Privacy Policy

1. Introduction

Ksheyma Sdn. Bhd. (1698520-V) ("Ksheyma.Travel", "we", "us", or "our") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit ksheyma.travel or engage our travel services.

This Policy is issued in compliance with the Personal Data Protection Act 2010 (PDPA) of Malaysia and, where applicable, the General Data Protection Regulation (GDPR) of the European Union.

2. Data Controller

The data controller responsible for your personal data is:

3. Personal Data We Collect

We may collect the following categories of personal data:

• Identity data: full name, nationality, passport or identification number.
• Contact data: email address, telephone number, WhatsApp number, mailing address.
• Health data (where relevant): medical history, treatment requirements, and related health information provided voluntarily for health tourism services.
• Travel data: travel preferences, itinerary details, accommodation requirements.
• Technical data: IP address, browser type, device identifiers, and usage data collected automatically when you visit our website.
• Communications data: records of correspondence between you and us.

Health data is classified as sensitive personal data under the PDPA. We collect it only with your explicit consent and solely for the purpose of arranging your medical travel.

4. How We Use Your Personal Data

We process your personal data for the following purposes and on the following legal bases:

5. Disclosure of Personal Data

We may share your personal data with:

• Healthcare providers and hospitals in Malaysia and Southeast Asia, for the purpose of arranging your medical treatment.
• Travel and hospitality partners (airlines, hotels, tour operators) for the purpose of fulfilling your travel arrangements.
• Service providers who assist us in operating our website and business (e.g. IT, communications, analytics), bound by confidentiality obligations.
• Regulatory and law enforcement authorities, where required by law.

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.

6. Cross-Border Data Transfers

In providing health and leisure tourism services across Southeast Asia, your personal data may be transferred to countries outside Malaysia. Where such transfers occur, we ensure appropriate safeguards are in place in accordance with Section 129 of the PDPA and, where applicable, Chapter V of the GDPR (including Standard Contractual Clauses or adequacy decisions).

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. In general, client records are retained for a minimum of seven (7) years in accordance with Malaysian statutory requirements, after which they are securely deleted or anonymised.

8. Your Rights

Under the PDPA and, where applicable, the GDPR, you have the following rights in respect of your personal data:

• Right of access — to request a copy of the personal data we hold about you.
• Right of correction — to request correction of inaccurate or incomplete personal data.
• Right to withdraw consent — to withdraw consent at any time where processing is based on consent (this does not affect the lawfulness of processing before withdrawal).
• Right to limit processing — to request that we limit the processing of your personal data in certain circumstances.
• Right to erasure (GDPR) — to request deletion of your personal data where there is no compelling reason for its continued processing.
• Right to data portability (GDPR) — to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object — to object to processing based on legitimate interests or for direct marketing purposes.

To exercise any of these rights, please contact us at [email protected]. We will respond within 21 days in accordance with the PDPA.

9. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to enhance your browsing experience and to analyse site traffic. You may control cookie preferences through your browser settings. Essential cookies necessary for the operation of the website cannot be disabled. For more information, please refer to our cookie consent notice displayed on your first visit.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by a revised effective date and will be effective as soon as it is accessible. We encourage you to review this Policy periodically.

12. Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy or our handling of your personal data, please contact our Personal Data Officer at:

If you are located in the European Union and are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.