Privacy Policy

Last updated: 16 October 2026

Planning a trip means trusting us with personal details: your passport, your dates, sometimes your medical history. This policy explains what we collect, why, who we share it with, and how you stay in control. We have written it in plain language on purpose.

1. Who we are
2. What we collect
3. How we use your information
4. Who we share it with
5. Where your data goes
6. How long we keep it
7. How we protect it
8. Your rights and choices
9. This website, cookies and third-party services
10. Children
11. Changes to this policy
12. How to contact us

1. Who we are

Travelliyo ("we", "us", "our") is a travel services team based in Kuala Lumpur, Malaysia, serving travellers from Bangladesh and the region. We plan family and honeymoon trips, process tourist and student visas, act as a ground partner for corporate groups, and arrange medical travel to Malaysia, Singapore and Thailand.

For the purposes of Malaysia's Personal Data Protection Act 2010 (PDPA) and any other applicable data protection law, Travelliyo is the data user (controller) of the personal information described in this policy.

2. What we collect

We only collect what we need to plan and deliver the service you ask for. Depending on the service, that can include:

Information you give us directly

• Contact details: your name, phone or WhatsApp number, email address and the messaging account you use to reach us.
• Trip details: destinations, travel dates, budget, preferences (for example halal food or accessibility needs) and the names and ages of the people travelling with you.
• Identity and travel documents: passport copies, national ID, photographs, and for visa applications, supporting documents such as bank statements, employment or study letters, offer letters, travel history and family details.
• Payment information: confirmation of bank transfers or other payments. We do not store full card numbers.
• Health information (medical travel only): your condition, medical reports, prescriptions and appointment preferences, so we can book the right hospital and doctor and arrange a suitable stay. This is sensitive personal data and we only collect it with your explicit consent.
• Communications: the messages, voice notes and files you send us on WhatsApp, Facebook, Instagram, email or in person.

Information from others

• If a travel agency books you with us as part of a corporate group, we receive your details from that agency.
• If a family member or colleague enquires on your behalf, we receive what they tell us about you.
• Airlines, hotels, hospitals and visa centres may send us booking confirmations, status updates or decisions relating to you.

Information collected automatically

This website is a simple, static site. We do not run analytics, advertising trackers or set cookies ourselves. See section 9 for the third-party services the page loads.

3. How we use your information

We use your personal information to:

• Reply to your enquiry and prepare an itinerary, quote or visa checklist.
• Book flights, hotels, transport, activities, hospital appointments and other services on your behalf.
• Prepare, check and submit visa applications to embassies, high commissions and authorised visa centres.
• Meet you at the airport, guide you during the trip and support you on WhatsApp until you are home.
• Take payments, issue receipts and keep the accounting records the law requires.
• Handle complaints, disputes, refunds and insurance or emergency situations.
• Send you occasional updates about Travelliyo services if you have asked for them. You can opt out at any time by replying "stop" or telling us.
• Comply with legal obligations, for example immigration, tax and anti-fraud requirements.

Our legal bases are your consent, the need to perform the contract you have asked us for, our legitimate interest in running a travel business, and compliance with the law. We never sell your personal information.

4. Who we share it with

Delivering a trip involves other companies. We share only what each one needs to do its part:

• Travel suppliers: airlines, hotels, transport and transfer companies, tour and activity operators, guides, photographers and travel insurers.
• Visa authorities: embassies, high commissions, immigration departments and their authorised application centres in Malaysia, Thailand, Singapore, Japan or elsewhere, as required by the visa you apply for.
• Hospitals and clinics (medical travel): the healthcare provider you choose, so they can confirm appointments, give cost estimates and prepare for your arrival. Medical treatment itself is governed by the hospital's own privacy policy.
• Partner travel agencies: if you are travelling as part of a corporate group organised by another agency, we share operational updates with that agency.
• Service providers: messaging, email, cloud storage and payment services we use to run Travelliyo.
• Authorities: police, courts, immigration or regulators where the law requires it or to protect someone's safety.

Our team members who handle your trip see your information on a need-to-know basis and are bound by confidentiality obligations.

5. Where your data goes

Because we operate across borders, your information may be transferred to and stored in Bangladesh, Malaysia, Singapore, Thailand, Japan and any other country involved in your trip or visa application. The messaging and cloud services we use may process data in other countries too. Where we have a choice, we use providers with recognised security standards, and we share only what is necessary.

6. How long we keep it

• Enquiries that do not become bookings: up to 12 months, so we can pick up where we left off if you come back.
• Bookings and visa files: for the duration of the service and up to 7 years afterwards, to meet accounting and legal requirements and to help with repeat applications.
• Passport copies and supporting documents: deleted once the booking or visa process is complete and any required retention period has passed, or earlier if you ask and the law allows.
• Health information: deleted once your medical trip is complete and any follow-up you have asked for is done, unless you ask us to keep it for a future visit.

7. How we protect it

We keep documents in access-controlled accounts, limit who on the team can see them, use devices with screen locks and up-to-date software, and share files with suppliers only through the channels they require. No system is perfectly secure. If a breach ever affects your information, we will tell you and the relevant authority as the law requires.

Please help us too: send documents only to the official Travelliyo contacts listed on our website, and let us know if anyone claiming to be from Travelliyo asks you for money or documents through another channel.

8. Your rights and choices

Depending on where you live, you have the right to:

• Ask for a copy of the personal information we hold about you.
• Ask us to correct anything that is inaccurate or incomplete.
• Withdraw consent for processing that is based on consent, including marketing messages and health information.
• Ask us to delete your information, or limit how we use it, where we have no legal reason to keep it.
• Object to processing based on our legitimate interests.
• Complain to a data protection authority, including the Personal Data Protection Department of Malaysia.

To exercise any of these rights, contact us using the details in section 12. We will respond within 21 days. We may need to verify your identity first. Withdrawing consent or asking for deletion may mean we can no longer complete a booking or visa application for you.

9. This website, cookies and third-party services

We do not set cookies, use analytics or run advertising on this website. To display properly, the page loads a few resources from third parties, and your browser sends them your IP address and basic device information as part of the request:

• Google Fonts (fonts.googleapis.com, fonts.gstatic.com) for typography.
• jsDelivr (cdn.jsdelivr.net) for the smooth-scroll and globe libraries.
• Flagcdn (flagcdn.com) for the country flag images.

These providers process that data under their own privacy policies. The site also links to our WhatsApp, Facebook, Instagram, TikTok and YouTube pages. When you contact us through those platforms, Meta, ByteDance or Google will process your data under their own terms in addition to ours.

10. Children

We often arrange trips for families and collect children's names, ages and passport details for that purpose, always from a parent or guardian. We do not knowingly deal directly with anyone under 18. If you believe a child has sent us personal information without a parent's involvement, please contact us and we will delete it.

11. Changes to this policy

We may update this policy as our services or the law change. The date at the top shows the latest version. If a change significantly affects how we use your information, we will tell you through the channel you normally use to reach us.

12. How to contact us

Please put "Privacy" in the subject line or first message so we can route it quickly.

← Back to home