How Qembara collects, uses, shares and protects personal data.
Important
This Privacy Policy explains what personal data Qembara collects, why it uses it, who receives it, how long it is kept, how transfers are protected and how you may exercise your rights. Qembara operates the marketplace. Hosts ordinarily supply Experiences and may separately control information needed to deliver them. This Policy is a notice; it is not blanket consent, and Qembara will ask for consent separately where consent is required.
Simple Summary
Qembara collects the information needed to run accounts, Bookings, payments, safety and support. Qembara does not sell, rent or trade personal data. Hosts receive only what they need to deliver your Booking and must not use it for anything else. Marketing and non-essential cookies are optional. You can ask to access or correct your data, withdraw consent and complain, by writing to support@qembara.com. Qembara is based in Singapore and follows Singapore’s Personal Data Protection Act 2012 and other laws that apply where Experiences take place. This summary is for convenience only; if it conflicts with the full Policy, the full Policy applies.
QEMBARA EXPERIENCES PRIVATE LIMITED, a company incorporated in Singapore with Company Unique Entity (UEN) Number 202645696M (Qembara, we, us or our), operates the Qembara online marketplace, including its websites, applications, communications, booking, payment-facilitation, trust, safety and support services (the Platform). This Policy applies whenever you browse or use the Platform, create an account, list or book an Experience, participate in an Experience, contact us or otherwise interact with Qembara.
Qembara processes personal data in accordance with Singapore’s Personal Data Protection Act 2012 (PDPA). Where an Experience takes place or a user is located in Indonesia, Malaysia or Saudi Arabia, Qembara will also comply with the data-protection law that applies there, such as Indonesia’s Personal Data Protection Law (Law No. 27 of 2022), Malaysia’s Personal Data Protection Act 2010 and Saudi Arabia’s Personal Data Protection Law.
Qembara is responsible for deciding why and how it processes personal data for its own Platform purposes. Where Qembara processes data solely on another party’s documented instructions, a separate written arrangement will define the parties’ roles.
A Host is ordinarily the independent supplier of an Experience. Privacy roles are determined activity by activity from the parties’ actual decisions and conduct, not by a general label. As stated in section 28 of the Host Terms, a Host acts as an independent controller when using Guest or Participant data to prepare for and deliver the Experience, meet legal duties and manage operational safety. Qembara and the Host are each responsible for processing under their respective control. Nothing in this Policy excludes responsibility imposed by law. Qembara remains responsible for its disclosure choices, Platform security, role classification and enforcement of Host data-use restrictions.
This Policy does not govern an independent third-party website, application, payment service or social-media service. The third party’s own notice may also apply.
This Policy forms part of the documents referred to in the Guest Terms, Host Terms and Payment Terms, and uses the defined terms in those documents. It is provided in English. This does not limit any language-related right required by law.
Booking means a reservation confirmed by a Booking Confirmation.
Booking Guest means the Guest who submits the Booking Request and contracts with the Host for the Booking. A Booking Guest must be at least 21 years old.
Experience means an activity, tour, workshop, class, meal, event, transport component or other service listed through Qembara and supplied by a Host.
Guest means a person who browses, submits a Booking Request, makes a Booking or participates in an Experience.
Host means the independent third-party supplier identified in the Listing and Booking Confirmation who offers and is contractually responsible to the Booking Guest for delivering the Experience.
Listing means the page on the Platform that describes an Experience.
Participant means any person included in a Booking, including a minor where the Listing permits.
Personal data means information about an individual who can be identified from that information, alone or with other information Qembara has or is likely to have access to, whether true or not.
Sensitive information means information needing enhanced care because misuse could cause significant harm, including health, disability, biometric, identity-document, passport or visa, precise-location, religious-belief or criminal-allegation information.
3.1 Information you provide. Qembara collects the following information that you give us:
Account and identity information: name, contact details, age confirmation, profile photograph, preferred language, country and account credentials.
Booking and Participant information: Experience, date, participant count, names where genuinely needed, age band, accessibility needs, dietary information (including halal or other faith-based dietary needs), allergies, emergency information and messages.
Host information: legal and trading identity, registration and tax details, licences, qualifications, insurance, Listing content, availability, payout instructions and representatives.
Payment and transaction information: payment token, billing information, currency, amounts, refunds, chargebacks and payout records. Card details are held by the payment provider as tokens; Qembara does not store full card numbers.
Communications and content: support requests, complaints, reviews, ratings, photos, recordings, surveys, incident reports and dispute evidence.
