Privacy Policy
DRAFT: This template must be reviewed by the villa owner and a qualified legal adviser before the website goes live. Replace every item in [square brackets].
Who we are
This website is operated by [business legal name] ("we", "us"), the operator of Villa Time, a private holiday villa in Bali, Indonesia. Contact: [privacy contact email].
Information we collect
When you make a booking request or contact us, we collect only what we need to respond and to manage your stay:
- Your name, email address and, if you choose to provide it, your phone number and country of residence
- Your travel dates, number of guests and any special requests you share with us
- The content of messages you send through our contact form
When payments are enabled, card payments are handled entirely by our payment provider ([payment provider]). We never receive or store your full card number or security code.
We also process limited technical information (such as your IP address) for security purposes, for example to prevent spam and abuse. We do not use advertising or tracking cookies.
How we use your information
- To respond to your enquiries and booking requests
- To manage and confirm your reservation, including sending booking-related emails
- To meet our legal, tax and accounting obligations
- To protect the website and our guests against fraud and abuse
We do not sell your information, and we do not send you marketing emails unless you have separately agreed to receive them.
Sharing
We share information only with service providers who help us operate the villa and this website (for example our email delivery provider, hosting provider, spam protection provider Cloudflare Turnstile and, when enabled, our payment provider), and only as needed for those purposes. We may disclose information where required by law.
International transfers
Our service providers may process information outside Indonesia. Where this happens we take reasonable steps to ensure your information remains protected.
How long we keep information
- Booking records: for as long as required for legal, tax and accounting purposes ([retention period])
- Booking requests that do not proceed: anonymised after [12] months
- Contact form messages: deleted after [24] months
Your rights
Depending on where you live, you may have the right to access, correct or delete your personal information, or to object to or restrict how we use it. To make a request, contact us at [privacy contact email]. We will respond within the time required by applicable law, including Indonesia's Personal Data Protection Law (Law No. 27 of 2022).
Security
We use encrypted connections (HTTPS), restricted administrator access with strong authentication, and reputable service providers to protect your information. No method of transmission or storage is completely secure, but we take care to protect your data.
Changes
We may update this policy from time to time. The date of the latest version is shown on this page.