DATA PROTECTION POLICY

Freme Travel Services Sdn Bhd (“Freme” or “we”) collects, uses, discloses, processes and cares for (collectively, “processes”) personal data in accordance with the Personal Data Protection Order, 2025
(“PDPO”). This Data Protection Policy (“Policy”) explains how we process personal data while meeting the requirements of the PDPO.

How we collect personal data

  • The term “personal data” means data, whether true or not, about an individual who can be identified either (a) from the data, or (b) from the data and other information which we have or to which we are likely to have access.
  • We may collect personal data about you, directly from you or from another person or organisation, in the following circumstances:
    (a) During booking process of air tickets, tours, hotels etc.
    (b) During recruitment process and for HR purposes.
    (c) During lucky draws and other registrations.
  • We may collect the following types of personal data about you when reasonably required for any of the purposes specified in this Policy:
    (a) Full name
    (b) Identification Number/Copy ( IC or Passport)
    (c) Date of Birth
    (d) Gender
    (e) Nationality
    (f) Contact details

Why we collect, use and disclose your personal data

  • Purposes for Collecting, Using and Disclosing Personal Data
    • We may collect and use your personal data for the following purposes (as may be applicable):
      (a) To make bookings on behalf such as with airlines, tour or accommodation providers.
      (b) For HR records on employee data or during recruitment and work permit application process.
      (c) For lucky draw during our promotional periods.
    • We may disclose your personal data where reasonably
      required for any of the purposes specified in paragraph 2.1.1
      to:
      (a) Freme’s sales and operations teams.
      (b) Freme’s HR and management team.
      (c) 3rd party suppliers such as airlines, accommodation providers, travel agents and tour providers, embassies for visa processing etc.

Consent and Withdrawal of Consent

  • We may collect, use and disclose personal data about you where permitted or required by law or otherwise with your consent or deemed consent in accordance with the PDPO.
    Without limiting the foregoing and subject to any specific data protection notice we may give ] to you and the terms and conditions of any contract which may be agreed between us, if
    you provide any personal data to us, whether directly or indirectly through another party, you consent to our collection, use and disclosure of such data in accordance with this Policy.
  • You may withdraw any consent given or deemed to have been given in relation to the collection, use and disclosure of your personal data by giving us not less than 14 days prior written notice in the manner stated in this Policy (above). Your notice for withdrawing consent must clearly state the following:
    (a) Your full name;
    (b) Your address, telephone number or email address;
    (c) The personal data affected by your notice; and
    (d) The purposes or activities for which you are withdrawing consent.
  • We may contact you in relation to your withdrawal of consent
    should we require additional information to process your withdrawal of consent or to inform you of the consequences of your withdrawal of consent.

Access to and Correction of Personal Data

  • You may make a request for access to, or correction of, your
    personal data which is in our possession or under our control in accordance with (and subject to) the PDPO and its regulations.
  • A request under paragraph 4.1 shall be made in writing and sent to us in the manner stated in this Policy (above). Your request must state the following:
    (a) Your full name;
    (b) Your address, telephone number or email address (so that we may contact you in relation to your request);
    (c) That you are making the request under the PDPO;
    (d) Whether you are requesting for access to your personal data or for a correction to be made to an error or omission in your personal data; and
    (e) The specific personal data or correction you are requesting.
  • We may contact you in relation to your request should we require additional information to process your request.

Care of Personal Data

  • Accuracy of Personal Data
    • We shall take reasonable steps to ensure personal data collected by us or on our behalf is accurate and complete if:
      (a) it is likely to be used to make a decision that affects you; or
      (b) it is likely to be disclosed to another organisation.
    • Where you provide your personal data directly to us, we shall be entitled to assume that it is accurate and complete.
  • Protection of Personal Data and Data Breach Notification
    • We shall protect personal data in our possession or under our control by making reasonable security arrangements to prevent loss, unauthorised access, collection, use, disclosure,
      copying, modification, disposal or similar risks.
    • We shall notify you (in accordance with and subject to the PDPO) in the event of a data breach affecting your personal data which may cause significant harm.
  • Retention of Personal Data
    • We may retain your personal data as long as reasonably required for any of the purposes specified in this Policy and for any other legal or business purpose permitted by law.
  • Transfer of Personal Data Outside of Brunei Darussalam
    • If we transfer personal data to a country outside of Brunei Darussalam, we shall ensure that it is protected to a standard of protection that is comparable to the protection under the PDPO in the manner prescribed in the relevant regulations under the PDPO.

For any data protection related concerns

Amendments

  • We may amend or update this Policy from time to time. Please refer to our website (at www.freme.com) for the latest version.

(Date Issued: 2 January 2026 / Last Updated: 22 April 2026)