Verification and compliance information: identity documents, liveness checks where lawfully used, verification results, tax identifiers, fraud indicators and information required by law or payment providers.
3.2 Information collected automatically. When you use the Platform, Qembara collects:
Device and network data: IP address, device identifiers, browser, operating system, language, time zone and approximate location derived from IP.
Usage data: pages viewed, searches, clicks, referral source, booking funnel, timestamps, session activity, errors and message interactions.
Cookie and similar-technology data: data used for essential operation, security, preferences and measurement and, where you consent, personalisation or advertising, as explained in section 8.
Security data: login attempts, authentication events, suspicious activity, device reputation and Platform communications reasonably reviewed for support, safety or fraud prevention.
3.3 Information from others. A Booking Guest may provide only the Participant information genuinely needed for a Booking and must have authority to do so, as stated in section 8 of the Guest Terms. Before any third-party information is entered, Qembara will display or link to a short Participant privacy notice that the Booking Guest can share. Where Qembara will receive sensitive information about another adult and consent is required, Qembara will obtain consent through a direct link sent to that Participant, record the notice and consent version, and provide a route to withdraw consent and exercise applicable rights.
Hosts, payment and verification providers, fraud-prevention services, authorities, insurers, advisers, public sources and other users may provide information relevant to attendance, transactions, safety, fraud, claims or legal compliance.
Qembara uses personal data for the following purposes:
Accounts and Platform: identity, contact, credentials, device and usage data to provide requested services and manage the user relationship.
Bookings and Experiences: Booking, Participant, Host, communication and transaction data to arrange and administer a Booking and support delivery by the Host.
Payments and Payouts: identity, transaction, billing, payout and fraud data for payment administration under the Payment Terms, contractual performance and legal compliance.
Trust, safety and support: messages, incident evidence, identity, device and booking data for safety, support, legal obligations and emergency protection under the Safety & Incident Policy.
Fraud and misuse: account, device, network, payment and behavioural signals to prevent fraud, secure the Platform and enforce Qembara’s terms.
Host and Listing checks: business identity, qualifications, licences, insurance and Listing data for marketplace integrity, legal compliance and safety, including the checks in section 5 of the Host Terms.
Service and legal notices: contact, account and booking data for operational communications and notices.
Improvement and analytics: usage, search, support and aggregated transaction data to measure and improve the Platform, subject to your choices.
Marketing: contact, preferences, usage and campaign data only with valid consent or another basis permitted by law; you may opt out at any time.
Law and claims: relevant account, transaction, identity, tax, safety and evidence data to comply with law and establish, exercise or defend claims.
Qembara will request consent separately when required, especially for optional marketing, non-essential cookies, sensitive information or a new optional use. Consent will be specific, informed, recorded and as easy to withdraw as to give. Withdrawal does not affect earlier lawful processing but may prevent a feature or accommodation that genuinely requires the information. Qembara will not use personal data for a materially incompatible new purpose without appropriate notice and, where required, fresh consent.
At each sensitive-data field, Qembara will explain why the information is requested, whether it is optional, whether Qembara, the identified Host or both will receive it, whether access may occur outside the place of collection, the relevant retention period and how consent may be withdrawn.
Qembara and Hosts will collect only what is reasonably needed to assess suitability, provide an agreed accommodation, manage safety or comply with law; will not display sensitive information publicly or use it for marketing, profiling or unrelated purposes; and will restrict access to people who genuinely need it for the disclosed purpose. Identity documents, medical records and other highly sensitive material must be sent through a secure upload route, not ordinary messages. In an emergency, relevant information will be disclosed only where lawful and reasonably necessary to protect life, health or safety.
Dietary, prayer or other faith-related preferences you share to use a Muslim-friendly or halal-labelled Experience may reveal religious belief. Providing them is optional, and they are used only to deliver the Booking and are not used for marketing or profiling.
Where an Experience crosses an international border, the Host or the disclosed transport operator may need passport, visa or other travel-document details to arrange travel, as disclosed in the Listing under section 15 of the Guest Terms. That information is collected only where required and is handled as sensitive information.
Payments are processed as described in the Payment Terms. Card details are tokenised by the payment provider, and some providers independently decide processing required by payment networks, anti-money-laundering, sanctions, fraud, tax or regulatory rules. Qembara will maintain a list of its payment, payout, identity-verification, cloud, analytics and communications providers, their roles and principal processing locations and will keep it up to date.
