Privacy Policy

01Who is responsible for your data

For the purposes of UU PDP, Luxe Estates Bali is the Data Controller (Pengendali Data Pribadi) for personal data processed through this website and our associated enquiry, booking, chat and messaging channels. We are based and operate in Bali, Indonesia.

You can reach us about any privacy matter at hello@luxeestatesbali.com. We are a small, owner-operated team, so any personal data request is handled directly by the person who owns this policy — see Contact us.

02Data we collect

We collect personal data in the following situations:

We do not intentionally collect Specific Personal Data (health, biometric, genetic, criminal, financial account, or children's data as defined by UU PDP) through this website. Please do not send us such data unless we specifically ask for it.

03How we use your data

• Responding to enquiries — answering your questions about villas, land, and investment opportunities.
• Quotes and bookings — calculating availability and pricing, and handing off to Hospitable's booking flow to complete a reservation.
• Customer support — communicating with you before, during and after a stay or transaction, across whichever channel you used to contact us.
• Operating and securing the website — keeping the site online, diagnosing problems, and preventing abuse or fraud.
• Marketing — with your consent, sharing new listings or offers by email, WhatsApp or social channels; you can opt out at any time.
• Legal compliance — meeting tax, accounting and regulatory obligations under Indonesian law.

We do not sell your personal data to third parties.

04Legal basis for processing

Under Article 20 of UU PDP, we process personal data on one or more of the following bases:

• Your explicit consent — for example, when you opt in to marketing messages or accept optional cookies.
• Performance of a contract — to respond to your enquiry, prepare a quote, or facilitate a booking you requested.
• Legitimate interest — to keep the website secure, understand aggregate usage, and improve our listings, balanced against your rights and interests.
• Legal obligation — to comply with Indonesian tax, financial and record-keeping requirements, or lawful requests from public authorities.

05Who we share data with

We share personal data only with parties that help us run the business, and only to the extent needed:

• Hospitable, Inc. — our property management and booking platform. Quote requests, booking details and, where a reservation is completed, guest and payment information are processed by Hospitable under its own privacy policy.
• Cloudflare, Inc. — content delivery and security in front of our servers; it sees connection-level metadata (such as your IP address) needed to route and protect traffic.
• Meta Platforms, Inc. and Telegram — if you contact us via WhatsApp, Instagram, Facebook or our Telegram Mini App, that platform processes your data as well, under its own privacy terms.
• Our support inbox (Chatwoot) — self-hosted on our own infrastructure, used to keep one conversation history with you across channels. Once you have a confirmed reservation, it also holds your stay dates, villa and booking status, so we can message you useful updates about that stay (for example, a check-in reminder) and so you can message our villa manager back. You can opt out of these stay-related messages at any time by replying to say so.
• Professional advisers and authorities — legal, tax or notary advisers assisting a transaction, or public authorities where disclosure is required by Indonesian law.

We do not use a payment processor of our own — bookings and payments are completed entirely on Hospitable's platform.

06Cross-border transfers

Some of the parties above (including Hospitable, Meta and Telegram) operate outside Indonesia. Where we transfer personal data abroad, Article 56 of UU PDP requires us to ensure the receiving country offers an equivalent or higher level of data protection, or to put in place adequate and binding safeguards (such as contractual commitments), or to rely on your explicit consent to the transfer. We take one or more of these steps before your data leaves Indonesia.

07Cookies & similar technologies

This website uses a small number of cookies:

• Strictly necessary cookies — required for the site and our security/CDN provider (Cloudflare) to function; these cannot be switched off.
• Analytics and marketing cookies — we use none. We do not run Google Analytics, Meta Pixel, or any other third-party tracking script on this website, and no advertising network receives your browsing here.

