Lancong

Privacy Policy

A. About this Privacy Policy

This Privacy Policy explains how BITESIZE PROJECTS PLT, registration no. 202604002500(LLP0047744-LGN) ("Lancong", "we", "us" or "our") collects, uses, discloses and protects your personal data when you use the Lancong website and mobile applications (the "Platform"). We are the data controller responsible for your personal data, and we handle it in accordance with the Personal Data Protection Act 2010 and its subsidiary legislation.

This Privacy Policy forms part of, and should be read together with, our Terms of Use and our Cookie Policy. By using the Platform you confirm that you have read and understood it. If you do not agree with it, please do not use the Platform.

B. What we collect

We collect the information you give us when you create and use an account, together with information generated as you use the Platform, including without limitation, at any meetings, events, contests, or customer satisfaction surveys, as well as publicly available sources. Such information includes:


Most of this comes directly from you or is generated as you use the Platform. Some is provided by other users, for example when a member records your name on a trip or your share of an expense, when someone invites you by email, or when a forwarded booking confirmation names you.

Profile details, contact and identity details and payment preferences are optional. If you do not provide the information necessary to create and operate an account, we cannot provide you with the Platform or with particular features of it.

C. Purpose of Collection and Processing Your Personal Data

We collect, process and use personal data for the following purposes:

We will not use your personal data for any purpose other than those set out above, or a purpose directly related to them, unless you consent or the law requires or permits it. We may also use, process and share non-personally identifiable, aggregated, statistical and/or anonymous data with third parties for data analytics and to analyse and develop our marketing strategy and further improve and enhance the platform and/or service. Your username may be displayed to and searched by other users. We will not directly disclose or share your user email address and other information without your consent.

D. The basis on which we process it

We process personal data on one or more of the following bases: your consent; the performance of our contract with you; our compliance with a legal obligation; the protection of your vital interests or those of another person; and our legitimate interests in operating, securing and improving the Platform, where those interests are not overridden by your own rights and interests. Check-ins are recorded under our contract with you, and location is optional — declining it does not cost you the feature. Reports you file are processed under our legitimate interests in keeping the Platform safe and preventing abuse. Push notifications are delivered under our contract with you; they are not based on consent, and you can switch them off in your device's Settings. A receipt for a paid feature you buy is emailed to your account address under our contract with you. Trip invitation emails, and the one-way hash we keep so that we can stop sending them to someone who asks, are processed under our legitimate interests in letting travellers invite their companions without sending unwanted mail.

We keep a delivery record of each email we send you (the email provider's message reference, your account ID, the kind of notification and the time — not your email address), under our legitimate interests in deliverability and diagnosing failed delivery.

Where we rely on your consent, you may withdraw it at any time. Withdrawal does not affect processing carried out beforehand, and may mean that we can no longer provide certain features to you.

E. Disclosure of your personal data

We may disclose it to the following classes of recipient, in each case only so far as is necessary for the purposes in Section C:

We require our service providers to process personal data only on our instructions, to keep it confidential, to apply appropriate security measures, and not to use it for their own purposes.

Links to other services. Some links on the Platform are affiliate links, and we may receive a commission if you book or buy after following one, at no additional cost to you. We attach a randomly generated reference so the provider can identify the referral as ours; it does not identify you. Sponsored content is labelled as such. Once you leave the Platform, the policies and terms of the operator concerned apply, not ours.

Mapping and place information. Certain features use mapping, place search and place information services supplied by Google. Your use of those features is also subject to the Google Terms of Service, and Google's handling of data in connection with them is described in the Google Privacy Policy.

F. What other users can see

Trips are private by default. Nothing is published outside your trip unless you or the trip host chooses to publish it.

You control your own visibility settings, including whether your profile can be found by other users, in the Platform's settings. To the extent permitted by law, we are not responsible for any disclosure that results from your choice of visibility settings.

G. Transfer of your personal data outside Malaysia

We operate from Malaysia, but the service providers we engage operate internationally. Your personal data may therefore be transferred to, stored in and processed in countries outside Malaysia, which may have different data protection laws. Those countries currently include the United States.

We make such transfers on one or more of the bases permitted under the Personal Data Protection Act 2010, including where the transfer is necessary for the performance of our contract with you, where you have consented, and where we have taken all reasonable precautions and exercised all due diligence to ensure the personal data will be treated in a manner consistent with that Act — in particular by contracting with each service provider on terms requiring appropriate protection. By using the Platform, you consent to such transfers for the purposes set out in this Privacy Policy.

H. Your rights

We make the following rights available to every user of the Platform, regardless of location:

Contact us using the details in Section O. Any request for the porting of your personal data initiated by you pursuant to this clause may take time for us to complete.