Qembara may use automated tools for security and fraud detection, identity verification, account or Booking restrictions, search ranking, recommendations and marketing personalisation. The data used, purpose and possible consequence will be explained where it is not reasonably apparent. Qembara does not use solely automated processing to make a decision producing legal or similarly significant effects unless permitted by law and protected by suitable safeguards. Qembara does not use personal data to set personalised prices; the Qembara Guest Service Fee is calculated as a percentage of the Host Amount under the Payment Terms.
Where an automated or assisted decision materially affects verification, an account, a transaction or a Booking, you may request review by a competent person who will consider additional evidence and has authority to change Qembara’s outcome. If a regulated or independent provider controls the final decision, Qembara will explain that limitation and provide or facilitate the provider’s review or appeal route. Qembara will explain the main reason for the outcome where lawful and safe. This commitment does not require manual review of every search ranking or recommendation.
Qembara sends transactional messages needed for accounts and Bookings, such as confirmations, changes, safety alerts, payment notices, support responses and policy updates. These are not optional marketing.
Promotional email, telephone, text message, push notification and targeted campaigns are sent only with the consent or other permission required by law. For telephone or text marketing to Singapore numbers, Qembara will obtain clear and unambiguous consent in evidential form or check the Singapore Do Not Call Registry, as required. It will retain the consent wording and version, date, time, channel, scope, withdrawal record and register-check evidence where applicable. You may unsubscribe in the message, change account preferences or contact Qembara. Opting out of marketing does not stop essential service communications.
Qembara serves Guests and Hosts in Indonesia, Malaysia, Saudi Arabia and Singapore. Hosts, providers and support personnel may therefore access personal data from a country other than the one where it was collected, for example when a Host in Batam receives a Singapore Guest’s Booking. Before permitting a restricted transfer or access, Qembara will assess the recipient, purpose, data categories, necessity, onward transfers and security; use a lawful transfer mechanism; and take steps to ensure a standard of protection comparable to that required under the PDPA.
Safeguards may include binding contractual clauses, recognised adequacy or certification mechanisms, provider assessments, encryption, access restrictions, data minimisation or a legally permitted exception. Consent will not be used to replace appropriate safeguards where it is not a valid or proportionate transfer basis. You may request information about the applicable safeguard, subject to lawful confidentiality limits.
Qembara keeps personal data only for as long as needed for the purpose it was collected for, or as required by law. The standard periods are:
Active account and profile: for the account’s life. Core account and security records: up to 24 months after closure, unless a longer legal or claims period applies.
Unsuccessful Booking Request: up to 12 months after the request ends. Participant and sensitive information is removed earlier when no longer needed, unless a complaint, fraud review or legal hold applies.
Financial, tax and payment records: 5 years after the end of the relevant financial year, or longer where law, payment rules or an active claim requires. This period does not automatically apply to Participant data, sensitive information or routine messages.
Identity verification: raw identity documents are not retained where a provider’s verification result is sufficient. If Qembara receives a raw document, it is deleted within 30 days after verification unless a documented legal need requires longer. Verification results follow a risk-based period stated at collection.
Routine messages and support: general enquiries up to 12 months after closure; Booking communications up to 24 months after the Booking or case closes. Sensitive, Participant, identity-document, safety, fraud or dispute content within a message follows the shorter or case-specific rule for that content, including in exports and backups.
Safety incidents and disputes: minor matters follow a shorter, case-specific period. Serious incident, fraud and claim evidence is kept until final resolution and the documented claims period ends, subject to legal hold, restricted access and six-monthly review.
Marketing consent and suppression: consent evidence while used and for 24 months after withdrawal; minimal suppression data for as long as needed to respect the opt-out.
Cookies and analytics: as stated in the Cookie Policy, with non-essential identifiers ordinarily kept no longer than 13 months unless consent is renewed or a shorter period applies.
Participant, accessibility and health information: deleted or anonymised within 30 days after the Experience, unless an unresolved accommodation, safety incident, complaint, consent record or legal hold requires a documented longer period.
Qembara will delete, anonymise or securely isolate information when the applicable period expires. Deletion follows the content and sensitivity of the data across messages, support tickets, logs, exports, backups and Host-accessible copies. Qembara will contractually require Hosts to delete or anonymise Qembara-sourced copies when instructed or when the permitted period ends, except records the law requires them to keep. Legal holds are documented, limited to the affected data and reviewed at least every six months. Retention periods are reviewed at least annually.
Qembara uses risk-appropriate administrative, technical and physical safeguards, including access control, authentication, encryption where appropriate, secure development, logging, backups, vendor review, staff confidentiality and incident response. No online service can guarantee absolute security.
