Privacy Policy

1. Who is responsible

PT. Tony Properties Bali (brand: HiddenKeys Bali), Jl. Mertanadi No. 86E, Kerobokan Kelod, Kuta Utara, Badung, Bali 80363, Indonesia, is responsible for the processing of your personal data as data controller (Pengendali Data Pribadi) under Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP).

For all privacy questions please contact us at info@hiddenkeys-bali.com or via WhatsApp +6285190920419.

2. Applicable law

We are an Indonesian company and process personal data in accordance with UU PDP. Because many of our guests come from the European Union, this policy also contains the information required by the EU General Data Protection Regulation (GDPR), insofar as the GDPR applies to the processing of data of guests in the EU.

3. Visiting our website

Our website is a static website without user accounts. When you open a page, your browser automatically transmits technical data (IP address, date and time, page requested, browser and operating system). This data is processed by our hosting provider to deliver the website and to keep it secure, and is kept in server logs for a short period only. We plan to host the website with Cloudflare, Inc. (USA).

No cookies, no analytics or tracking tools, no advertising pixels and no local browser storage are used. The fonts are stored on our own server; no connection to Google Fonts is made.

4. Maps

Villa pages show the approximate area of the villa on an interactive map. When the map comes into view, your browser loads map images from the servers of the OpenStreetMap Foundation (United Kingdom, tile.openstreetmap.org); your IP address and browser data are transmitted to them in the process. Links to Google Maps only open Google Maps when you click them; Google's privacy policy then applies.

5. Contacting us

You can contact us by email (info@hiddenkeys-bali.com; villa owners: management@hiddenkeys-bali.com) or WhatsApp (+6285190920419). The WhatsApp buttons on our website open WhatsApp with a prepared message; WhatsApp is operated by Meta and its own privacy policy applies. The inquiry forms on our website (booking requests and the owner form) do not send any data themselves: they only open your email app or WhatsApp with a prepared message, which you then send yourself.

We process the data you send us (e.g. name, email, phone number, travel dates, number of guests, your message) to answer your inquiry.

6. Bookings and your stay

To handle a booking we process your name, contact details, travel dates, number of guests, booking and payment status and your messages. We manage bookings in our property management system Hostify. If you book through Airbnb, Booking.com, Agoda or Vrbo, we receive your booking data from that platform; its own privacy policy applies as well.

Under Indonesian law, accommodation providers must provide data on foreign guests to the immigration authorities on request (Art. 72(2) of Law No. 6 of 2011 on Immigration). For this purpose we record passport or ID details at check-in.

The online booking function on our website is currently in test mode and does not transmit any personal data.

7. Payments

For direct bookings we plan to offer online payment through the payment providers Xendit and PayPal. Card and account details are then entered directly with the payment provider and are not stored by us; we only receive the payment status and a transaction reference. We will update this policy before online payment is activated.

8. Guest services

If you request a service such as an airport transfer, driver, tour, massage or private chef, we pass on the details needed for it (e.g. name, villa, date, time, number of people, WhatsApp number) to the local partner who provides the service.

9. Legal bases

We process your data to perform a contract with you or to take steps at your request before a contract (Art. 20(2)(b) UU PDP; Art. 6(1)(b) GDPR), to comply with legal obligations such as guest registration and tax law (Art. 20(2)(c) UU PDP; Art. 6(1)(c) GDPR), on the basis of our legitimate interests in operating a secure website and answering inquiries (Art. 20(2)(f) UU PDP; Art. 6(1)(f) GDPR) and, where we ask for it, on the basis of your consent (Art. 20(2)(a) UU PDP; Art. 6(1)(a) GDPR), which you can withdraw at any time.

10. Recipients and transfers abroad

We share personal data only where necessary: with our service providers (property management system, email and hosting providers, and in future our payment providers), with the booking platform you booked through, with local service partners for services you request, and with authorities where required by law. We do not sell personal data.

Some of these providers process data outside Indonesia and outside the EU. We transfer data only in line with Art. 56 UU PDP and, where the GDPR applies, on the basis of appropriate safeguards or because the transfer is necessary to perform your booking (Art. 49(1)(b) GDPR).

11. How long we keep data

Inquiries that do not lead to a booking are deleted no later than 12 months after our last contact. Booking and accounting records are kept for 10 years as required by Indonesian tax law. Guest registration data is kept as long as required by law. After that, we delete or anonymise the data.

12. Your rights

Under UU PDP you have the right to information, to access and obtain a copy of your data, to correction, to deletion, to restrict or stop processing, to withdraw your consent, to object to decisions based solely on automated processing and to data portability (Art. 5–13 UU PDP). Where the GDPR applies, you have the corresponding rights under Art. 15–21 GDPR, including the right to object to processing based on legitimate interests, and the right to lodge a complaint with a data protection supervisory authority, in particular in your country of residence.

To exercise your rights, simply write to info@hiddenkeys-bali.com.

13. Security

We protect your data with appropriate technical and organisational measures; our website is delivered via an encrypted connection (HTTPS). If a data breach occurs, we will notify the affected persons and the competent authority in writing within 3 × 24 hours, as required by Art. 46 UU PDP.

14. Changes to this policy

We will update this policy when our website or services change, for example before online payment is activated. The current version is always available on this page.

Last updated: 2 November 2026