Some features use artificial intelligence to generate suggestions and to read information out of documents you provide. These produce suggestions that you review, accept or reject. We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you.

I. Deleting your personal data

You may delete a trip at any time, and close your account at any time from your profile. Closing your account is immediate and cannot be reversed. It removes your login credentials, profile, settings, preferences, connections, notifications, saved payment preferences and any service credentials you supplied to us.

The following is retained after your account is closed:

If you are the host of a trip that still has other members, we will ask you to transfer or remove that trip before your account can be closed, so the group's shared records are not lost without their knowledge.

If you want a copy of your personal data, obtain it before closing your account. We cannot recover it afterwards.

J. Retention

We retain personal data only for as long as it is needed for the purposes in Section C, or for as long as a longer period is required to meet our legal, regulatory, tax or accounting obligations or to establish, exercise or defend legal claims. When it is no longer needed it is deleted or anonymised, including from our backup systems in the ordinary course of their replacement.

In practice, account and trip information is retained while your account or that trip exists; working data generated by particular features, such as drafts and imported messages, is deleted automatically within a short period; technical and security records are retained for a limited period appropriate to their purpose; transaction records are retained for the period required by law; and the record of your choices about our policies and cookies is retained while your account exists, so that we can show what you agreed to and when, and is deleted with your account. A report you file is kept while it is open and for 24 months after it is resolved, then deleted automatically; if you delete your account, the report stays for that period but is no longer linked to you. A check-in is kept with its trip. An invitation email's address is not stored: for 24 hours we keep only a one-way hash of it, to enforce sending limits. If you use "don't email me again" in an invitation, the hash of your address is kept until you withdraw that request by contacting us, because deleting it would resume the email you asked us to stop; it is not linked to any account, so it is not part of an account data export or removed by account deletion. A push device token is kept until you sign out, until the push service reports that the device is no longer registered, or until your account is deleted, whichever comes first. Email delivery records are kept for 90 days and are deleted with your account. Routine database backups are kept for a short period, currently up to about six hours, and are then deleted automatically.

K. Accuracy

We take reasonable steps to ensure the personal data we hold is accurate, complete, not misleading and kept up to date, having regard to the purposes for which it was collected and further processed. Please update your profile and settings when your details change.

Because the Platform is used by groups, other users may enter information about you. If you believe information about you on the Platform is inaccurate or should not be there, contact us using the details in Section O, whether or not you hold an account with us.

L. Security

We take reasonable and appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised or accidental access, disclosure, alteration and destruction. These include storing passwords only in encrypted form, encrypting sensitive credentials at rest, transmitting data over secure connections, restricting internal access to what is necessary, removing location information from uploaded images, and keeping records of administrative actions.

Where we engage a service provider to process personal data on our behalf, we take reasonable steps to satisfy ourselves that it provides sufficient guarantees in respect of the technical and organisational security measures governing that processing, and we contract with it accordingly.

No method of transmission over the internet or of electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential and for activity under your account.

If a breach of personal data occurs, we will notify the Personal Data Protection Commissioner as soon as practicable, and will notify you without unnecessary delay where the breach is likely to cause you significant harm.

M. Children

The Platform is not intended for children under 18, and we do not knowingly collect their personal data. If you are below the age of majority in your jurisdiction, you may use the Platform only with the involvement of your parent or legal guardian. If we become aware that we hold personal data of a child under 18, we may delete it and close the account concerned.

N. Cookies

We use cookies and similar technologies as described in our Cookie Policy, which forms part of this Privacy Policy. Before you register, continue as a guest, join a trip or view a Discover page, we ask you to switch on essential cookies and to agree to our Terms of Use and this Privacy Policy. Non-essential cookies are used only for the purposes you switch on, and you can change that at any time.

We do not yet use analytics or advertising cookies, but we ask about them in advance. If you switch either on, that choice applies when we introduce it, without asking you again; before either starts, we will update the Cookie Policy to name the provider. You can switch them off at any time.

O. Contact us

For any question about this Privacy Policy, to exercise any right in Section H, or to make a complaint:

BITESIZE PROJECTS PLT (registration no. 202604002500(LLP0047744-LGN))
Email: [email protected]
Web: www.me-lancong.my/contact

P. Changes

We may revise this Privacy Policy from time to time. The version number and effective date above will change accordingly, and it is your responsibility to check our website or application periodically for updates. Continued use of the Platform after any changes means you accept the revised Privacy Policy. If you do not accept the changes, you must stop using the Platform and delete your account.

Q. Language

This Privacy Policy is issued in English and in Bahasa Malaysia. In the event of any inconsistency or conflict between the two versions, the English version shall prevail.