Privacy Policy

1. About This Policy

This Privacy Policy explains how Xiao Qiang Holidays Sdn Bhd (Company Registration No. 201301017811), trading as XQ Car Rental ("the Company", "we", "us", or "our"), collects, uses, discloses, and protects your personal data when you use our website, mobile applications, and services.

This Policy is to be read together with our PDPA Notice, which sets out your statutory rights under the Personal Data Protection Act 2010 ("PDPA").

2. Information We Collect

We collect personal data that you provide directly, data generated through your use of our services, and data obtained from third parties where lawful.

2.1 Information You Provide

• Full name, gender, date of birth, and nationality.
• Identification documents (passport, MyKad, or other government-issued ID).
• Driving licence details, including International Driving Permit where applicable.
• Contact information (email address, telephone number, postal address).
• Payment information (card details processed through PCI-compliant payment gateways; we do not store full card numbers).
• Booking history and customer service correspondence.
• Emergency contact information where provided.

2.2 Information Generated Through Service Use

• Vehicle GPS and telematics data, including location, speed, mileage, and harsh braking events, where the Vehicle is fitted with such systems.
• Photographs taken at vehicle handover and return.
• CCTV footage at our office and pickup locations.
• Website analytics, cookies, IP address, browser type, and device identifiers.

2.3 Information from Third Parties

• Fraud screening and identity verification providers.
• Credit card issuers and payment processors.
• Insurers, in connection with claims.
• Authorities, where legally required.

3. How We Use Your Information

We use your personal data for the following purposes:

• Processing bookings, payments, and refunds.
• Verifying identity, driving eligibility, and detecting fraud.
• Vehicle handover, recovery, and incident management.
• Insurance administration and claims processing.
• Customer service and communication.
• Compliance with Malaysian law, including reporting to authorities where required.
• Recovery of outstanding amounts, including damage, fines, and unpaid charges.
• Service improvement, internal analytics, and quality assurance.
• Marketing communications, where you have consented or where permitted by law.

4. Legal Basis for Processing

We process personal data on one or more of the following legal bases under the PDPA:

• Performance of our contract with you.
• Compliance with legal obligations.
• Your consent (which you may withdraw at any time).
• Our legitimate interests in operating, securing, and improving our services.

5. Disclosure of Your Information

We may disclose your personal data to the following categories of recipients, only as necessary for the purposes stated in this Policy:

• Fleet partners and third-party vehicle suppliers.
• Payment processors and financial institutions.
• Insurers and insurance adjusters.
• Identity verification and fraud screening providers.
• Legal advisors, auditors, and professional consultants under confidentiality obligations.
• Government authorities, regulators, and law enforcement, where legally required.
• Debt recovery agencies, where outstanding amounts remain unpaid.
• Courts and tribunals, in connection with legal proceedings.

We do not sell your personal data to third parties for marketing purposes.

6. International Transfer of Data

Where we transfer personal data outside Malaysia (for example, to cloud service providers or international payment processors), we ensure that the receiving party provides a level of protection comparable to that required under the PDPA, through contractual safeguards or by the data subject's consent.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, and reporting requirements.

• Booking and rental records: seven (7) years from the end of the Rental Period, in line with Malaysian tax and accounting requirements.
• Identification document copies: three (3) years from the last interaction, unless required longer for legal or insurance purposes.
• CCTV footage: thirty (30) days unless retained for a specific incident.
• Vehicle GPS and telematics data: ninety (90) days unless retained for a specific incident or claim.
• Marketing data: until you withdraw consent or unsubscribe.

8. Data Security

We implement reasonable technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration, and destruction. These include access controls, encrypted payment processing, secure storage, and staff confidentiality obligations.

No method of transmission or storage is completely secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security.

9. Your Rights

Subject to the PDPA, you have the following rights in respect of your personal data:

• Right of access: to request a copy of the personal data we hold about you.
• Right of correction: to request correction of inaccurate or incomplete data.
• Right to withdraw consent: to withdraw consent previously given, subject to legal or contractual restrictions.
• Right to limit processing: to request that we limit certain uses of your data.
• Right to prevent direct marketing: to opt out of marketing communications at any time.

To exercise any of these rights, contact us using the details in Section 12. We may charge a reasonable fee for processing access requests as permitted under the PDPA.

10. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to:

• Enable essential website functionality.
• Remember your preferences.
• Analyse website traffic and user behaviour.
• Deliver relevant advertising, where applicable.

You may disable cookies through your browser settings, though some features of the Platform may not function properly as a result.

11. Children's Privacy

Our services are not directed at persons under the age of eighteen (18). We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us so we can take appropriate action.

12. Contact and Complaints

For questions about this Privacy Policy, to exercise your rights, or to make a complaint, contact our Data Protection Officer:

Xiao Qiang Holidays Sdn Bhd Attn: Data Protection Officer 26 & 28, 1st Floor, Jalan Pandak Mayah 4, Mukim Kuah, 07000 Langkawi, Kedah, Malaysia Website: xqholidays.com.my

If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commissioner of Malaysia at www.pdp.gov.my.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified through the Platform or by email. The current version is identified by its effective date at the top of this document.