Privacy Policy
Updated on 13th November 2026
Sanctum Pilgrimages respects your privacy. This policy explains what personal data we collect, why we collect it, who sees it, and your rights under Malaysian law and the especially privacy laws of the EU, UK, US and Australia.
1. Who we are
Sanctum Pilgrimages is a trading brand name of Capricorn Travel Services Sdn. Bhd. (SSM no. 201201004133 / 977658-X), based in Bandar Sunway, Selangor, Malaysia. We are the "data controller" for your personal data, meaning we decide why and how it is used.
This policy covers our website (www.sanctumpilgrimages.com), our booking, request and newsletter forms, our communications by email, phone and WhatsApp, and the pilgrimages we organise.
Registered address: Suite 1010, Block A4, Level 10, Leisure Commerce Square, 46150 Petaling Jaya, Selangor, Malaysia
Hotline: +60 14-345 8676
2. What we collect
Identity and contact: name, email, phone, address, date of birth, nationality, parish or diocese. Source: you, through forms, WhatsApp, email or phone.
Travel documents: passport and IC details and copies, visa information, frequent flyer numbers. Source: you or your group leader.
Booking and payment: chosen tour, room preferences, deposit and payment slips, invoices. Source: you and our booking records.
Emergency contact: name and phone number of the person you nominate. Source: you.
Sensitive data: religious belief or clergy status, health conditions, allergies, dietary and mobility needs. Source: you, only where needed for your trip.
Communications: enquiries, feedback, testimonials, newsletter sign-ups. Source: you.
Website and device data: IP address, browser, pages viewed, ad-click identifiers. Source: cookies and similar tools (Section 4).
Photos and video: images taken during pilgrimages. Source: our staff, tour leaders and fellow pilgrims.
Religious belief and health information are "sensitive personal data" in Malaysia, "special category data" in the EU and UK, and "sensitive information" in Australia. We collect them only with your explicit consent, and you can withdraw that consent at any time.
If you give us another person's details, such as a travel companion or emergency contact, please make sure they know and agree. We do not buy personal data lists.
3. How we use your data
Handle enquiries, bookings and payments; arrange flights, hotels, transport, tours, visas and insurance. Legal basis: contract with you.
Look after your safety, health and special needs during the trip. Legal basis: your explicit consent; vital interests in an emergency.
Meet legal duties on tax, accounting, immigration and licensing. Legal basis: legal obligation.
Send trip updates and pre-departure information. Legal basis: contract; legitimate interests.
Send newsletters and promotions. Legal basis: your consent, which you can withdraw at any time.
Measure and improve our website and advertising. Legal basis: your consent to cookies and pixels.
Share photos and testimonials on our website and social media. Legal basis: your consent.
Prevent fraud, resolve disputes and defend legal claims. Legal basis: legitimate interests; legal claims.
Under Malaysia's Personal Data Protection Act 2010 (PDPA), we process your data with your consent, or where it is necessary for a contract with you, to comply with the law, or to protect your vital interests.
We do not sell your personal data. We do not make decisions about you solely by automated means.
4. Cookies, pixels and advertising
Essential cookies: make the site work: navigation, forms, security. Your choice: cannot be switched off.
Analytics: count visits and show which pages are used. Your choice: choose in the cookie banner.
Meta Pixel: measures our Facebook and Instagram ads and helps show them to relevant people. Your choice: choose in the cookie banner.
Meta Conversions API: when you submit a booking or request form, or pay a deposit, we may send Meta a limited event such as "form submitted", with hashed (scrambled) contact details. Your choice: tick or untick the consent box on our forms; or email us to opt out.
These events do not include your health, religious, passport or payment details. Meta uses the data under its own privacy policy.
You can change your cookie choices at any time through the cookie settings link on our website. You can also use your browser settings and your Facebook and Instagram ad settings.
For US residents: showing you ads through these tools may count as "sharing" for cross-context behavioural advertising. You can opt out through our cookie settings or by emailing us. We treat Global Privacy Control signals as an opt-out where our tools support them.
5. Who we share data with
We share personal data only as needed to run your trip, meet legal duties, or operate our business. Recipients include:
Airlines, hotels, coach and transfer operators, local guides and overseas partners who deliver your itinerary
Embassies, consulates and immigration authorities for visa and entry requirements
Travel insurers, where you ask us to arrange cover
Priests, parish or group leaders who organise a group booking, limited to what the trip needs
Banks and payment providers that process your payments
Technology providers for website hosting, forms, booking and accounting systems, email, cloud storage and WhatsApp messaging
Advertising platforms such as Meta, as described in Section 4
Professional advisers, auditors, regulators, courts and law enforcement where the law requires it
Our service providers may use your data only on our instructions and must protect it. If we ever sell or restructure our business, your data may transfer to the new owner under this policy.
6. Transfers outside Malaysia
Our pilgrimages take place overseas, so your data travels with you. Our technology providers may also store it in other countries, such as Singapore, the United States or the EU.
