This Privacy Policy explains how the Sarawak Tourism Board (“STB”, “we”, “us”) collects and uses personal data when you use the official Sarawak Tourism ticketing platform (the “Platform”). We handle personal data in accordance with Malaysia’s Personal Data Protection Act 2010 (“PDPA”).
By using the Platform or completing checkout, you are notified of the processing described here. Where the PDPA requires consent, we ask for it at the point of collection — for example, when you subscribe to the newsletter.
Who we are
STB operates the Platform. Participating agencies and operators (“Organisers”) offer the events and attractions listed on it. When you buy a ticket, we share the order details the Organiser needs to admit you.
Personal data we collect
We collect:
- Order details: name, email address, and phone number (if you provide one) when you check out as a guest or while signed in.
- Account details: name, email address, phone number, and sign-in credentials if you register.
- Booking details: the event or attraction, ticket type, quantity, seat assignment, and visit date where the product requires one.
- Payment references: order number, amount, currency, and payment status. Card details are collected by our payment provider. We do not store your full card number.
- Newsletter: your email address if you opt in on the homepage.
- Technical data: records needed to operate the service, including the session used to hold a seat and complete checkout, and security logs.
The signed QR code on your ticket identifies the ticket. It does not contain your name, email address, or phone number.
How we use personal data
We use personal data to:
- create and fulfil your order;
- take payment and send receipts;
- email your ticket PDF;
- assign or confirm seats and visit dates;
- allow Organisers to scan tickets and prevent duplicate use;
- answer support requests about your order;
- send the newsletter only if you have opted in; and
- keep the Platform secure and meet our legal duties.
Retention
We keep order and ticket records for as long as needed to fulfil the booking, handle refunds, prevent fraud, and meet accounting or legal requirements. Newsletter addresses are kept until you unsubscribe. We then delete or irreversibly anonymise personal data when we no longer need it.
Security
We limit access to personal data to staff and systems that need it. Tickets use a signed QR code so a scan can be validated without exposing your contact details in the code. No method of transmission or storage is completely secure. We take reasonable technical and organisational measures to protect your data.
Your rights under the PDPA
Subject to the PDPA, you may:
- request access to the personal data we hold about you;
- request correction of personal data that is inaccurate or incomplete; and
- withdraw consent for the newsletter at any time.
To make a request, contact us through the Help centre or the Sarawak Tourism Board website. We may need to verify your identity before we respond.
Children
The Platform is not directed at children. A parent or guardian should buy tickets for a child and provide the contact details used for the order.
Changes to this policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will change when we do. The policy in force when you submit personal data applies to that collection, unless we are required to give you a further notice.
How to contact us and complain
For a privacy question or to exercise your rights, use the Help centre on this website or contact the Sarawak Tourism Board through sarawaktourism.com.
You may also refer a complaint to the Personal Data Protection Commissioner of Malaysia if you are not satisfied with our response.