Privacy Policy

GSK Services & Tour · Last updated 10 August 2026

GSK Services & Tour (“we”, “us”, “our”) provides car rental and tour services in Malaysia. This policy explains what personal data we collect, why we collect it, who we share it with, and the choices you have. We handle personal data in accordance with the Malaysian Personal Data Protection Act 2010 (PDPA).

1. Who we are

Business	GSK Services & Tour
Registration no.	[SSM registration number]
Address	[Business address, Bangi / Kajang, Selangor, Malaysia]
Email	gskservice.tour@gmail.com
Phone	[Business phone number]

2. Data we collect

2.1 Customers and enquiries

Identity and contact details — name, phone number, email address, and postal address.
Verification documents — identity card (MyKad) or passport number and driving licence details, which we are required to record to rent a vehicle.
Booking and payment records — rental dates, vehicle, pricing, deposits, and payment method. We do not store full card numbers; card payments are processed by our payment provider.
Correspondence — messages you send us by phone, email, WhatsApp, or social media.

2.2 Social media data

We use a self-hosted marketing tool to publish and measure our own social media content. When we connect one of our own accounts (Facebook Page, Instagram Business account, Threads, TikTok, or Google Business Profile), that tool accesses:

the name, ID, and profile image of our own business accounts;
access tokens permitting us to publish to and read insights from those accounts;
aggregate performance figures for our own posts — views, reach, likes, comments, shares, and follower counts;
public comments and replies left on our posts, including the commenter’s public display name, so that we can respond to them.

We do not collect personal data belonging to other people’s accounts. We do not access your private messages, your friends list, or any data about you beyond the public comment you choose to leave on our posts. We never sell data, and we do not use social media data for advertising profiles.

2.3 Website and system logs

Our systems keep technical logs (IP address, browser type, timestamps) for security and troubleshooting. Staff accounts on our internal system record sign-in activity for audit purposes.

3. Why we use your data

Purpose	Data used
Providing a rental — booking, handover, return, and billing	Identity, licence, booking, payment
Legal and insurance obligations, and traffic-offence enquiries	Identity, licence, booking
Answering enquiries and customer support	Contact details, correspondence
Publishing our own marketing content and measuring how it performs	Our own account data, aggregate post insights
Replying to comments on our posts	Public display name and comment text
Security, fraud prevention, and internal audit	System logs

4. Who we share data with

We disclose personal data only where necessary, and only to:

Service providers who operate parts of our business on our behalf — payment processors, insurers, cloud hosting, and IT support — under confidentiality obligations;
Authorities — the police, JPJ, or other government bodies, where required by Malaysian law, for example in connection with a traffic offence or an accident;
Meta Platforms, TikTok, and Google, only to the extent needed to operate our own business accounts on their services, subject to their own privacy policies.

We do not sell personal data, and we do not share it with third parties for their own marketing.

5. How long we keep it

Rental and payment records — seven years, to meet Malaysian tax and accounting requirements.
Enquiries that do not become bookings — up to twelve months.
Social media access tokens — until the account is disconnected or the token expires.
Comment records — up to twenty-four months, after which they are deleted from our inbox. Deleting a comment on the platform itself does not automatically remove our copy; see section 7.
System logs — up to twelve months.

6. How we protect it

Access to our systems requires an individual account and is limited by role, so staff see only what their work requires. Social media access tokens are encrypted at rest and are never exposed to a web browser. Administrative actions are recorded in an audit log. No system is perfectly secure, but we take reasonable technical and organisational measures to protect personal data against loss, misuse, and unauthorised access.

7. Your rights, and how to delete your data

Under the PDPA you may ask us to:

access the personal data we hold about you;
correct it if it is inaccurate or incomplete;
limit how we use it, or withdraw consent for marketing;
delete it, where we are not required by law to keep it.

Requesting deletion

Email gskservice.tour@gmail.com with the subject line “Data deletion request”, telling us your name and, if the request concerns a comment or message on social media, the account name you used. We will confirm receipt and complete the request within 30 days. If a record must be kept for legal reasons — for example a rental invoice inside the seven-year tax retention period — we will tell you which data that is and why.

You may also remove our access at any time from the platform itself: on Facebook, Settings & Privacy → Settings → Apps and Websites, then remove the app. Doing so revokes our access immediately.

8. Children

Our services are intended for people aged 18 and over, and vehicle rental requires a valid driving licence. We do not knowingly collect data from children.

9. Changes to this policy

If we change this policy we will update the date at the top of this page. Material changes will be communicated to affected customers directly where practicable.

10. Contact and complaints

Questions or complaints about how we handle personal data can be sent to gskservice.tour@gmail.com. If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commissioner, Malaysia (JPDP).