Privacy Policy

The controller of your personal data is Belitung Mampau Tour, Jl. Pantai Tanjung Kelayang No.Desa, Keciput, Sijuk, Kabupaten Belitung, Kepulauan Bangka Belitung 33414 (Near Dermaga Kelayang Resto). For privacy questions or requests, contact us on WhatsApp at +62 819-2967-8612 or by email at aja296685@gmail.com.

Data you give us directly when you ask a question or book through WhatsApp or email:

• Identity and contact details: name, phone or WhatsApp number, email, and home city or country.
• Trip details: dates, number and ages of guests, chosen package, pickup location, and special requests.
• Payment data: transfer receipts showing the sender's name, bank, and amount. We never ask for or store card numbers, PINs, or banking passwords.
• Health data (specific personal data): only if you volunteer it for safety, such as food allergies, pregnancy, or medical conditions. We use it only to prepare your trip safely.

Data collected automatically when you visit the website:

• Visit statistics from Vercel Web Analytics, only if you consent: pages viewed, referring site, approximate country, and device, browser, and operating system type. This service uses no cookies and does not track you across sites.
• Server logs kept by our hosting provider (Vercel) for security and abuse prevention, such as IP address and user agent.
• Local storage in your browser for your consent, language, and pop-up choices. See the Cookie Policy for details.

We do not use your data for automated decisions or profiling with legal effects on you, and we do not send marketing without your consent.

We do not sell your personal data and do not share it for cross-context behavioral advertising. We share data only as needed with:

• Service partners needed for your trip, such as hotels, resorts, boat operators, drivers, and guides, limited to names, group size, schedule, and special needs.
• Technology providers that process data on our behalf: Vercel Inc. (website hosting and analytics), Meta Platforms (WhatsApp), and Google LLC (email).
• Government or law enforcement authorities where the law requires it.

Some of our providers are outside Indonesia, mainly in the United States. We use only providers that apply adequate and binding safeguards, such as Standard Contractual Clauses, in line with Article 56 of the PDP Law and Chapter V of the GDPR.

• Inquiries that do not lead to a booking: up to 12 months after the last contact.
• Booking and payment records: up to 10 years to meet company-records and tax obligations.
• Health data: deleted no later than 30 days after your trip ends.
• Analytics data: only in aggregated form that does not identify you.

We protect your data with reasonable technical and organizational measures, such as HTTPS connections, access limited to staff who need it, and accounts secured with two-step verification. If a personal data breach occurs, we will notify you and the relevant authority within 3 x 24 hours under Article 46 of the PDP Law, and within 72 hours under the GDPR.

Depending on the law that applies to you, you have the right to:

• Be informed about how your data is processed, and access and get a copy of it.
• Correct or complete inaccurate data.
• Ask us to delete or destroy your data.
• Withdraw consent at any time, without affecting earlier processing.
• Restrict or suspend processing, and object to processing based on legitimate interests.
• Receive your data in a common, machine-readable format (data portability).
• Opt out of the sale or sharing of data and limit the use of sensitive data (CCPA). We do neither.
• Sue for and receive compensation for unlawful processing of your personal data (PDP Law).
• Not be treated differently for using your privacy rights.

Send requests by WhatsApp to +62 819-2967-8612 or by email to aja296685@gmail.com. We may ask for information to verify your identity before acting. You may also appoint an authorized agent to make a request for you. We act on requests within 3 x 24 hours where the PDP Law requires it, and in any case within one month (GDPR) or 45 days (CCPA).

Our website and services are not aimed at unaccompanied children. We process children's data, such as a guest's name and age, only with the consent of the parent or guardian making the booking, in line with Article 25 of the PDP Law.

In the last 12 months we collected the following categories of personal information for the purposes in section 3: identifiers (name, phone number, email, IP address), customer records, commercial information (booking history), internet activity (aggregated visit statistics), approximate geolocation (country level), and sensitive personal information in the form of health data you chose to provide. We do not sell or share personal information, including that of children under 16, and we honor Global Privacy Control (GPC) signals as an opt-out request.

If you believe your privacy rights have been infringed, please contact us first so we can put it right. You may also complain to Indonesia's personal data protection authority (currently through the Ministry of Communication and Digital Affairs), the data protection authority in the EU or UK country where you live, or the California Privacy Protection Agency.

We may update this Privacy Policy. We will show important changes on this website and, where the law requires, ask for your consent again.