How we handle personal data in enquiries
You are about to message us and want to know what happens to what you send.
For a planning enquiry, you only need to share your dates, your group size and a rough budget. Keep your IC, passport, card numbers and bank details out of the chat. If you ask for a written quotation, what you send may be passed to the agency preparing it, and our aim is to tell you before that happens.
This page is a plain guide, not our full privacy notice. Read the privacy notice for the formal position, and see about IslandQuest for who we are.
What helps us?
Share these if you are comfortable:
- Your travel dates or a window, such as a month.
- How many adults and children, with child ages if relevant.
- A rough budget range for the trip.
- The island or two you are considering.
- Any need that affects the choice, such as limited mobility or a baby.
What should you keep out of the chat?
Keep these out of the chat:
- IC or passport numbers and photos.
- Bank card numbers, card security (CVV) codes or online banking details.
- Medical details beyond what is needed for a specific access question.
If a seller later asks for identity documents to complete a booking, ask first why they need them, how they will be stored and who can see them.
What does the Malaysian law say?
The Personal Data Protection Act 2010 came into force on 15 November 2013, has seven principles and is overseen by the Personal Data Protection Department (JPDP). A 2024 amendment was gazetted on 17 October 2024 and includes breach notification, with commencement staged from 2025 [1].
The source we used does not verify the detail on consent, so we do not summarise it here. If you want to know your rights over data you have shared, read the regulator’s own guidance or ask us what we hold about your enquiry.
What happens after you message us?
We use what you send to understand your trip, answer your questions and help you ask for a written quotation. If you choose to ask for one, your details may go to the agency preparing it, so they can quote for your dates and group. We aim to tell you first.
You can message us to ask what you have sent and what we hold, and to ask us to stop using it. The privacy notice is the formal statement. If anything on this page differs from the notice, the notice governs.
What should you ask before giving an agency documents?
Use these questions with any seller:
- Which documents do you need, and why?
- How will you store them, and for how long?
- Who inside the company can see them?
- Will you share them with anyone else, and who?
A clear seller answers quickly. Our guide on payment methods and safety covers the payment side, and who is responsible shows who holds what.
A better fit if…
Reading this page suits you if:
- you prefer to share as little as possible at the start.
- you are about to send a first WhatsApp message.
- you are booking for a group and handling others’ details.
What should you do next?
Send your first message with just dates, group size and a rough budget. Keep other details until you know who you are dealing with. When you are ready, read the site’s role to see what we do and where we stop.
Common questions
What do I need to tell you in an enquiry?
Your dates, the size of your group and a rough budget are usually enough to start. Our message template asks for these. You can add the island you are considering and any needs, such as a child or someone with limited mobility, if you are comfortable.
Should I send my IC, passport or card number?
No. A planning enquiry does not need them. Keep identity documents and payment card details out of chat. If an agency asks for documents later, ask why, how they will be stored and who can see them, before you send.
Do you pass my details to anyone?
If you ask for a written quotation, what you send may be passed to the agency preparing it. Our aim is to tell you before that happens. Read our privacy notice for the full position, and ask us if anything is unclear.
What is the PDPA?
The Personal Data Protection Act 2010 is the Malaysian law on personal data. It has seven principles and a regulator, JPDP. A 2024 amendment adds duties such as breach notification in stages from 2025. Details on consent were not verified, so check the regulator for specifics.
Sources
- Conventus Law (accessed 2026-10-16)