Privacy Policy

Teratai Haven ("the house", "we", "us") operates at 12, Lebuh Pantai, 10300 George Town, Pulau Pinang, Malaysia. This policy describes how we collect, use, and protect personal information provided to us by guests and visitors to this website.

We take the handling of personal information seriously. We collect only what we need, use it only for the purposes stated here, and do not share it with third parties except as described below. This policy is written for guests and prospective guests — it is not a legal instrument, but it represents how we actually handle your information.

If you have questions about this policy or about how your information is held, please write to us at [email protected].

Enquiry and booking information: When you contact us through the website form or by email, we collect your name, email address, and telephone number if provided. We also collect the content of your message, including your intended dates of stay and room preference.

Correspondence: We retain email correspondence between you and the household for the duration of your stay and for twelve months thereafter, for the purpose of managing your reservation and any follow-up communications.

Website usage: If you have accepted analytics cookies, we collect anonymised information about how this website is used — pages visited, time on site, and general location data (country level). This is collected through third-party analytics tools and is not linked to your personal identity.

Legal basis: We process your information on the basis of the performance of a contract (managing your reservation), legitimate interest (responding to enquiries), and consent (analytics cookies).

We use your personal information to respond to enquiries, confirm reservations, and communicate with you about your stay — including details about arrival, dietary requirements, and any arrangements specific to your room.

We do not use your information for marketing purposes. We do not send newsletters, promotional emails, or unsolicited communications. If you contact us again in the future, we may refer to previous correspondence to provide context, but we will not contact you uninvited.

We do not share your personal information with third parties except where required by Malaysian law or necessary to manage your reservation (for example, if we need to arrange an external service at your request).

Retention: Enquiry records are held for twelve months. Records related to a completed stay are held for three years, which is the standard retention period for business records under Malaysian law (Personal Data Protection Act 2010).

Guest correspondence is stored in a password-protected email account accessible only to the proprietor. Paper records, where they exist, are kept in a locked filing cabinet on the premises.

This website is served over HTTPS. Any information submitted through the contact form is transmitted securely. We do not store form submissions on the website server — they are delivered directly to the household's email.

In the event of a data breach that affects your personal information, we will notify you within 72 hours of becoming aware of it, and will contact the relevant Malaysian regulatory authority as required by the Personal Data Protection Act 2010.

This website uses cookies. Essential cookies are necessary for the site to function correctly and are always active. Analytics and preference cookies are optional and are only used if you have given consent through the cookie notice displayed on the site.

For detailed information on the cookies we use and how to manage your preferences, please see our Cookie Policy.

Under the Malaysian Personal Data Protection Act 2010, you have the right to access, correct, and request the deletion of personal information we hold about you. You also have the right to withdraw consent for processing at any time, where consent is the legal basis for processing.

To exercise any of these rights, please write to us at [email protected]. We will respond within fourteen working days. Where a request requires verification of your identity, we may ask for confirmation before proceeding.

If you believe your personal information has been mishandled, you may lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP) at www.pdp.gov.my.