Privacy Policy

The BaliKula website is published by: BaliKula Bali, Indonesia Contact: via WhatsApp (button available on the platform) BaliKula is operated as an individual initiative. For any legal correspondence, please contact us via the methods listed in Section 10 of this Privacy Policy.

The website is hosted by: Vercel Inc. 440 N Baxter St, Los Angeles, CA 90004, United States https://vercel.com Data is stored via Supabase (PostgreSQL database and authentication), hosted on cloud infrastructure.

BaliKula processes your personal data in compliance with Indonesia's Personal Data Protection Law (Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi, 'UU PDP'). As a data controller, BaliKula ensures that all data processing is based on valid legal grounds as defined by UU PDP. We collect the following data depending on your type of use: Hosts (registered users): - Full name - Email address - WhatsApp number - Profile photo (optional) - Short biography (optional) Renters (visitors submitting a request): - First and last name - Email address - Phone number (with country code) - Request message (optional)

Your data is collected exclusively for: - Facilitating the connection between Hosts and Renters - Allowing Hosts to manage their listings and bookings - Sending transactional emails (request confirmation, booking notification) - Improving the platform's functionality Your data is never sold to third parties or used for advertising purposes.

Renter contact details (name, email, phone) are shared with the relevant Host ONLY after the Host has confirmed the booking. Before confirmation, the Host can see the request but not the Renter's contact details. No personal data is shared with third parties for commercial purposes.

Data is retained for the following periods: - Host accounts: as long as the account is active, then 12 months after deactivation - Booking requests: 24 months after the booking end date - Connection logs: 12 months After these periods expire, data is securely deleted.

In accordance with UU PDP (Indonesia's Personal Data Protection Law, UU No. 27/2022) and applicable international regulations, you have the following rights regarding your personal data: - Right of access: obtain a copy of your data held by BaliKula - Right of rectification: correct inaccurate or incomplete data - Right of deletion: request erasure of your data - Right of portability: receive your data in a structured, commonly used format - Right to withdraw consent: withdraw your consent to data processing at any time, without affecting the lawfulness of processing carried out prior to withdrawal - Right to object: object to the processing of your personal data on grounds relating to your particular situation - Right to lodge a complaint: file a complaint with the relevant supervisory authority if you believe your data protection rights have been violated To exercise these rights, contact us via WhatsApp (button available on the platform) or by email at the address indicated on the platform. We will respond to your request within thirty (30) calendar days.

BaliKula uses a minimal number of cookies: - Language preference cookie (to remember your language choice) - Authentication session cookie (for logged-in Hosts) No advertising tracking cookies, no third-party analytics cookies. We do not use Google Analytics or any third-party tracking tool.

BaliKula uses the following third-party services: - Supabase: database, authentication, and file storage - Vercel: website hosting and delivery - Resend: transactional email delivery These providers have their own privacy policies and comply with industry security standards.

For any questions regarding the protection of your personal data or to exercise your rights, contact us: - Via WhatsApp using the contact button available on the platform - By email at the address indicated on the platform BaliKula Bali, Indonesia

Your personal data may be processed and stored on servers located outside the territory of the Republic of Indonesia, including: - United States: Vercel Inc. (website hosting and content delivery) - Various international locations: Supabase cloud infrastructure (database, authentication, and file storage) - United States: Resend (transactional email delivery) These transfers are conducted in compliance with the requirements of UU PDP (UU No. 27/2022) for cross-border data transfers. BaliKula ensures that adequate protection standards are maintained by selecting service providers that implement appropriate technical and organizational security measures, including encryption in transit and at rest. By using BaliKula, you consent to the transfer of your personal data to these jurisdictions for the purposes described in this Privacy Policy.

In the event of a personal data breach that may affect your rights and freedoms, BaliKula commits to: - Notifying affected users without undue delay, and in any event within seventy-two (72) hours of becoming aware of the breach, as required by UU PDP - Notifying the relevant supervisory authority within the timeframe prescribed by UU PDP - Providing a description of the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences of the breach, and the measures taken or proposed to address the breach BaliKula maintains appropriate technical and organizational measures to detect, investigate, and respond to personal data breaches in a timely manner.

We process your personal data on the following legal bases as defined by UU PDP (UU No. 27/2022): (a) Your explicit consent: When you submit a booking request as a Renter or create an account as a Host, you provide explicit consent for the processing of your personal data for the purposes described in this Privacy Policy. (b) Performance of a contract: Processing necessary for the performance of a contract to which you are a party, including facilitating booking requests, managing listings, and enabling communication between Hosts and Renters. (c) Legitimate interests: Processing necessary for the legitimate interests of BaliKula in operating, maintaining, and improving the platform, provided that such interests do not override your fundamental rights and freedoms as a data subject. (d) Legal obligation: Processing necessary for compliance with a legal obligation to which BaliKula is subject under Indonesian law. You may withdraw your consent at any time by contacting us via the methods described in Section 10. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.