Bali Expedition (“we,” “us,” “our”) operates baliexpedition.com and the booking services on it. This Privacy Policy explains what personal data we collect when you browse the site or book a tour, why we collect it, who we share it with, and the choices and rights you have over it.
By using this website or making a booking, you agree to the collection and use of information in line with this policy. If you do not agree, please do not submit a booking or personal information through the site.
Who we are
Bali Expedition
[Registered business name / PT / CV — please complete]
[Registered office address, Bali, Indonesia — please complete]
Email: hadimahmud.id@gmail.com
WhatsApp / Phone: +62 812 3456 7890
For any question about this policy or your personal data, this email address is the fastest way to reach us.
Information we collect
We only ask for what a booking actually needs. Depending on how you use the site, we collect:
Information you give us directly
- Booking details — first and last name, email address, phone number (with country code), country of residence, number of adults and children, chosen tour and date, pickup hotel/villa name or address, and any note you add (for example a dietary restriction or accessibility request).
- Account details — if you create an account, your name, email address, and a login history tied to that account.
- Reviews — if you leave a review, the name you submit it under, your rating, and the text of the review, which is displayed publicly on the relevant tour page.
- Messages — anything you send us by email, WhatsApp, or a contact form, including the content of that message and the contact details you sent it from.
Information collected automatically
- Cart and wishlist — a randomly generated session identifier stored in a cookie, so your cart and wishlist survive between pages. It does not contain your name or any personal detail by itself.
- Display currency — a cookie recording whether you chose to browse prices in USD or IDR, so we don’t ask again on your next visit.
- Technical data — standard web server logs (IP address, browser type, pages visited, timestamps), kept for security and troubleshooting.
We do not run advertising trackers, and we do not use analytics cookies that build a profile of you across other websites. The only cookies this site sets are the two described above, plus the ones WordPress itself uses to keep you logged in if you have an account.
Payment information
We do not collect or store your card number, card expiry date, CVV, or bank login details anywhere on our systems. When you pay:
- by bank transfer, you send funds directly through your own bank, and you upload or send us proof of transfer, which we keep as a record of that payment;
- by Xendit (cards, virtual account, e-wallets), your payment details are entered directly into Xendit’s own secure payment page and handled under Xendit’s privacy policy — we only receive confirmation that the payment succeeded, the amount, and a transaction reference;
- by PayPal, your payment details are entered directly into PayPal’s own secure checkout and handled under PayPal’s privacy policy — we only receive confirmation that the payment succeeded, the amount, and a transaction reference.
How we use your information
We use the information above to:
- process and confirm your booking, calculate the correct price, and arrange your pickup;
- communicate with you about your booking — confirmations, payment reminders, schedule changes, and reminders before your tour date;
- respond to questions you send us, including support requests and booking lookups;
- process refunds and cancellations in line with our Refund & Cancellation Policy;
- display the reviews you choose to submit;
- keep records we are required to keep for accounting, tax, and legal purposes;
- detect and prevent fraud, abuse, or misuse of the booking system;
- maintain and improve the security and reliability of the website.
We do not use your information for automated decision-making that produces legal effects, and we do not send marketing newsletters — every email we send you relates directly to a booking you made or an enquiry you sent.
Who we share your information with
We do not sell, rent, or trade your personal data. We share it only with the parties needed to deliver your booking:
- Payment processors — Xendit and PayPal, to process the payment you chose. Each handles the payment details you enter directly with them, under their own privacy policy.
- Our driver, guide, or partner operator for the specific tour you booked, limited to your name, guest count, contact number, and pickup location — what they need to find and safely guide you.
- Hosting and email infrastructure providers who store the website’s data and deliver transactional emails on our behalf, under a duty of confidentiality.
- Authorities, if required by Indonesian law, a court order, or to protect the rights, property, or safety of Bali Expedition, our guests, or the public.
How long we keep your information
We keep booking and payment records for as long as Indonesian tax and accounting law requires (generally up to 10 years), and account or review data for as long as your account exists or your review remains published. You can ask us to delete data we are not legally required to keep — see “Your rights” below.
Your rights
Under Indonesia’s Personal Data Protection Law (UU No. 27 of 2022) and, for visitors from the EU/EEA and UK, under the GDPR, you have the right to:
- access a copy of the personal data we hold about you;
- correct data that is inaccurate or incomplete;
- request deletion of your data, where we are not required to keep it for legal or accounting reasons;
- object to or restrict certain uses of your data;
- request a copy of your data in a portable format;
- withdraw consent at any time, where our use of your data is based on consent.
To use any of these rights, email hadimahmud.id@gmail.com with your name and booking reference (if you have one). We will respond within a reasonable time and no later than required by applicable law.
Children’s privacy
This website is not directed at children, and we do not knowingly collect personal data directly from children. Guest counts for children on a booking are provided by the adult making the booking, for pricing and safety-briefing purposes only.
International data transfers
We are based in Indonesia, and our data is primarily processed there. Some service providers we use — including Xendit, PayPal, and our hosting/email infrastructure — may process data outside Indonesia, including in jurisdictions with different data protection standards. Where this happens, we rely on those providers’ own compliance with applicable data protection safeguards.
Data security
We use reasonable technical and organisational measures to protect your data, including restricting who can access booking records and never storing full payment card details on our own systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we work to keep your information protected and will notify affected guests if a breach materially affecting them occurs, as required by law.
Changes to this policy
We may update this policy from time to time — for example if we add a new payment method or change how a feature works. The “Last updated” date at the top of this page always reflects the current version. Continuing to use the site after a change means you accept the updated policy.
Contact us
Questions, requests, or complaints about this policy or your personal data can be sent to: