Privacy Policy

Introduction

Celestane is committed to protecting the privacy and security of personal information provided by travelers who book our volcanic trekking expeditions across Java. This Privacy Policy explains how we collect, use, store, and protect your data in compliance with Malaysian Personal Data Protection Act 2010 and international privacy standards.

By using our services, booking expeditions, or providing personal information through our website or communication channels, you consent to the practices described in this policy. If you have questions about our privacy practices, please contact us at [email protected].

Information We Collect

Personal Information

When you book an expedition or contact us, we collect:

• Full name and preferred name
• Email address and phone number
• Physical address (for emergency contact purposes)
• Emergency contact information
• Passport details (for travel documentation)
• Dietary restrictions and medical conditions relevant to trekking
• Payment information (processed through secure third-party providers)

Automatically Collected Information

Our website collects technical data including:

• IP address and device identifiers
• Browser type and operating system
• Pages visited and time spent on site
• Referring website or source
• Cookie data (see our Cookie Policy for details)

How We Use Your Information

We process personal data for the following purposes:

• Service Delivery: Processing bookings, coordinating expeditions, arranging accommodations and transport, and communicating itinerary details
• Safety and Emergency Response: Maintaining emergency contact information and medical details to ensure appropriate care if needed during treks
• Communication: Sending booking confirmations, pre-trek information, weather updates, and post-expedition feedback requests
• Payment Processing: Handling transactions through secure payment processors (we do not store complete credit card information)
• Legal Compliance: Meeting obligations under Malaysian tourism regulations and international travel requirements
• Service Improvement: Analyzing feedback and usage patterns to enhance expedition quality and website functionality

Data Sharing and Third Parties

We share personal information with:

Service Partners

• Indonesian trekking guides and mountain guesthouses (names, dietary requirements, emergency contacts)
• Transportation providers (pickup/dropoff locations, passenger counts)
• Travel insurance providers (policy coverage and claims processing)

Payment Processors

We use secure third-party payment processors that comply with Payment Card Industry Data Security Standards. These processors handle financial transactions and may collect payment card information directly — we do not store complete card details on our systems.

Analytics Services

We may use analytics tools to understand website usage patterns and improve user experience. These services collect anonymized data about site visits and interactions. See our Cookie Policy for details on analytics cookies.

Legal Obligations

We may disclose information when required by Malaysian law, court orders, or government authorities, or to protect our legal rights and the safety of our travelers and guides.

Data Security

We implement security measures to protect personal information:

• Encryption of data in transit using SSL/TLS protocols
• Secure storage systems with access controls limiting staff who can view personal data
• Regular security audits and updates to protect against vulnerabilities
• Staff training on data protection practices and privacy obligations
• Secure disposal procedures when data is no longer needed

While we employ reasonable safeguards, no internet transmission is completely secure. We cannot guarantee absolute security but commit to promptly addressing any security incidents.

Data Retention

We retain personal information for:

• Booking Records: Seven years from expedition date (Malaysian tax and business record requirements)
• Marketing Communications: Until consent is withdrawn or account deletion is requested
• Website Analytics: Typically 26 months for anonymized usage data
• Emergency Contact Information: Duration of expedition plus six months

After retention periods expire, we securely delete or anonymize personal data unless longer retention is required by law.

Your Rights

Under Malaysian data protection law, you have:

• Right to Access: Request copies of personal information we hold about you
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data (subject to legal retention requirements)
• Right to Restrict Processing: Limit how we use your information in certain circumstances
• Right to Data Portability: Receive your data in a structured format for transfer to another provider
• Right to Withdraw Consent: Opt out of marketing communications at any time
• Right to Lodge Complaint: Contact Malaysia's Personal Data Protection Commissioner if you believe we've mishandled your information

To exercise these rights, email [email protected]. We respond to requests within 30 days.

Marketing Communications

With your consent, we may send emails about new expeditions, special offers, and trekking tips. You can opt out at any time by clicking the unsubscribe link in emails or contacting us directly. Opting out of marketing does not affect transactional communications about your bookings.

Cookies and Tracking

Our website uses cookies to improve functionality and analyze usage. For detailed information about cookie types, purposes, and how to manage them, please see our Cookie Policy.

International Data Transfers

Our expeditions operate in Indonesia, requiring transfer of certain personal information (names, emergency contacts, dietary requirements) to Indonesian guides and service providers. We ensure these partners understand and follow appropriate data protection practices. By booking with Celestane, you consent to these necessary transfers for service delivery.

Children's Privacy

Our services are intended for adults 18 and older. We do not knowingly collect personal information from minors without parental consent. If you believe we've inadvertently collected data from a minor, please contact us immediately for deletion.

Policy Updates

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or service offerings. Material changes will be communicated via email to active customers. Continued use of our services after updates indicates acceptance of the revised policy.

Contact Information

For privacy-related questions or to exercise your rights, contact:

Celestane Data Protection Officer
Email: [email protected]
Phone: +60 3-6293 8174
Address: 33 Jalan Hang Jebat, 75200 Melaka, Malaysia