Privacy policy
Who is responsible
[Company name — PT / CV / individual owner], Jl. [street], Mas, Kecamatan Ubud, Kabupaten Gianyar, Bali [postcode], Indonesia ("we") is the data controller of your personal data. Contact for any privacy request: amarellubudvilla@gmail.com.
What we collect
When you book: name, email, phone, country, arrival time, special requests and the booking details. Payments are processed by Stripe — we never see or store your card number. If you accept analytics: anonymous usage data (pages viewed, device type, language, referring site) with a random session id. When you write to us by email or WhatsApp: your message and contact details.
Why we use it (legal basis)
To manage your booking and stay (performance of a contract); to comply with Indonesian law, including guest registration and tax/accounting rules (legal obligation); to prevent fraud and keep the Site secure (legitimate interest); and to send news and offers only if you ticked the box (consent, which you can withdraw at any time).
Who receives it
Only providers that help us run the service, bound by confidentiality: Stripe (payments), our website and database host, our email delivery service and Google (reviews/maps). Some are located outside Indonesia (e.g. USA or EU) with appropriate safeguards. Indonesian authorities receive guest data where the law requires it. We never sell your data.
How long we keep it
Booking and invoicing data: as long as required by Indonesian tax and accounting law (up to 10 years). Marketing consent: until you withdraw it. Anonymous analytics: up to 26 months.
Your rights
Under Law No. 27/2022 (UU PDP) and, where applicable, the EU GDPR, you may access, correct, update, delete or obtain a copy of your data, restrict or object to its use, and withdraw consent. Write to us and we will reply within 3×24 hours as required by UU PDP. You may also complain to the competent data protection authority.
Security
Data is sent over encrypted connections (HTTPS/TLS), access to the booking system is limited to authorised staff with personal accounts, and card payments are handled by Stripe (PCI-DSS Level 1). In the unlikely event of a data breach we will notify you and the authority within 3×24 hours.
Children
Bookings must be made by adults (18+). We do not knowingly collect data from children.
Last updated October 2026