Privacy Policy

How we collect, use and protect your personal data.

Last updated: 9 October 2026

1. Who we are

JRB Holiday Sdn Bhd ("JRB Holiday", "we", "us") operates this website and is the data controller for the personal data described in this policy. We are based at Plaza Berjaya, Jalan Imbi, Kuala Lumpur, Malaysia, and are licensed by the Ministry of Tourism, Arts & Culture Malaysia (MOTAC). Contact: admin@jrbholiday.com.

2. Information we collect

Account details — your full name, email address, phone number and a hashed form of your password when you register.
Booking and enquiry details — travel preferences, destinations, group details and messages you send us through forms, email, WhatsApp or phone.
Verification data — one-time codes used to verify your email or phone during registration (these expire automatically).
Technical data — IP address, browser type and pages visited, collected through cookies and analytics to keep the site working and improve it.
Agent business details — business name and registration number, if you register as a travel agent.

3. How we use your information

To create and manage your account and keep it secure (including locking accounts after repeated failed sign-in attempts).
To prepare quotations, arrange and manage your bookings, and send you trip-related updates.
To respond to your enquiries and provide customer support.
To meet legal and regulatory obligations, including MOTAC requirements.
To understand how the website is used and improve our services.

We process your data with your consent when you provide it (for example, by registering or submitting an enquiry), and where necessary to fulfil a booking you have requested.

4. Who we share it with

We share only what is needed, and only where it is needed:

Travel suppliers — hotels, airlines, transport providers and tour operators involved in delivering your booking.
Service providers — parties who help us operate the website or send transactional email, under appropriate confidentiality obligations.
Authorities — when disclosure is required by law or regulation.

We do not sell your personal data to anyone.

5. How long we keep it

We keep personal data for as long as your account is active and for as long as needed to provide services and meet legal, accounting or regulatory requirements. Verification codes expire automatically (10 minutes for registration codes, 15 minutes for password-reset codes) and are then unusable.

6. How we protect it

Passwords are stored only as cryptographic hashes — never in plain text. Sessions are protected, access to customer data is restricted to staff who need it for their work, and traffic to this site is served over encrypted connections. No method of transmission or storage is 100% secure, but we review our safeguards regularly.

7. Cookies

We use essential cookies to keep you signed in and to protect forms against abuse, plus analytics cookies to understand how the site is used. You can control cookies through your browser settings; blocking essential cookies may prevent sign-in and forms from working.

8. Your rights

Subject to applicable law (including Malaysia's Personal Data Protection Act 2010), you may:

request access to the personal data we hold about you;
ask us to correct data that is inaccurate or incomplete;
withdraw your consent to marketing or optional data processing at any time;
ask us about our data practices or make a complaint.

To exercise any of these rights, email admin@jrbholiday.com. We will respond as required by law.

9. Children

This website is not directed at children under 18. Accounts are created by the traveller or their authorised booking contact; please do not register children as account holders.

10. Changes to this policy

We may update this policy from time to time. The "Last updated" date above shows when it was last revised. Material changes will be announced on this website.

11. Contact us

Privacy questions?
admin@jrbholiday.com
+60 116-265 8997
Plaza Berjaya, Jalan Imbi, Kuala Lumpur, Malaysia