Privacy Policy

1. About This Policy

Malaysian Chinese Tourism Association (MCTA) ("MCTA", "we", "us" or "our") is committed to protecting the privacy of members, applicants, event participants and visitors. This Privacy Policy explains how we collect, use, disclose, store and protect personal data through the MCTA membership portal at https://www.mcta.com.my (the "Portal"), in accordance with the Personal Data Protection Act 2010 of Malaysia ("PDPA").

Please read this Policy together with the MCTA Terms and Conditions. By submitting personal data to us, you consent to its processing as described here.

2. Personal Data We Collect

2.1 Information you give us

• Account details: name, email address, password and one-time verification codes.
• Company details: company name, company registration number, business address, state, postcode, telephone, website and company logo.
• Representative details: name, designation, email and telephone of the contact person, chief delegate and alternate representative.
• Membership details: membership category, membership tier, application declarations and supporting documents such as SSM certificates, business licences, MOTAC licences and company stamps.
• Payment details: payment method, amount, transaction reference, proof of payment and receipt records. Full card numbers are handled by our payment providers and are not stored by MCTA.
• Event and activity details: event registrations, attendance and related correspondence.
• Correspondence: enquiries, feedback, complaints and support requests sent to us.

2.2 Information collected automatically

• Technical data such as IP address, browser type, device information, pages visited, and dates and times of access.
• Cookies and similar technologies used to keep you signed in, remember your language preference and measure usage of the Portal.

2.3 Information from third parties

• Records supplied by regulators, licensing bodies or industry partners where needed to verify a licence or membership eligibility.
• Data from payment gateways, email delivery providers and social media platforms integrated with the Portal.

3. Why We Process Your Personal Data

We process personal data for the following purposes:

• to process, assess and approve membership applications and renewals;
• to verify licences, certificates and the authenticity of supporting documents;
• to administer your member account, profile changes and document expiry reminders;
• to process payments, issue receipts and maintain accounting records;
• to publish approved member listings in the MCTA member directory;
• to organise events, training and association activities;
• to send administrative notices, renewal reminders, warning letters and association announcements;
• to handle enquiries, disputes and disciplinary matters under the MCTA Constitution;
• to maintain the security, integrity and proper operation of the Portal; and
• to comply with legal, regulatory and audit obligations in Malaysia.

Providing the data marked as mandatory in our forms is necessary for us to process your application or provide the service. If it is not supplied, we may be unable to register, renew or maintain your membership.

4. Legal Basis and Consent

We process personal data on the basis of your consent, the performance of our obligations to you as a member, compliance with legal obligations, and the legitimate interests of the association in administering its membership and activities.

You may withdraw consent for direct marketing communications at any time. Withdrawal of consent for processing necessary to administer your membership may result in MCTA being unable to maintain your membership.

5. Disclosure of Personal Data

We may disclose personal data to:

• MCTA office bearers, committee members and authorised secretariat staff, on a need-to-know basis;
• the public, in respect of member directory information published on the Portal;
• service providers who host, maintain or support the Portal, deliver email, or process payments;
• auditors, accountants, insurers and professional advisers;
• government departments, regulators and law enforcement agencies, where required or permitted by law; and
• event co-organisers and venue operators, where necessary for an event you have registered for.

We do not sell or rent personal data to third parties.

6. Transfers Outside Malaysia

Some of our service providers, including cloud hosting and email delivery providers, may store or process data on servers located outside Malaysia. Where personal data is transferred outside Malaysia, we take reasonable steps to ensure that it receives a standard of protection comparable to that required under the PDPA.

7. Security

We apply reasonable technical and organisational measures to protect personal data against accidental or unlawful loss, misuse, unauthorised access, alteration or disclosure. These include encrypted transmission, hashed passwords, role-based access controls for staff, and restricted access to uploaded documents.

No method of transmission or storage is completely secure. You are responsible for keeping your account credentials confidential and for notifying us promptly of any suspected compromise.

8. Retention

We retain personal data for as long as your membership subsists and thereafter for such period as is necessary to satisfy the association's legal, accounting, audit and historical record-keeping requirements. Financial and payment records are retained for at least seven (7) years in line with Malaysian statutory requirements. Data that is no longer required is securely deleted or anonymised.

9. Your Rights

Subject to the PDPA, you have the right to:

• request access to the personal data we hold about you;
• request correction of inaccurate, incomplete, misleading or out-of-date data;
• withdraw consent to processing, including direct marketing;
• limit the processing of your personal data for specified purposes; and
• enquire about disclosures of your personal data to third parties.

To exercise any of these rights, contact the secretariat at admin@mcta.com.my. We may require proof of identity and authority before acting on a request, and a reasonable fee may apply to a data access request as permitted by the PDPA. We will respond within the period prescribed by law.

Certain profile fields can be updated directly through the Portal; some changes require approval by the secretariat before they take effect.

10. Cookies

The Portal uses cookies that are strictly necessary for authentication and session management, together with preference cookies (such as language selection) and analytics cookies that help us understand how the Portal is used. You can control cookies through your browser settings, but disabling necessary cookies will prevent you from signing in.

11. Children

The Portal is intended for business entities and their authorised representatives. We do not knowingly collect personal data of persons under the age of eighteen (18). If you believe such data has been provided to us, please contact us so that it can be removed.

12. Third-Party Sites

The Portal may link to external websites, including member websites and social media pages. This Policy does not apply to those sites, and MCTA is not responsible for their privacy practices.

13. Changes to This Policy

We may update this Policy from time to time. The current version will always be available on the Portal, and the effective date will be revised accordingly. Material changes will, where practicable, be notified to members by email.

14. Language

This Policy may be made available in English and Chinese. In the event of any inconsistency between versions, the English version prevails.

Contact Us

For questions, requests or complaints regarding personal data, please contact the MCTA secretariat:

• Secretariat: Malaysian Chinese Tourism Association (MCTA)
• Address: 2-3A Jalan Pandan 2/1, Pandan Jaya, 55100 Kuala Lumpur, Malaysia
• Email: admin@mcta.com.my
• Telephone: +603-9200 5228
• Website: https://www.mcta.com.my