1. Scope and data controller

Escabee Sdn. Bhd. is the data controller responsible for personal data processed through Xplore.my. This policy applies to Xplore.my pages, accounts, forms, reviews, correction requests, listing claims, booking-demand features, and related administration. Escabee.com and third-party booking sites have separate privacy notices for activity completed on their services.

2. Personal data we collect

• Account and operator data: name, email address, account identifiers, campsite affiliation, verification evidence, account activity, and an audit trail of listing changes.
• Claims and corrections: your contact details, role, message, supporting evidence, and the listing concerned.
• Camper reviews: display name, email address, rating, review text, optional photos and their embedded metadata, visit month, moderation status, and technical anti-abuse signals.
• Booking notifications: email address, consent record, campsite, confirmation status, and unsubscribe or deletion status.
• Demand measurement: campsite, date and time, source context, and a pseudonymous visitor reference. The browser may store a random Xplore.my visitor identifier in local storage. The server records a protected one-way reference rather than the raw browser identifier.
• Technical data: IP address, browser or device information, server logs, security events, cookies or similar storage, referring page, and basic usage information needed to operate and protect the site.
• Communications: information in emails and requests you send us.

Please do not submit identity documents, payment details, health information, or other sensitive data unless we specifically request it through an appropriate secure process.

3. Why we process personal data

We process data to operate and secure Xplore.my; create and administer accounts; verify campsite representatives; publish and moderate reviews; investigate corrections and abuse; measure camper demand; send requested availability notifications; communicate with you; maintain accurate records; enforce our terms; comply with legal obligations; and improve the directory.

Fields marked as required must be provided if you want us to process the relevant form, account, claim, review, or notification request. Optional information may be omitted. If required information is not provided, we may be unable to complete the requested feature.

Where consent is used, you may withdraw it. Withdrawal does not affect processing already carried out and may mean we cannot continue the feature you requested. We may also process information where necessary for a requested service, legitimate operational purposes, legal compliance, or the establishment and defence of legal rights, as permitted under applicable law.

4. Cookies and similar technology

Xplore.my may use essential cookies for login, security, preferences, and WordPress functionality. A random local-storage identifier may be used to reduce duplicate demand events without directly identifying a named camper. If optional analytics or advertising technology is introduced, this policy and any consent controls will be updated before it is used where required.

5. When data may be disclosed

We may disclose data to hosting, email-delivery, security, maintenance, and other service providers acting for us; professional advisers; authorities or courts where legally required; and a successor in a genuine business reorganisation. Providers receive only what is reasonably needed and are expected to protect it.

Campsite operators receive aggregated demand information in their dashboard, not camper notification email addresses. Reviews and chosen display names are public once approved. We do not sell personal data.

6. International processing

Some service providers may store or process information outside Malaysia. Where this occurs, we take reasonable steps to use appropriate contractual, organisational, or legal safeguards consistent with applicable Malaysian requirements.

7. How long we keep data

We keep personal data only as long as reasonably needed for the stated purpose, security, dispute handling, and legal obligations. Current operational periods include:

Backups may retain deleted data until the backup expires through its normal cycle. We may keep a minimal suppression, fraud-prevention, or legal record where necessary.

8. Security

We use reasonable technical and organisational safeguards appropriate to the nature of the data, including access controls, verification steps, anti-abuse measures, audit records, and protected identifiers. No online service is completely secure, so please use a strong unique password and notify us of suspected misuse. If a personal-data breach occurs, we will assess it and make notifications to the Personal Data Protection Commissioner and affected individuals where Malaysian law requires.

9. Your choices and rights

Subject to applicable law and exceptions, you may ask to access or correct personal data, withdraw consent, unsubscribe from a notification, object or limit certain processing, request deletion or data portability, or ask how your data is used. WordPress account holders may also use the available personal-data export and erasure process.

Send a request to xploreoutdoormy@gmail.com. Tell us the email address or account involved and what you want us to do. We may need to verify your identity before acting. You may also visit the official Personal Data Protection Commissioner website if you believe your concern has not been resolved.

10. Children

Accounts, listing claims, reviews, and notification forms are intended for people aged 18 or above. We do not knowingly request personal data directly from children. A parent or guardian who believes a child submitted personal data should contact us.

11. Changes and contact

We may update this policy as Xplore.my develops or legal requirements change. The latest version will be posted here with its revision date. Privacy questions and rights requests may be sent to xploreoutdoormy@gmail.com.