Privacy Policy

Who we are

MD2 Botanic Cafe & Resort ("MD2 Botanic", "we", "us" or "our") operates the restaurant, chalets, seminar hall and estate tours at Changkat Setul, Changlun, Kedah, and this website at md2resort.com.

This policy explains what personal information we collect when you visit this website, send us an enquiry or stay with us, how we use it, and the rights you have over it under the Malaysian Personal Data Protection Act 2010 (PDPA).

Information we collect

We collect only what we need to answer your enquiry and host you properly.

Information you give us

• Your name, phone number and email address when you send an enquiry or make a booking.
• Booking details — the date and time of your visit, the number of people, the table, chalet or hall you want, and any special requests such as dietary or accessibility needs.
• The content of messages you send us through WhatsApp, email or our enquiry form.
• Details you give us at check-in for an overnight stay, including the identification that accommodation operators are required to record under Malaysian law.
• Feedback, reviews and photographs you choose to share with us.

Information collected automatically

• Standard technical data logged by our web server — IP address, browser and device type, the pages you view, and the date and time of your visit.
• A language preference stored in your own browser, so the site opens in English or Bahasa Melayu next time.
• Information collected by our online booking system while you reserve a table, a chalet or the seminar hall.

Information from other sources

If you reach us through a travel agent, an online travel platform, a corporate organiser or a social media page, we may receive your contact and booking details from them so that we can confirm your visit.

How we use your information

We use your personal information to:

• respond to your enquiry, quotation request or booking;
• confirm, prepare for and manage your visit, stay, event or estate tour;
• take and arrange a deposit or payment where one is required;
• contact you about a booking — for example to confirm timings, or to tell you about a change caused by weather or maintenance on the estate;
• meet our record-keeping, accounting, tax and guest-registration obligations under Malaysian law;
• keep the resort, our guests and our team safe;
• improve our website, menu, facilities and service;
• send you news, promotions or seasonal offers — only if you have asked to receive them.

We do not sell your personal information, and we do not pass it to other companies for their own marketing.

Your consent and our legal basis

We process your personal information on the basis of the consent you give when you send an enquiry, make a booking or check in; because it is necessary to provide the booking or stay you asked for; or because Malaysian law requires us to keep certain records.

You may withdraw your consent at any time by contacting us. If you withdraw consent for information we need in order to hold a confirmed booking, we may no longer be able to provide that booking.

Cookies and local storage

This website does not use advertising or tracking cookies. It stores only what it needs in order to work:

• a language preference saved in your browser, so the site remembers whether you read it in English or Bahasa Melayu;
• cookies or similar storage set by our online booking system while you are making a reservation;
• cookies set by embedded services such as Google Maps and the web fonts we use, which are governed by those providers’ own privacy policies.

You can clear or block this storage in your browser settings. The site will still work — it simply will not remember your language choice.

Who we share your information with

We share your information only where it is needed to run the resort:

• our booking and enquiry system provider, which processes reservations on our behalf;
• WhatsApp (Meta), when you choose to contact us or receive a confirmation through it;
• payment providers, where a deposit or payment is taken — card and banking details are handled by the payment provider and are not stored on this website;
• suppliers and partners engaged for your booking, such as caterers, transport or activity guides for a group programme, limited to what they need to know;
• professional advisers, and government authorities where the law requires it — for example guest registration, health, safety or tax obligations.

Some of our service providers store information on servers outside Malaysia. Where that happens, we take reasonable steps to satisfy ourselves that your information stays protected to a standard comparable with the PDPA.

How long we keep it

We keep enquiry messages for as long as we need them to answer you, and for a reasonable period afterwards in case you come back to us. Booking, accommodation and financial records are kept for the period required by Malaysian tax and record-keeping law — generally seven years.

When information is no longer needed for these purposes we delete it, or remove the details that identify you.

How we protect your information

This website is served over an encrypted (HTTPS) connection. Access to booking and guest records is limited to the members of our team who need it to do their work, and our service providers are required to keep the information confidential.

No system is completely secure. If a personal data breach occurs that is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and the guests affected, as required by law.

Your rights

Under the PDPA you may ask us to:

• confirm what personal information we hold about you, and give you a copy of it;
• correct information that is inaccurate, incomplete or out of date;
• stop or limit the way we process your information;
• stop using your information for direct marketing;
• withdraw a consent you previously gave us;
• transmit your information to another provider, where that right applies.

To make a request, contact us using the details below. We may need to verify who you are before we act, and we will respond within the period allowed by law. A small fee may apply to a data access request, as permitted by the PDPA. If you are not satisfied with our response, you may complain to the Personal Data Protection Department of Malaysia (JPDP).

To ask us to delete your information, see Delete My Data — it sets out exactly what to send us and what happens next.

Children

Families are very welcome at the resort, but this website is not directed at children and we do not knowingly collect personal information from a child. Bookings that involve children are made by a parent, guardian or group organiser, who gives us only the details needed for the visit.

Other websites and services

Our pages link to and embed services we do not control, including Google Maps, WhatsApp, our social media pages and our online booking system. This policy does not cover them, and we are not responsible for their content or for how they handle your information. Please read their own privacy policies.

Changes to this policy

We may update this policy as our services, our systems or the law change. The current version is always published on this page, with the date it was last updated. Where a change is significant, we will make that clear on the website.

How to contact us

For any question about this policy, or to exercise any of the rights above, please contact us: