Privacy Policy
Who We Are
The data controller responsible for your personal data is:
- Business Name: Mustika Dolphin Lovina Bali
- Guide Name: Mr. Nyoman
- Address: Jl. Laviana No. 1, Kalibukbuk, Lovina Beach, Buleleng, Bali 81152, Indonesia
- Website: mustikalovinadolphintours.com
- Email: marlinpish@yahoo.com
- WhatsApp: +62 823 3994 9871
As data controller, we determine the purposes and means of processing your personal data. If you have any questions about this policy or our data practices, please contact us using the details above.
Personal Data We Collect
We collect the following categories of personal data:
| Category | Data Points | When Collected |
|---|---|---|
| Identity Data | Full name, nationality | Booking / contact form |
| Contact Data | Email address, phone/WhatsApp number | Booking / inquiry |
| Booking Data | Tour date, number of participants, special requests, service type | Reservation process |
| Communication Data | Messages, inquiry content, feedback | Contact form, WhatsApp, email |
| Technical Data | IP address, browser type, device type, pages visited, time on site | Automatically via cookies |
| Usage Data | Referral source, search terms, click behaviour | Analytics tools (e.g. Google Analytics) |
| Marketing Data | Communication preferences, consent records | Opt-in forms / cookie consent |
We do not collect sensitive personal data (special categories under GDPR Article 9), such as health information, racial or ethnic origin, or financial card details. Payment transactions, if applicable, are handled by secure third-party processors.
How We Collect Your Data
We collect personal data through the following means:
- Directly from you — when you fill in a contact or booking form on our website, send us an email, or message us via WhatsApp.
- Automatically — when you browse our website, we automatically collect technical and usage data via cookies and analytics scripts.
- Third-party platforms — when you contact us or book via TripAdvisor, Booking.com, Agoda, Klook, Viator, or Google, those platforms may share relevant booking data with us under their own privacy policies.
- Social media — if you interact with us on Instagram, Facebook, or YouTube, we may receive your public profile information as permitted by those platforms.
Legal Basis for Processing (GDPR)
Under the GDPR, we must have a valid legal basis for each type of data processing. We rely on the following legal bases:
| Legal Basis | GDPR Article | When We Use It |
|---|---|---|
| Contract Performance | Art. 6(1)(b) | Processing booking data to fulfil your reservation and deliver our services |
| Legitimate Interests | Art. 6(1)(f) | Website analytics, fraud prevention, improving our services, responding to inquiries |
| Consent | Art. 6(1)(a) | Non-essential cookies, marketing emails, newsletter subscriptions |
| Legal Obligation | Art. 6(1)(c) | Retaining booking records for tax, accounting, or regulatory compliance |
Where we rely on consent, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
Purpose of Processing Your Data
We use your personal data for the following purposes:
- To process and confirm your tour bookings and reservations
- To respond to your inquiries, questions, and support requests
- To send booking confirmations, reminders, and important updates
- To improve our website content, user experience, and services
- To send marketing communications where you have given consent
- To analyse website traffic and usage patterns (aggregate, anonymised where possible)
- To comply with legal and regulatory obligations
- To prevent fraud and ensure the security of our systems
We will not use your personal data for purposes incompatible with those listed above without first informing you and, where required, obtaining your consent.
Data Sharing & Third Parties
We do not sell your personal data. We may share your data with carefully selected third parties only where necessary:
| Third Party | Purpose | Data Shared |
|---|---|---|
| Google Analytics | Website usage analytics | Anonymised usage / technical data |
| Google Maps | Location display on website | IP address (handled by Google) |
| WhatsApp (Meta) | Customer communication | Message content, phone number |
| Booking platforms (TripAdvisor, Agoda, Klook, etc.) | Reservation processing | Name, contact info, booking details |
| Email service provider | Transactional & marketing emails | Email address, name |
| WordPress / Hosting provider | Website infrastructure | Form submissions |
| Xorro Apps by Xorro | Development Services | Technical data |
All third parties are required to process your data lawfully, fairly, and in a manner consistent with this Privacy Policy and applicable data protection law. We have data processing agreements in place with processors where required under GDPR Article 28.