We transfer only the data needed for your booking or the service concerned, and we rely on these safeguards:
Malaysia: the destination has laws substantially similar to the PDPA or ensures adequate protection, or the transfer is allowed under section 129 of the PDPA, for example with your consent or to perform your contract.
EU and UK: adequacy decisions or standard contractual clauses (the UK addendum or IDTA for the UK). Where a transfer is necessary to deliver your booking, we may rely on that exception.
Australia: we take reasonable steps to make sure overseas recipients handle your data consistently with the Australian Privacy Principles.
You can ask us how a particular transfer is protected by emailing us (Section 11).
7. Retention and security
We keep personal data only as long as we need it for the purposes in this policy or the law requires.
Booking, invoice and payment records: 7 years after the trip, for tax and accounting
Passport and IC copies: until your trip ends and visa or claim periods pass, normally within 12 months of your return
Health, dietary and emergency contact details: deleted within 90 days after the trip ends
Enquiries that did not become a booking: 24 months
Newsletter and marketing contact details: until you unsubscribe or withdraw consent
Cookie and ad-tool data: for the lifespan of each cookie or the provider's retention period
We protect your data with measures such as access controls, encrypted connections, restricted access to travel documents and staff confidentiality duties. No system is completely secure.
If a data breach is likely to cause you significant harm, we will notify the Personal Data Protection Commissioner and affected individuals as the PDPA requires. We will also notify regulators and individuals under the GDPR, UK GDPR, Australia's Notifiable Data Breaches scheme and US state laws where they apply.
8. Your rights
Wherever you live, you can ask us to:
Access: give you a copy of the personal data we hold about you
Correct: fix data that is wrong, incomplete or out of date
Withdraw consent: stop marketing, cookies, photo use or our handling of sensitive data
Delete: erase your data, unless we must keep it by law
Limit or object: restrict how we use your data, including for direct marketing
Port: send your data to you or another provider in a commonly used format, where the law gives you this right
We will not treat you unfairly for using these rights.
To make a request, email pilgrimage@sanctumpilgrimages.com. We may ask you to prove your identity first. We reply within the time the applicable law sets, generally 21 to 45 days. In Malaysia we may charge the fee the law allows for access requests.
9. Region-specific notices
These laws apply to you only where they cover our activities. Where more than one applies, you get the stronger protection.
Malaysia
Law: Personal Data Protection Act 2010, as amended in 2024
Extra points: explicit consent for sensitive data. You may also ask us to stop processing likely to cause damage or distress, and to stop direct marketing.
Who to complain to: Personal Data Protection Commissioner, Jabatan Perlindungan Data Peribadi (www.pdp.gov.my)
EU and EEA
Law: General Data Protection Regulation (GDPR)
Extra points: you may object to processing based on legitimate interests and withdraw consent at any time.
Who to complain to: the data protection authority in the country where you live or work
United Kingdom
Law: UK GDPR, Data Protection Act 2018 and PECR
Extra points: same rights as the EU. Marketing emails need your consent, apart from the limited exception for existing customers.
Who to complain to: Information Commissioner's Office (ico.org.uk)
United States
Law: California Consumer Privacy Act and other state privacy laws
Extra points: you may know, delete, correct, opt out of sharing and limit use of sensitive data, and appeal a refusal where your state allows. An authorised agent may act for you. We do not sell personal information.
Who to complain to: your state attorney general; in California, also the California Privacy Protection Agency
Australia
Law: Privacy Act 1988 and the Australian Privacy Principles
Extra points: you may access and correct your data and opt out of direct marketing. Please complain to us first.
Who to complain to: Office of the Australian Information Commissioner (oaic.gov.au)
Some US states treat religious belief and health data as "sensitive personal information". We use it only to provide the trip you booked.
10. Children, photos, marketing and changes
Children. Our website is not aimed at children under 16, and we do not knowingly collect their data directly. A child can join a pilgrimage only when a parent or legal guardian registers them and consents to the use of their data.
Photos and video. We may photograph or film pilgrimages for our website, social media and newsletters, and we ask for your consent when you book. If you prefer not to appear, tell your tour leader or email us, and we will stop using and, where practical, remove the images. We publish testimonials with names only with the person's permission.
Marketing. We send newsletters and offers only with your consent. Every email has an unsubscribe link, or you can ask us to stop on WhatsApp or by email. We will still send messages needed for a trip you have booked.
Other websites. Our site links to third-party sites, such as social media. This policy does not cover them.
Changes. We may update this policy. The effective date at the top shows the latest version, and we will tell you about material changes by email or a notice on our website.
11. Contact and complaints
For questions, requests or complaints about your personal data, contact our data protection contact:
Phone: +60 14-345 8676
We will look into every complaint and reply promptly. If you are not satisfied, you can complain to the regulator for your region listed in Section 9.