Privacy Policy

This Privacy Policy is prepared in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia. By using this site or our services, you consent to the Processing of your Personal Data as described in this Policy.

Table of Contents

• Definitions used in this Policy
• Data protection principles we follow
• What rights do you have regarding your Personal Data
• What Personal Data do we gather about you
• How we use your Personal Data
• Who else has access to your Personal Data
• How we secure your data
• Information about cookies
• Contact information

Definitions

• Personal Data – any information relating to an identified or identifiable natural person.
• Processing – any operation or set of operations that is performed on Personal Data or on sets of Personal Data.
• Data subject – a natural person whose Personal Data is being Processed.
• Child – a natural person under 16 years of age.
• We/us – Local Culinary Experiences Sdn. Bhd., also known as Simply Enak.

Data Subject's Rights

The Data Subject has the following rights:

• Right to information – you have the right to know whether your Personal Data is being processed; what data is gathered, from where it is obtained and why and by whom it is processed.
• Right to access – you have the right to access the data collected from/about you, including the right to request and obtain a copy of your Personal Data.
• Right to rectification – you have the right to request rectification or erasure of your Personal Data that is inaccurate or incomplete.
• Right to erasure – in certain circumstances you can request for your Personal Data to be erased from our records.
• Right to restrict processing – where certain conditions apply, you have the right to restrict the Processing of your Personal Data.
• Right to object to processing – in certain cases you have the right to object to the Processing of your Personal Data, for example in the case of direct marketing.
• Right to object to automated Processing – you have the right to object to automated Processing, including profiling; and not to be subject to a decision based solely on automated Processing.
• Right to data portability – you have the right to obtain your Personal Data in a machine-readable format or, if feasible, as a direct transfer from one Processor to another.
• Right to lodge a complaint – if we refuse your request under the Rights of Access, we will provide a reason. If you are not satisfied with how your request has been handled, please contact us.
• Right to withdraw consent – you have the right to withdraw any given consent for the Processing of your Personal Data.

Data Protection Principles

We follow these data protection principles:

• Processing is lawful, fair, and transparent. We always consider your rights before Processing Personal Data.
• Processing is limited to the purpose for which Personal Data was gathered.
• We only gather and Process the minimal amount of Personal Data required for any purpose.
• We will not store your Personal Data for longer than needed.
• We will do our best to ensure the accuracy of the data.
• We will do our best to ensure the integrity and confidentiality of data.

Data We Gather

Information you have provided us with

This might be your email address, name, billing address, home address etc — mainly information that is necessary for delivering you a service or enhancing your experience with us. We save the information you provide us with in order for you to comment or perform other activities on the website. This includes, for example, your name and email address.

Information automatically collected about you

This includes information that is automatically stored by cookies and other session tools — for example, your IP address and browsing history on this site. This information is used to improve your customer experience. When you use our services or look at the contents of our website, your activities may be logged.

Information from our partners

We gather information from our trusted partners with confirmation that they have legal grounds to share that information with us.

Publicly available information

We might gather information about you that is publicly available.

How We Use Your Personal Data

We use your Personal Data in order to:

• contact you prior to, during or after your Food Experience;
• provide our service to you, including registering your account and communicating with you about your bookings;
• enhance your customer experience;
• fulfill an obligation under law or contract.

On the grounds of entering into a contract or fulfilling contractual obligations, we Process your Personal Data to identify you, provide you with a service, and communicate for sales or invoicing purposes.

On the ground of legitimate interest, we Process your Personal Data to administer and analyze our client base in order to improve the quality and availability of our services, and to conduct satisfaction questionnaires.

With your consent we may Process your Personal Data to send you newsletters and campaign offers.

Data retention: Booking and billing records are retained for 7 years as required under Malaysian law (Companies Act 2016 and Income Tax Act 1967). Contact information and correspondence are retained for 3 years after your last tour with us, or until you request erasure — whichever is earlier. Marketing preferences are retained until you withdraw consent.

Who Else Can Access Your Personal Data

We do not share your Personal Data with strangers. In some cases Personal Data is provided to our trusted partners in order to make providing the service possible or to enhance your experience. We share your data with:

Our processing partners: Stripe Payments Malaysia Sdn. Bhd. (credit/debit card processing), Wise Payments Malaysia Sdn. Bhd. (international payments)

Our business partners: The licensed guide(s) who conduct your tour (name and booking details shared to enable delivery of the tour)

Connected third parties: Meta (Facebook/Instagram — for advertising and social sharing), Google Analytics 4 (website analytics and user behaviour)

We only work with Processing partners who are able to ensure an adequate level of protection for your Personal Data. We disclose your Personal Data to third parties or public officials when we are legally obliged to do so.

How We Secure Your Data

We do our best to keep your Personal Data safe. Specific measures include:

• All data is transmitted over HTTPS with TLS encryption.
• The website is protected by Cloudflare's web application firewall and DDoS mitigation at the network level.
• All payment processing is handled exclusively by PCI-DSS Level 1 certified processors (Stripe, PayPal). We do not store card numbers or payment credentials on our systems.
• Access to Personal Data is restricted to staff who require it to deliver your booking or respond to your enquiry.
• We monitor our systems for vulnerabilities and apply security updates promptly.

Even though we take these precautions, no system is entirely free from risk. We promise to notify the relevant authorities of any confirmed data breaches and will also notify you directly if there is a threat to your rights or interests.

Children

We do not intend to collect or knowingly collect information from children. We do not target children with our services.

Cookies and Other Technologies

We use cookies and/or similar technologies to analyze customer behaviour, administer the website, track users' movements, and collect information about users. This is done in order to personalize and enhance your experience with us.

Contact Information

For any questions about this Privacy Policy or your Personal Data, please contact us at info@simplyenak.com or by WhatsApp at +60 17-287 8929.

Changes to This Privacy Policy

We reserve the right to make changes to this Privacy Policy. We will notify you of any significant changes. This Policy was last updated in March 2026.