Cookies & Tracking Technologies
Our website uses cookies and similar technologies. A cookie is a small text file placed on your device to help our website function and to provide analytics data.
| Cookie Type | Purpose | Consent Required? |
|---|---|---|
| Strictly Necessary | Session management, security, basic website functionality | No (essential) |
| Analytics | Google Analytics — understanding how visitors use our site | Yes |
| Marketing / Retargeting | Google Ads, Facebook Pixel — serving relevant advertisements | Yes |
| Preferences | Remembering your language or region preferences | Yes |
When you first visit our website, you will be presented with a cookie consent banner. You can accept all cookies, reject non-essential cookies, or manage your preferences individually. You may also change your cookie settings at any time via your browser settings or our cookie preference centre.
For more information about cookies and how to control them, visit allaboutcookies.org.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, or reporting requirements.
| Data Type | Retention Period | Reason |
|---|---|---|
| Booking & reservation records | 5 years from booking date | Legal / tax compliance |
| Customer communications | 2 years from last contact | Customer service, dispute resolution |
| Marketing preferences / consent | Until withdrawn + 1 year | Consent record-keeping |
| Website analytics data | 26 months (Google Analytics default) | Aggregate usage analysis |
| Cookie consent records | 12 months | Audit trail |
Once the applicable retention period expires, we will securely delete or anonymise your personal data so it can no longer be associated with you.
Your Rights Under GDPR
If you are located in the European Economic Area (EEA), United Kingdom, or another jurisdiction with equivalent data protection laws, you have the following rights:
Request a copy of the personal data we hold about you (Art. 15).
Request correction of inaccurate or incomplete data (Art. 16).
Request deletion of your data ("right to be forgotten") where applicable (Art. 17).
Request that we limit how we process your data in certain circumstances (Art. 18).
Receive your data in a structured, machine-readable format (Art. 20).
Object to processing based on legitimate interests or for direct marketing (Art. 21).
Withdraw consent at any time where processing is based on consent (Art. 7).
Lodge a complaint with your supervisory authority if we have violated your rights.
To exercise any of these rights, please contact us at marlinpish@yahoo.com. We will respond within 30 days (extendable to 90 days for complex requests). We may need to verify your identity before processing your request.
We will not charge a fee for exercising your rights, unless the request is clearly unfounded, repetitive, or excessive.
Security of Your Data
We implement appropriate technical and organisational security measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These measures include:
- SSL/TLS encryption for all data transmitted via our website (HTTPS)
- Access controls limiting who within our organisation can view personal data
- Regular security updates and patches for our website and systems
- Secure hosting with reputable, GDPR-aware infrastructure providers
- Password protection and authentication policies for internal systems
While we take all reasonable steps to secure your data, no method of transmission over the internet is 100% secure. In the unlikely event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours, and will inform you directly where required by law.
International Data Transfers
Our business is based in Bali, Indonesia. Some of our third-party service providers (such as Google and Meta/WhatsApp) are located in the United States or other countries outside the EEA. When your data is transferred internationally, we ensure appropriate safeguards are in place, such as:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adequacy decisions where the receiving country provides equivalent protection
- Binding Corporate Rules (BCRs) where applicable
By using our website and services, you acknowledge that your data may be transferred to and processed in countries outside your country of residence. We will always ensure such transfers are conducted with appropriate legal safeguards in place.
Contact Us & How to Complain
If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how we handle your data, please contact us:
Contact Information
If you are located in the EEA and believe we have not handled your data in accordance with GDPR, you have the right to lodge a complaint with your local supervisory authority. In the EU, a full list of supervisory authorities is available at edpb.europa.eu. In the UK, contact the Information Commissioner's Office (ICO) at ico.org.uk.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify you by email or via a notice on our website.
We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your data. Your continued use of our website after any changes constitutes your acceptance of the updated policy.
