominate.

3. Purposes of Processing

Your personal data is collected and processed for the following purposes:

• To process and manage your booking, including verifying eligibility, identity, and driving credentials.
• To process payments, refunds, deposits, and recovery of outstanding amounts.
• To handle vehicle handover, return, inspection, and incident management.
• To administer insurance coverage and process insurance claims.
• To respond to your enquiries and provide customer service.
• To prevent and detect fraud, money laundering, and other unlawful activity.
• To comply with our legal and regulatory obligations under Malaysian law, including tax, accounting, and reporting requirements.
• To enforce our terms and conditions and pursue debt recovery.
• To improve our services and conduct internal analytics and quality assurance.
• To send marketing communications about our services, where you have consented or where permitted by law.
• To cooperate with police, courts, and regulatory authorities as legally required.

4. Source of Personal Data

We collect personal data:

• Directly from you when you create an account, make a booking, communicate with us, or use our services.
• Automatically when you use our website or our vehicles fitted with telematics systems.
• From third parties, including payment processors, identity verification providers, fraud screening providers, insurers, and authorities, where lawful.

5. Mandatory and Voluntary Data

Most of the personal data we request is mandatory to enable us to provide our services. If you do not provide this data, we will not be able to:

• Verify your identity and driving eligibility.
• Process your booking or release a vehicle to you.
• Process insurance coverage on your behalf.
• Comply with our legal obligations.

Some data is voluntary (such as marketing preferences and emergency contact details). You may decline to provide voluntary data without affecting our ability to provide rental services to you.

6. Disclosure of Personal Data

We may disclose your personal data to the following classes of third parties:

• Companies within our group, subsidiaries, and affiliates.
• Fleet partners and third-party vehicle suppliers fulfilling part of your booking.
• Payment processors, banks, and financial institutions.
• Insurers, insurance brokers, and loss adjusters.
• Identity verification, credit check, and fraud screening service providers.
• IT service providers, cloud hosting providers, and software vendors supporting our operations.
• Legal advisors, accountants, auditors, and other professional consultants under confidentiality obligations.
• Debt recovery agencies, where amounts remain outstanding.
• Government bodies, regulators, courts, and law enforcement, where required by law.
• Any party to whom we may transfer our business or assets in the event of a sale, merger, or restructuring.

7. Transfer of Personal Data Outside Malaysia

Some of the service providers we engage (including cloud hosting and payment processing providers) may be located outside Malaysia. Where personal data is transferred outside Malaysia, we ensure that:

• The recipient country provides a level of protection comparable to the PDPA, or
• Appropriate contractual safeguards are in place to protect your data, or
• You have consented to the transfer.

8. Retention of Personal Data

We retain personal data only for as long as necessary for the purposes set out in this Notice or as required by law. Retention periods are detailed in our Privacy Policy.

9. Your Rights Under the PDPA

You have the following rights in respect of your personal data:

9.1 Right of Access

You may request a copy of the personal data we hold about you. We may charge a prescribed fee for processing your request, as permitted under the PDPA.

9.2 Right of Correction

You may request correction of personal data that is inaccurate, incomplete, misleading, or out of date.

9.3 Right to Withdraw Consent

You may withdraw consent previously given for the processing of your personal data. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and may affect our ability to provide services to you.

9.4 Right to Limit Processing

You may request that we limit the processing of your personal data in certain circumstances.

9.5 Right to Prevent Direct Marketing

You may, at any time and without charge, request that we stop using your personal data for direct marketing purposes.

10. How to Exercise Your Rights

To exercise any of the rights set out above, or for any question or complaint regarding your personal data, please contact our Data Protection Officer:

Data Protection Officer Xiao Qiang Holidays Sdn Bhd 26 & 28, 1st Floor, Jalan Pandak Mayah 4, Mukim Kuah, 07000 Langkawi, Kedah, Malaysia Website: xqholidays.com.my

We will respond to your request within twenty-one (21) days from the date we receive a valid request, as required under the PDPA. Complex requests may require additional time, and we will notify you accordingly.

11. Complaints to the Commissioner

If you are dissatisfied with our handling of your personal data or your request, you may lodge a complaint with the Personal Data Protection Commissioner of Malaysia:

Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi) Ministry of Communications and Digital, Malaysia Website: www.pdp.gov.my

12. Consent

By submitting your personal data to the Company through any of our service channels (including the website, mobile applications, telephone, email, WhatsApp, or in person), you consent to the collection, use, and disclosure of your personal data in accordance with this Notice.

Where you provide personal data of a third party (such as an additional driver or emergency contact), you confirm that you have obtained that person's consent for us to process their personal data in accordance with this Notice.

13. Updates to This Notice

We may update this Notice from time to time to reflect changes in our practices or in applicable law. The current version is identified by its effective date. Material changes will be notified through the Platform or by email.