Privacy Policy
Last Updated: 12 February 2026
Velaris ("we", "us", "our") is committed to handling personal information responsibly and in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA). This policy explains what data we collect, why we collect it, how we use it, and what rights you have in relation to it. Questions about this policy can be directed to [email protected].
1. Data Controller
Velaris operates as the data controller for personal information collected through this website and during tour booking processes. Our registered business address is 17 Jalan Jesselton, 88000 Kota Kinabalu, Sabah, Malaysia.
2. What Personal Data We Collect
We collect personal data in the following circumstances:
- Contact form submissions: name, email address, phone number (optional), and message content
- Booking enquiries: name, email, phone, group size, tour preference, and dietary or accessibility requirements
- Website usage: browser type, referring URL, pages visited, and time on site (via analytics cookies, where consented)
We do not collect payment card information directly. Payment processing, if applicable, is handled through authorised third-party platforms.
3. How We Collect Data
- Directly from you via the contact form or email enquiry
- From analytics tools (Google Analytics) where you have consented to analytics cookies
- From cookie interactions on this website — see our Cookie Policy for detail
4. Legal Basis for Processing
We process personal data on the following bases:
- Consent: for marketing communications and analytics tracking
- Contractual necessity: for processing tour bookings and responding to enquiries
- Legitimate interest: for operational improvements, safety record-keeping, and fraud prevention
5. How We Use Your Data
- Responding to tour enquiries and confirming bookings
- Sending pre-voyage information to confirmed guests
- Maintaining safety and operations records as required by Malaysian maritime regulations
- Sending follow-up communications with your explicit consent
- Improving this website and our service offering based on aggregated analytics data
6. Data Retention
We retain booking and enquiry data for three years from the date of the tour or last contact. Analytics data is retained as configured in our analytics platform (typically 26 months). You may request earlier deletion at any time — see Section 10 for how to do so.
7. Data Sharing
We do not sell or rent personal data to third parties. We may share data with:
- Google Analytics — for website usage analytics (anonymised where possible)
- Email service providers — for pre-voyage communication delivery
- Insurance providers — where required for maritime insurance documentation
- Malaysian authorities — if required by applicable law or maritime safety regulations
8. Data Security
We take reasonable technical and organisational measures to protect personal data from unauthorised access, loss, or disclosure. These include secure HTTPS transmission, staff access controls, and periodic review of our data handling practices. In the event of a data breach affecting your rights, we will notify you as required by applicable law.
9. Cookies
This website uses cookies for essential site functionality and, where you have consented, for analytics and preference purposes. For full details on cookie categories and how to manage your preferences, please see our Cookie Policy.
10. Your Rights
Under Malaysia's PDPA, you have the right to:
- Access personal data we hold about you
- Correct inaccurate or incomplete data
- Request deletion of your personal data (subject to legitimate business and regulatory requirements)
- Withdraw consent to marketing or analytics processing at any time
- Lodge a complaint with Malaysia's relevant supervisory authority if you believe your rights have been breached
To exercise any of these rights, contact us at [email protected]. We will respond within 10 business days.
11. Third-Party Links
This website may contain links to external websites. We are not responsible for the privacy practices of those sites and recommend reviewing their privacy policies independently.
12. Children's Privacy
Our services are intended for adults aged 18 and above. We do not knowingly collect personal data from individuals under 18. If you believe we have inadvertently done so, please contact us and we will delete the information promptly.
13. Changes to This Policy
We may update this privacy policy from time to time. The "Last Updated" date at the top of this page reflects the most recent revision. Continued use of this website after changes have been published constitutes acceptance of the updated policy.
14. Contact
For all privacy-related enquiries:
- Email: [email protected]
- Address: Velaris, 17 Jalan Jesselton, 88000 Kota Kinabalu, Sabah, Malaysia