If a breach occurs, Qembara will contain and assess it, preserve evidence, mitigate harm and notify affected individuals and the competent authority where required. Qembara will begin its assessment immediately and complete it within 30 calendar days after it first has credible grounds to believe a breach occurred, or sooner where applicable law requires. Where notification to Singapore’s Personal Data Protection Commission is required, it will be made as soon as practicable and no later than three calendar days after Qembara determines that the breach is notifiable. Affected individuals will be notified as soon as practicable where required, with clear protective steps. Breaches affecting users in other launch markets will be notified to the local authority within the period that law requires.
Hosts and providers must notify Qembara within 24 hours after becoming aware of a suspected breach affecting Qembara-sourced data. Qembara remains responsible for its own assessment and notification.
Subject to applicable law, you may exercise the following rights:
Access: ask whether Qembara holds personal data about you and request a copy, with information about how it has been used or disclosed where required.
Correction: ask Qembara to correct inaccurate or incomplete data.
Withdrawal of consent: withdraw consent for future processing based on consent.
Marketing: object to direct marketing and change your communication preferences.
Other statutory rights: use any right to deletion, restriction, portability or human review that applies to the relevant processing under the law of your location.
Complaint: complain to Qembara or the competent data-protection authority.
Send requests to support@qembara.com, marked for the attention of the Data Protection Officer. Qembara may request proportionate identity verification and clarification. An authorised representative must prove authority. Qembara will respond as soon as reasonably possible. If it cannot complete an access or correction request within 30 days, it will tell you in writing when it expects to respond. Qembara will explain any lawful refusal, limitation, fee or extension.
Rights are not absolute. Qembara may retain or withhold information where necessary to protect another person, preserve legal privilege, prevent fraud, comply with law or establish, exercise or defend claims. Qembara will not disadvantage you for exercising a privacy right.
You must be at least 21 to make a Booking, as stated in section 4 of the Guest Terms, and at least 18 to register as a Host, as stated in section 4 of the Host Terms. Qembara does not knowingly permit anyone under 18 to create an account. A minor may participate only where the Listing permits and the Booking Guest or lawful guardian has authority.
Information about a minor Participant must be limited to what is genuinely needed for eligibility, safeguarding, accessibility, safety or law. Where consent is required, Qembara or the Host will obtain it from the appropriate parent, guardian or authorised person and verify authority proportionately. Qembara will not use a minor’s data for behavioural advertising or direct marketing. Suspected improper collection may be reported for prompt review and deletion where appropriate.
Profiles, Listings, reviews, ratings and content you choose to publish may be visible to others, as described in the Reviews & Content Policy. Qembara will indicate the intended audience where it is not obvious. Do not post another person’s personal data, image or sensitive information without authority.
Participation in an Experience does not itself authorise promotional recording. Consent to promotional use of an identifiable image must be specific and recorded and may be withdrawn for future use where applicable. Qembara may moderate content and retain a restricted copy where needed for evidence, legal compliance or enforcement.
You may request closure through account settings or by writing to support@qembara.com. Closure does not require immediate deletion of data retained for Bookings, payments, safety, fraud prevention, disputes, tax, legal duties or others’ rights. Qembara will explain material continuing retention where appropriate.
Qembara may update this Policy for legal, technical or service changes. The current version and effective date will be published on the Platform, and earlier versions will be archived. If a change materially affects how personal data is used, Qembara will provide prominent advance notice and obtain consent where required. Confirmed Bookings retain their recorded contractual terms, while this Policy governs ongoing processing from its effective date to the extent permitted by law.
Contact Qembara’s Data Protection Officer at support@qembara.com with a question, request or complaint. State your name, account email, relevant Booking reference and the right or issue concerned. Do not send identity documents by ordinary email; Qembara will provide a secure upload link when identity verification is needed.
For urgent safety matters, use the support routes in section 27 of the Guest Terms, which operate 24 hours a day, 7 days a week. Qembara aims to acknowledge an ordinary complaint within two business days and provide a substantive response within 14 calendar days, or explain why more time is needed.
You may also complain to Singapore’s Personal Data Protection Commission at www.pdpc.gov.sg or to the data-protection authority where you live. This does not limit any other complaint right.
QEMBARA EXPERIENCES PRIVATE LIMITED operates the Qembara Platform and provides marketplace, booking, payment-facilitation and support services. Except where a Listing expressly identifies Qembara as the supplier, Qembara is not the Host and is not a party to the Experience Contract.