Privacy Policy

Aung Villa is a private villa in Ubud, Bali, operated by Book Ubud. For the purposes of Indonesia's Personal Data Protection Law (UU 27/2022), Book Ubud is the controller of the personal data described in this policy.

You can reach us on WhatsApp at +62 859-3524-3151 for any question about this policy or to exercise your rights. This is also our contact point for personal data protection.

When you contact us on WhatsApp or through the form on this site, we receive the details you choose to send: your name, where you are travelling from, your dates, the number of guests, and any notes.

When you browse the site we may receive technical data such as device type, browser, approximate location at city level, pages viewed, and the referring source, collected through analytics as described in the cookies section below.

When you tap the WhatsApp or call button, or send the booking form, we keep a simple record of that action to link your enquiry to the page it came from and to measure how quickly we reply. It contains the page and button used, a reference code that also appears in your message, the country your connection comes from, the campaign source if any, and the dates and number of guests if you entered them. It does not contain your name, phone number, notes, or IP address. We keep these records for up to 24 months.

This website does not take payments. Bookings are arranged and paid outside the site, using the payment details we send you in writing on WhatsApp.

We only process general personal data. Please do not send us specific or sensitive data (such as health records, identity document numbers, or biometric data) in the form or in your first messages. If you have a need that touches on this, for example an allergy, tell us only what is needed and we will use it only for your stay.

We do not ask for payment card details on this website, and we do not knowingly collect data about children.

To answer your enquiry, confirm availability, send a written quote, manage your stay, and provide support before and during your visit.

To keep records required for accounting and tax purposes.

To improve this website, measure our own communication, and, where you have consented, show our adverts to people who may be interested.

Under Article 20 of UU 27/2022 we process personal data on one of these bases:

Performance of a contract or steps before one: enquiry and booking data, to answer you, quote, and run your stay once a booking is confirmed.

Your explicit consent: when you send us details through WhatsApp or the form, and for optional analytics or advertising cookies where consent is required. You can withdraw consent at any time; withdrawal does not affect processing carried out before that point.

Legal obligation: accounting, tax, and other records Indonesian law requires us to keep.

Legitimate interest: keeping basic records, securing the website, and measuring how the site is used (analytics) in a way that has little impact on your privacy. If you are in the European Economic Area, the United Kingdom, or Switzerland, we ask for your consent before analytics start. Advertising cookies and tags, if we ever enable them, always need your consent.

This site uses two kinds of browser storage. Essential storage keeps your theme and language choice and remembers your consent decision; it is always active. Analytics and advertising cookies are optional.

If you are in the European Economic Area, the United Kingdom, or Switzerland, analytics cookies and tags load only after you accept them in the consent banner. Until then, Google Consent Mode v2 keeps them denied. Elsewhere, anonymised analytics are on by default and no banner is shown. Advertising cookies stay denied everywhere unless you accept them.

What is stored: your theme, language, and consent choice in your browser's local storage (essential, no expiry until you clear it); and, only when analytics are allowed, Google Analytics cookies such as _ga and _ga_*, which last up to 2 years and identify a browser anonymously; and Microsoft Clarity cookies _clck and _clsk, under the same consent rules.

You can change your choice at any time with the "Cookie settings" link in the footer of every page, or by clearing this site's data in your browser.

We use Google Analytics 4 to understand how the site is used. If we later run our own advertising, we may add Google Ads, Meta (Facebook and Instagram), and TikTok tags, and these load only with your consent.

We also use Microsoft Clarity to see how visitors use the pages, through heatmaps and anonymised session recordings. It records clicks, scrolling, and page layout. Text typed into form fields (name, country, notes) and numbers or email addresses are masked and never leave your browser. It follows the same consent rules as analytics: where consent is required it does not load until you accept, and it sets the cookies _clck and _clsk only when allowed.

These providers set their own cookies and process data under their own privacy policies. We do not control their processing. Turning analytics off or withdrawing consent stops future collection but does not delete data they already hold.

We do not sell your personal data, and we do not share it for anyone else's marketing.

We share it only with service providers that help us run the site and our communications, such as our hosting and CDN provider, messaging services, and the analytics and advertising providers named above (Google and Microsoft), and only as needed or with your consent.

We may disclose data where the law requires it, or to protect the rights, safety, and property of our guests and our team.

Some providers above are based outside Indonesia, so analytics and, if enabled, advertising data may be processed in other countries. In line with Article 56 of UU 27/2022 we use providers that apply an adequate level of data protection, or we rely on your consent.

Booking details you send us on WhatsApp stay in our booking records and are not transferred abroad for marketing purposes.

Enquiries that do not lead to a booking are kept for up to 12 months so we can pick up the conversation later.

Booking and payment records are kept as long as needed to manage your stay and, for financial records, up to 10 years as Indonesian tax and company-document rules require, then deleted or anonymised.

Anonymous action records (button taps and the like, without your name or phone number) are kept for up to 24 months. Analytics data is kept no longer than 14 months in our Google Analytics settings.

Consent records are kept for as long as the banner choice applies, plus a short period to show we honoured it.

The site is served over HTTPS, uses a CDN with DDoS protection and a firewall, and applies security headers in the browser.

Access to booking records is limited to the people who need it. We keep systems updated and review what we collect so we hold as little as possible.

Under UU 27/2022 you have the right to: know who is processing your data, on what basis, and for what purpose; access your data and get a copy; complete, update, or correct it; end processing, delete, or destroy it; withdraw consent; object to decisions made only by automated processing, including profiling, that affect you; delay or restrict processing; receive your data in a portable format; and seek redress, including compensation, for a breach of this policy.

We do not make decisions about you by automated means alone, and we do not build individual profiles of our guests.

To make a request, message us on WhatsApp at +62 859-3524-3151. We will confirm your identity, acknowledge your request within 3 x 24 hours, and complete it within 30 days, unless the law requires or allows us to keep certain data.

If you believe we have handled your data improperly, please contact us first so we can put it right. If you are not satisfied, you may lodge a complaint with the Indonesian personal data protection authority (the institution designated under UU 27/2022; until it operates fully, the Ministry of Communication and Digital Affairs, Komdigi).

If a personal data breach affects you, we will notify you and the relevant authority within 3 x 24 hours, as the law requires.

This website is intended for adults making travel enquiries. We do not knowingly collect personal data from children. A parent or guardian should make and manage any booking that includes children.

This site links to third-party services such as Google Maps and partner platforms. Their privacy practices are their own, and this policy does not cover them.

This policy is governed by the laws of the Republic of Indonesia, including UU 27/2022 on Personal Data Protection and the Electronic Information and Transactions Law (UU ITE).

This policy is published in Indonesian and English. If the two differ, the Indonesian version prevails.

We may update this policy as the site or the law changes. The date at the top shows the latest version, and material changes will be highlighted on the site.