Our own visitor counter

We do measure how the website is used, because we would otherwise be redesigning it on guesswork. We do it with a counter we wrote and run ourselves, on our own server in this same website, rather than with a third-party analytics product. It works like this:

• No cookies and no storage on your device. The counter writes nothing to your browser and reads nothing from it — with the single exception of remembering that you switched it off, if you use the button below.
• No identifiers, and no way to recognise you tomorrow. To tell two people apart from one person reading two pages, we calculate a one-way hash from your IP address and browser type, using a secret key that is randomly regenerated every day and never kept. Your IP address itself is never written down, the hash cannot be turned back into it, and once the key rotates the same visitor is a completely new value. It is a way of counting people on one day, and it cannot follow anyone across days, devices or sites.
• What is recorded. The page address (without any query string), roughly how many seconds the page was in front of you and how far down you scrolled, which website or advertising campaign you arrived from, your country as our CDN reports it, and whether you were on a phone, tablet or desktop. Also which of a few actions were taken — opening a villa, using the calendar, receiving a price, or starting an enquiry.
• What is never recorded. Your IP address, your full browser identification, anything you type into a form, the contents of your messages, and any query string in a link you followed.
• Where it stays. On our own server, in the same system that serves this website. It is not shared with anyone, not sold, and not transferred abroad. Detailed records are deleted after 180 days; what remains after that is daily totals with nothing in them that relates to a person.

Because it involves no cookie, no device storage and no personal identifier, this counter does not require your consent under the cookie rules — but we would rather ask than assume, so you can turn it off for good right here. We also automatically honour the Do Not Track and Global Privacy Control settings your browser or an extension may send: if either is on, the counter never runs and there is nothing for you to switch off.

You can also control cookies through your browser settings; blocking non-essential cookies will not affect your ability to browse the site or contact us.

08How long we keep data

We keep personal data only for as long as needed for the purpose it was collected for — for example, enquiry and booking correspondence for the duration of our relationship with you plus a reasonable period afterwards for support and legal purposes, and financial records for as long as Indonesian tax law requires. When data is no longer needed, we delete or anonymise it, in line with Article 16 of UU PDP.

For the stay-related WhatsApp messages described under Who we share data with, your name and phone number are held only for the short window between us learning of your reservation and matching it to a support-inbox contact — after that they are deleted from our reservation system, though your support-inbox conversation itself is retained under our normal support-history practice. Your stay dates, villa and booking status are kept against that contact for 90 days after checkout, then deleted automatically.

09How we protect your data

We apply reasonable technical and organisational measures to protect personal data against loss, misuse and unauthorised access — including encrypted connections (HTTPS) across the site, access controls on our internal systems, and hosting infrastructure that is not directly reachable from the public internet except through our secured edge proxy. No method of transmission or storage is perfectly secure, but we work to keep these protections current.

10Your rights

As a data subject under UU PDP, you have the right to:

• be informed clearly about our identity, the legal basis, and the purpose of processing your data;
• access and obtain a copy of the personal data we hold about you;
• correct or update inaccurate or outdated personal data;
• withdraw consent, where processing is based on consent;
• object to processing carried out on the basis of legitimate interest, and to automated decision-making that produces legal effects concerning you;
• request that we restrict, stop, or delete/destroy your personal data, subject to legal retention obligations;
• receive your data in a structured, commonly used, machine-readable format (data portability), where applicable;
• lodge a complaint and, where the law is breached, seek compensation for damage arising from a violation of UU PDP.

To exercise any of these rights, email hello@luxeestatesbali.com. We may need to verify your identity before acting on a request, and we will respond within a reasonable time in line with applicable regulations.

11Children's data

This website and our booking channels are directed at adults arranging travel or property enquiries. We do not knowingly collect personal data from children without the consent of a parent or legal guardian, as required for children's data under UU PDP. If you believe a child has provided us with personal data, please contact us so we can remove it.

12Data breach notification

If a failure occurs that compromises the protection of your personal data, we will notify you in writing and notify the competent Indonesian personal data protection supervisory authority, in accordance with the timeframe and procedure set out in Article 46 of UU PDP.

13Changes to this Policy

We may update this Policy from time to time as our services or the law change. The "Last updated" date at the top of this page shows when it was last revised. Material changes will be reflected here before they take effect.

14Contact us & complaints

For any question about this Policy or how we handle your personal data, contact us at hello@luxeestatesbali.com.

If you are not satisfied with our response, you have the right to lodge a complaint with Indonesia's personal data protection supervisory authority. Pending the full establishment of the dedicated authority under UU PDP, complaints relating to electronic systems and personal data protection may be submitted to the Ministry of Communication and Digital Affairs of the Republic of Indonesia (Kementerian Komunikasi dan Digital, Kemkomdigi).