Privacy Policy

Last updated: 17 October 2026

NapzBox is run by Napz Holdings Berhad ("we", "us"). We respect your privacy. This notice explains, in line with Malaysia's Personal Data Protection Act 2010 (PDPA), what personal data we collect, why, who we share it with, and your rights.

1. What we collect

• When you book on napzbox.com: your name, email address, phone number, dates of stay, pod type, number of guests, any special requests, and your agreement to our terms.
• Payment: payments are made on the secure pages of our payment providers. We receive the payment status, amount and a reference number. We never see or store your full card or bank details.
• At check-in: your IC or passport details, as Malaysian law requires for hotel guest registration.
• When you contact us (phone, WhatsApp, email or feedback forms): what you tell us.
• Website data: basic technical data such as browser type and IP address, kept in server logs for security. We do not use advertising tracking tools such as Meta Pixel.
• Analytics cookies: we use Google Analytics, which sets cookies to measure visits to our website, such as which pages are viewed and how visitors find us. These are anonymous usage statistics; we do not use them to identify you. Google processes this data for us. To opt out, install the Google Analytics opt-out browser add-on or block cookies in your browser settings.

2. Why we use it

• To take, confirm and manage your booking, and to check you in.
• To take payments, and to process refunds under our Cancellation & Refund Policy.
• To send your booking confirmation and messages about your stay.
• To answer your questions and improve our service.
• To meet legal duties, such as guest registration, tax and accounting records.
• To send offers, only if you agree. You can stop these at any time.

3. Who we share it with

We do not sell your data. We share it only with service providers who help us run bookings, and only what they need:

• Stripe and CHIP: process online payments (cards, online banking, e-wallets).
• Resend: sends our booking confirmation emails.
• Cloudflare: hosts and secures our website.
• Google (Google Analytics): measures website visits for us.
• Our hotel management system, used by reception to manage bookings.
• Government authorities, when the law requires it.

Some of these providers store data outside Malaysia. When that happens, we use providers that protect personal data to a standard similar to the PDPA.

4. How long we keep it

We keep booking and payment records for as long as the law requires for tax and accounting (generally 7 years), and other data only as long as we need it. After that we delete it or make it anonymous.

5. Keeping it safe

We use secure (HTTPS) connections, limit staff access and use trusted providers. No system is 100% secure, but we take reasonable steps to protect your data.

6. Your rights

Under the PDPA you can:

• ask for a copy of the personal data we hold about you,
• ask us to correct it,
• withdraw your consent, or ask us to stop sending marketing messages,
• ask questions or complain about how we use your data.

Contact us using the details below. We will reply within 21 days, as the PDPA requires. If you do not give us the data we need for a booking, we may not be able to accept it.

7. Changes

We may update this policy. The latest version is always on this page, with the date it was updated.