Note: This document has been drafted with reference to Indonesia's Law No. 27 of 2022 on Personal Data Protection (PDP Law), the Electronic Information and Transactions Law (ITE Law) as amended, and Government Regulation No. 71 of 2019 on Electronic System and Transaction Operation, alongside common digital marketplace practice.

Version 1.0 — Last updated: August 04, 2026

This Privacy Policy should be read together with our Terms & Conditions, which govern your use of BaliTrip.id.

1. Introduction & Scope

BaliTrip.id ("BaliTrip.id", "we", "us") operates a platform connecting travelers with independent local tour and activity operators in Bali. This Privacy Policy explains how we collect, use, share, and protect personal data when you access or use our website, create an account, or make a booking.

2. Legal Basis for Processing

We process your personal data on one or more of the following legal bases, consistent with the PDP Law:

• Consent — where you have explicitly agreed, e.g. when creating an account or signing in with Google.
• Performance of a contract — to process your booking and connect you with the relevant operator.
• Legal obligation — where processing is required to comply with Indonesian law.
• Legitimate interest — for purposes such as fraud prevention and service security, to the extent permitted by law and balanced against your rights.

3. Information We Collect

We collect only the data reasonably necessary to operate the platform, including:

• Name, email address, and WhatsApp/phone number;
• Google profile name and photo, if you sign in with Google;
• Booking history and related transaction details;
• IP address, browser type, and device information;
• Cookies and similar session identifiers;
• System and activity logs (e.g. login timestamps, actions taken on the platform);
• Language preference;
• Payment-related information necessary to process a transaction — BaliTrip.id does not store full card numbers when payment is processed via a third-party payment gateway.

4. How We Use Your Information

Your data is used to: process and manage bookings; connect you with the relevant tour operator; send service-related communications (booking confirmations, status updates); verify accounts; maintain platform security and prevent fraud or abuse; conduct analytics to improve our services; and comply with applicable legal obligations.

5. Data Sharing and Disclosure

We share personal data only with parties reasonably necessary to deliver the service, including: the tour operator relevant to your booking; payment service providers; Google (for Google Sign-In); email delivery providers; hosting and cloud infrastructure providers; and other technical service providers supporting platform operations. All such parties are permitted to use your data solely for the purpose for which it was shared. We do not sell your personal data to third parties.

6. International Data Transfers

Some of our service providers (e.g. cloud hosting, Google, email infrastructure) may process data outside Indonesia. Where this occurs, BaliTrip.id will take reasonable steps to ensure such transfers are conducted consistently with applicable Indonesian data protection requirements.

7. Data Retention

We retain personal data for as long as necessary to: provide the services you have requested; comply with applicable legal obligations; resolve disputes; and support legitimate audit purposes. Once data is no longer needed for these purposes, it will be deleted or anonymized.

8. Your Rights

Consistent with the PDP Law, you have the right to: obtain information about the processing of your data; access your personal data; correct or update inaccurate data; request deletion of your data; withdraw consent; request restriction of processing in certain circumstances; and object to processing as permitted by law. Requests may be submitted to info@balitrip.id.

9. Data Security

We apply reasonable technical and organizational measures to protect personal data, including: password hashing (passwords are never stored in plain text); encrypted (HTTPS) connections; access controls; regular backups; monitoring for suspicious activity; and restricted internal access on a need-to-know basis. For security reasons, we do not publicly disclose further technical detail regarding our security architecture.

10. Cookies

We use the following categories of cookies:

• Essential cookies — required for core functionality such as staying signed in and maintaining your cart;
• Session cookies — temporary identifiers that expire when you close your browser or log out;
• Security cookies — used to protect against cross-site request forgery (CSRF) and similar risks.

You may configure your browser to refuse certain cookies; doing so may affect some site functionality.

11. Children's Privacy

Our services are not directed at children under the age of 18. We do not knowingly collect personal data from minors without the consent of a parent or legal guardian. If you believe a minor has provided us data without appropriate consent, please contact us so we can take corrective action.

12. Consent

By creating an account or otherwise using BaliTrip.id, you acknowledge that you have read and understood this Privacy Policy.

13. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be announced on this website. Continued use of BaliTrip.id after changes take effect constitutes acceptance of the updated policy.

14. Contact Us

Questions regarding this Privacy Policy or your personal data may be directed to:
Email: info@balitrip.id
Business address: to be provided upon formal business registration
Customer service WhatsApp: to be provided