PRIVACY NOTICE

1. INTRODUCTION

REN Wellness Retreat (“REN”) respects your privacy and is committed to protecting your Personal Data.

This Privacy Notice explains how your Personal Data may be collected, used, disclosed, stored and otherwise processed when you visit, communicate with, make enquiries with, or use the services, facilities, programmes or platforms of REN.

This Notice is issued in accordance with the Personal Data Protection Act 2010 (Act 709), as amended from time to time (“PDPA”), and applicable regulations, standards, guidelines and directions issued by the Personal Data Protection Commissioner Malaysia.

2. WHO WE ARE

REN Wellness Retreat is a brand owned by:

ERMS Berhad
Company No. 198501012928 (145383-W)
No. 9, Jalan SS12/1
47500 Subang Jaya, Selangor, Malaysia.

REN forms part of an integrated wellness, healthcare and hospitality ecosystem.

Depending on the service or activity involved, Personal Data may be processed by ERMS Berhad, its subsidiaries, affiliates, related entities, business partners, appointed service providers, operators or other relevant parties (“REN Parties”).

For avoidance of doubt, the REN Parties are not necessarily the same legal entity, and each party may have different responsibilities in relation to Personal Data depending on the applicable service, arrangement and processing activity.

Where another entity independently provides a particular service, that entity may provide its own privacy notice and/or consent requirements.

3. PERSONAL DATA WE MAY COLLECT

Depending on your dealings with REN, we may collect and process:

name and contact details;
NRIC, passport and other identification information;
date of birth, gender and nationality;
booking, accommodation, membership and service information;
payment and billing information;
health, medical, wellness, dietary, rehabilitation or other relevant information;
emergency contact, next-of-kin or authorised representative information;
photographs, CCTV and other images or recordings;
information provided through enquiries, forms, surveys, feedback or communications;
website, device, IP address, cookie and technical information; and
other Personal Data reasonably necessary for the purposes described in this Notice.

Certain health, medical, biometric or other information may constitute Sensitive Personal Data under applicable law and will be handled with appropriate safeguards.

4. HOW WE COLLECT PERSONAL DATA

We may collect Personal Data:

directly from you;
from your authorised representative, family member or emergency contact;
from companies or organisations acting on your behalf;
from healthcare, wellness, hospitality or other service providers;
from booking, payment, technology or other business partners;
through our website, systems, applications or other digital platforms;
through CCTV, security and access-control systems; or
from other lawful sources.

Where you provide Personal Data relating to another person, you should ensure that you have the appropriate authority to provide such information and, where required by law, the necessary consent.

5. PURPOSES OF PROCESSING

Your Personal Data may be processed for purposes including:

providing and administering requested services, bookings and appointments;
providing healthcare, wellness, hospitality and related services;
maintaining relevant customer, service or healthcare records;
processing payments, billing, refunds and transactions;
communicating with you regarding your bookings, services and enquiries;
managing customer relationships, feedback and complaints;
safety, security, emergency response and incident management;
complying with applicable laws, regulations, licensing and regulatory requirements;
preventing fraud, misuse or unlawful activities;
protecting the rights, property and safety of REN and relevant persons;
service quality monitoring, analytics and business improvement;
internal administration, audit and record keeping;
managing events, programmes, surveys and membership activities;
sending marketing and promotional communications, where permitted and, where required, with your consent; and
any other purpose reasonably necessary for or related to the above purposes or otherwise permitted or required by law.

6. CONSENT AND OTHER LAWFUL PROCESSING

Depending on the circumstances, Personal Data may be processed:

with your consent where required;
to provide a service or fulfil a transaction requested by you;
to comply with legal or regulatory obligations;
to protect your vital interests or those of another person;
for the establishment, exercise or defence of legal rights; or
where otherwise permitted or required under applicable law.

Where processing is based on consent, you may withdraw your consent subject to applicable law.

Marketing and promotional communications are optional and you may opt out or withdraw your marketing consent at any time.

7. DISCLOSURE OF PERSONAL DATA

Where reasonably necessary for the purposes described in this Notice, Personal Data may be disclosed or made accessible to:

ERMS Berhad and relevant subsidiaries, affiliates and related entities;
relevant REN Parties;
healthcare, wellness, hospitality and professional service providers;
practitioners, consultants and appointed representatives;
banks, payment processors and insurers;
IT, cloud, software, booking, security and other technology providers;
auditors, lawyers, accountants and other professional advisers;
government, regulatory, licensing and enforcement authorities; and
other parties where disclosure is permitted or required by law or necessary for the relevant service or transaction.

Where appropriate, REN will take reasonable steps to ensure that third parties receiving Personal Data provide appropriate protection and process the information only for authorised purposes.

8. CROSS-BORDER TRANSFERS

Your Personal Data may be transferred to, stored in or accessed from locations outside Malaysia where reasonably necessary for our operations, technology infrastructure, services or service providers.

Where applicable, REN will comply with the requirements of the PDPA relating to cross-border transfers and implement appropriate safeguards in accordance with applicable law and regulatory requirements.

9. SECURITY AND RETENTION

REN takes reasonable and appropriate administrative, technical and physical measures to protect Personal Data against unauthorised access, disclosure, misuse, alteration, loss or destruction.

Access to Personal Data is restricted to authorised persons who require it for legitimate purposes.

We retain Personal Data only for as long as reasonably necessary for the purposes for which it was collected or as required or permitted by applicable law, regulatory, contractual, accounting, audit or other legitimate requirements

10. YOUR RIGHTS

Subject to applicable law, you may have the right to:

request access to your Personal Data;
request correction of inaccurate or incomplete Personal Data;
withdraw consent where processing is based on consent;
opt out of direct marketing;
exercise other rights available under the PDPA; and
lodge a privacy-related enquiry or complaint.

Requests may be subject to identity verification and applicable legal limitations.

11. COOKIES AND WEBSITE TECHNOLOGIES

Our website may use cookies and similar technologies to operate, secure, analyse and improve the website and, where applicable, support communications and marketing.

You may manage certain cookie settings through your browser or other available controls. Disabling certain cookies may affect website functionality.

Third-party websites, platforms or services linked to or integrated with our website may have their own privacy practices and notices.

12. CHILDREN AND OTHER REPRESENTED PERSONS

Where services are provided to a minor or a person requiring a parent, guardian or authorised representative, REN may require the appropriate consent or authorisation before collecting or processing Personal Data, where applicable.

13. DATA BREACHES

REN maintains procedures for managing Personal Data breaches and security incidents.

Where notification is required under applicable law or regulatory requirements, REN will take the necessary steps to notify the relevant authorities and/or affected individuals within the applicable timeframe.

14. DATA PROTECTION OFFICER / PRIVACY CONTACT

For any enquiry, request, complaint or matter relating to your Personal Data, please contact:

Data Protection Officer / Privacy Contact
REN Wellness Retreat / ERMS Berhad
No. 9, Jalan SS12/1
47500 Subang Jaya
Selangor, Malaysia

Email: legal@renwr.com

15. CHANGES TO THIS PRIVACY NOTICE

REN may update this Privacy Notice from time to time to reflect changes in our services, operations, technology, legal requirements or data processing practices.

The latest version will be published on the REN Wellness Retreat website together with the applicable “Last Updated” date.

Where required by applicable law, we will provide additional notice and/or obtain the appropriate consent for material changes to the processing of Personal Data.

16. ACKNOWLEDGEMENT

By providing Personal Data to REN, you acknowledge that you have been provided with or have had reasonable access to this Privacy Notice.

This Privacy Notice is not, by itself, a blanket consent to all processing of Personal Data. Where specific consent is required, REN may request such consent separately.

Specific services, including healthcare, psychology and counselling, rehabilitation, nursing, T&CM, marketing, photography, events or other specialised services, may be subject to additional terms, privacy notices, informed consent forms or specific consents.

REN WELLNESS RETREAT
A brand owned by ERMS Berhad
Company No. 198501012928 (145383-W)
No. 9, Jalan SS12/1
47500 Subang Jaya
Selangor, Malaysia

Email: legal@renwr.com
Website: https://renwr.com

Last Updated: 23 September 2026