Who is responsible

PT KAY FAMILY GROUP BALI, trading as ATV in Bali, of 77R6+RF3, Sanur, Denpasar Selatan, Bali 80228, Indonesia. Questions about your data go to info@familytripsbali.com or WhatsApp +62 877-9285-5999.

What we collect when you book

Only what running the activity needs: the lead guest’s name, email address and phone number, the date and start time you chose, how many of you there are, your answer to the experience or swimming-ability question, your pick-up address if you asked for one, and any note you added. That is the whole list. A booking made on WhatsApp gives us whatever you send in the message, and nothing more.

We do not ask for a passport number, a date of birth, or an address beyond the pick-up point. We never see your card number.

Why we are allowed to hold it

Because you asked us to take you on a tour. The lawful basis is performance of the contract between us — we cannot put you on a machine or a raft without knowing who is coming and how to reach you if the weather turns. The email address is also how your voucher reaches you.

Who else sees it

Our hosting and database — the site runs on Vercel and the database is Neon. They hold the data on our behalf and do nothing else with it.
No payment provider — online payment is not switched on, so we take no card or account details at all. Bookings are paid in person.
No email provider — automatic email is not switched on, so your confirmation is sent by hand on WhatsApp and no third party sees your address.
WhatsApp — booking messages travel through WhatsApp, which is operated by Meta and governed by its own privacy policy. We have no control over how Meta processes message metadata. If you would rather not use WhatsApp, you can book online, by email or by telephone.
The guide on your day — your name, party size and your answer to the experience or swimming question appear on the day’s manifest, because that is the point of collecting them.

We do not sell your details, and we do not share them with anyone not listed above. We do not send marketing email.

Analytics and advertising

None. No analytics or advertising tag loads on this site, so no such cookie is set and nothing about your visit is sent anywhere. The only things stored in your browser are your dark or light theme preference and the tours you have marked with a heart, both of which stay on your device and are never sent to us.

Maps

The contact page and some tour pages embed a Google Map. Loading it involves a request to Google, which may set cookies under its own policy. The map is lazy-loaded, so it is only requested if you scroll to it.

How long we keep it

Bookings are kept for seven years, because Indonesian tax and company law requires us to keep records of what we sold. Payment records are kept for the same period. Sign-in attempts to our own admin are kept for 30 days as a security record. Rate-limiting records are deleted after a day.

A booking that was never paid — a hold that ran out — is kept as an expired record rather than deleted, so that if you come back and ask what happened, we can tell you.

Your rights

Ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Use the email address above and quote your booking reference. We will answer within 30 days.

One limit worth stating plainly: we cannot delete a booking record we are legally required to keep for tax purposes until that period has passed. We can, and will, delete everything not covered by that.

Children

Minimum ages apply to every activity and a booking is always made by an adult. We do not knowingly collect details directly from children.

Changes

If this policy changes, the date at the top changes with it. We do not make changes retroactive.

Privacy policy