Privacy Policy

Personal Information We Collect

We collect personal information through the following methods:

1. Information you provide directly
   Name, email address, and other details submitted via inquiry forms, comment sections, and newsletter sign-ups.
2. Information collected automatically
   Cookies, IP address, access timestamps, browser/OS information, referrers, etc. (obtained via Google Analytics 4, Meta Pixel, Cloudflare WAF, and similar tools).
3. Information obtained from third parties
   Non-identifiable data such as reservation IDs, purchase amounts, and conversion timestamps provided when bookings/purchases are completed through affiliate links (e.g., Klook, Chope, Trip.com).

Purposes of Use

• Responding to inquiries and verifying identity
• Distributing newsletters with new features and campaign updates
• Improving site quality and optimizing content through analytics
• Ad delivery and affiliate performance measurement
• Investigating and preventing violations of laws or terms

Legal Bases (GDPR Articles 6 and 13; PDP Law Article 20)

We process personal data on one or more of the following legal bases:

• Your explicit consent
• Performance of a contract or steps prior to entering into a contract
• Our legitimate interests (e.g., marketing, security)
• Compliance with legal obligations

Sharing and Joint Use of Personal Information

We may provide personal information to, or jointly use it with, the following entities. Please refer to each company’s privacy policy for details.

Use of Cookies and Similar Technologies

We use cookies to enhance user experience and for statistical analysis. A banner is displayed on first visit to allow you to accept or reject cookies. You can disable cookies in your browser settings; however, some features may not function properly.

Cross-Border Data Transfers

Our servers are located in Indonesia, but some service providers operate servers in the United States, Singapore, and Japan. For transfers from GDPR jurisdictions, we implement appropriate safeguards such as Standard Contractual Clauses (SCCs).

Data Retention

We retain personal information only for as long as necessary to fulfil the purposes described above and as required by law, after which it is deleted or anonymized. Example: Google Analytics user-level tracking data is automatically deleted after 26 months.

Data Subject Rights

You have the following rights. To exercise them, please contact us via the details in the Contact section.

• Right of access (disclosure of retained personal data)
• Rights to rectification and erasure
• Rights to restriction of processing and to object
• Right to data portability
• Right to withdraw consent

Security Measures

We implement appropriate technical and organizational security measures, including SSL/TLS encryption, two-factor authentication, WordPress security plugins, Cloudflare WAF, regular vulnerability scans, and least-privilege access control.

Children’s Privacy

Our Site is not directed to children under the age of 13, and we do not knowingly collect personal information from such children. If we learn that information has been collected inappropriately, we will promptly delete it.

Disclaimers

• We cannot be responsible for privacy practices on external sites linked from our pages.
• Information that users voluntarily disclose (e.g., in comments) may be viewed by third parties.

Changes to This Policy

We may revise this Policy without prior notice due to legal changes or service updates. For material changes, we will provide notice on the Site and may request renewed consent.

Contact

If you have any questions about this Policy, please contact us at: