Privacy Policy

Last updated: 23 June 2026

This Privacy Policy explains how GEO Travel & Tours Sdn Bhd (“we”, “us”, the “Company”) collects, uses, discloses and protects your personal data when you use the Geo Travel Connection platform — our website at geotravelconnection.com and our mobile application (together, the “Platform”). We handle personal data in accordance with Malaysia’s Personal Data Protection Act 2010 (PDPA) and other applicable laws.

1. Who we are

Geo Travel Connection is a marketplace connecting travellers with licensed travel agencies, tour guides, and mutawifs (Hajj/Umrah pilgrimage guides) in Malaysia and Saudi Arabia. The data controller is GEO Travel & Tours Sdn Bhd.

2. Information we collect

  • Account & profile: name, email address, phone number, password (stored only as a secure hash), preferred language and region.
  • Identity & verification (providers): business registration (SSM), MOTAC licence, MyKad/IC, passport, Saudi visa/Iqama and related documents you upload for KYC and regulatory compliance.
  • Bookings: trip details, travel dates, number of participants, group/jemaah member details you provide, and special requests.
  • Payments: processed by our third-party payment gateways (Billplz, Revenue Monster, Moyasar). We do not store your full card or bank credentials; we retain transaction references and status.
  • Location: if you grant permission, GPS location for trip check-in, geofence validation, and safety features (e.g. SOS, location sharing).
  • Photos & media: images you upload (verification documents, package photos for agencies).
  • Communications: in-platform messages, ratings and reviews, and support correspondence.
  • Technical: device information, app version, and authentication tokens stored on your device (browser storage on web, secure storage on mobile).

3. How we use your data

  • To create and manage your account and provide the Platform’s features.
  • To process bookings, payments, refunds and tax invoices.
  • To verify identities and licences (KYC), as required by Bank Negara Malaysia and MOTAC.
  • To enable communication between travellers and providers.
  • To provide safety features (check-in, SOS, location sharing) and prevent fraud or off-platform circumvention.
  • To send service notifications by email, SMS and push (booking updates, messages, verification, password resets).
  • To comply with legal obligations and maintain audit records.

4. Who we share data with

We share personal data only as needed to run the service:

  • Travel providers (agencies, guides, mutawifs) you book with — to fulfil your booking.
  • Service providers who process data on our behalf: hosting and database (Supabase), email (SendGrid), SMS (Twilio), push notifications (Firebase), and the payment gateways named above.
  • Authorities where required by law, regulation, or valid legal process.

We do not sell your personal data.

5. International transfer

Because the Platform serves Malaysia and Saudi Arabia, some data (e.g. for pilgrimage services) may be processed in or transferred to Saudi Arabia and to our service providers’ data centres. We take reasonable steps to ensure such transfers are protected.

6. Data retention

We keep personal data only as long as necessary for the purposes above. Certain records (e.g. transaction and audit logs) are retained for up to 7 years to meet financial and regulatory requirements. When you delete your account, we anonymise or remove personal data except where retention is legally required.

7. Your rights (PDPA)

Subject to applicable law, you may:

  • Access and request a copy of your personal data.
  • Correct inaccurate data.
  • Withdraw consent or limit processing.
  • Request deletion of your account and data.

Logged-in users can export their data or request deletion at Account → Privacy & data, or contact us at privacy@geotravelconnection.com.

8. Security

We use industry-standard measures including encryption in transit, hashed passwords, row-level access controls, and restricted access to documents via short-lived signed links. No method of transmission or storage is 100% secure, but we work to protect your data.

9. Children

The Platform is intended for users aged 18 and above. We do not knowingly collect data from children without appropriate consent.

10. Changes to this policy

We may update this policy from time to time. Material changes will be notified through the Platform. The “Last updated” date at the top reflects the latest version.

11. Contact us

For privacy questions or to exercise your rights, contact GEO Travel & Tours Sdn Bhd at privacy@geotravelconnection.com.