Legal

Privacy and Cookie Policy

Last updated: 4 August 2026

1. Introduction

This Privacy and Cookie Policy ("Policy") is issued by PT SURFSIDE DEVELOPMENT GROUP ("Surfside," "the Company," "we," "us," or "our"), the operator of the hospitality project and website known as Surfside Bali (https://surfsidebali.com/) (the "Website"). This Policy is issued in accordance with Law No. 27 of 2022 on Personal Data Protection of the Republic of Indonesia ("PDP Law") and other applicable Indonesian laws and regulations governing personal data and electronic systems.

This Policy explains how we collect, use, store, disclose, and otherwise process the personal data of individuals who visit our Website, make enquiries, request bookings, stay as guests, subscribe to our communications, or otherwise interact with us. Sections 12 to 15 together form the Cookie Policy applicable to the Website.

Using the Website or providing us with your personal data does not by itself mean that you consent to every purpose or type of processing described in this Policy. Where the law requires your specific consent — for example, for optional cookies or marketing communications — we ask for that consent separately, as described in the relevant sections below.

2. Identity of the Data Controller

The data controller responsible for the personal data described in this Policy is:

PT SURFSIDE DEVELOPMENT GROUP

Registered address: Jalan Sunset Road No. 819, Ruko Sunset Indah II No. 10, Desa/Kel. Kuta, Kec. Kuta, Kab. Badung, Bali, Indonesia

Project / hotel address: Kuta Selatan, Pecatu, Jl. Pantai Padang-Padang, Bali, Indonesia

Website: https://surfsidebali.com/

Email: sys@surfsidebali.com

Payments for bookings made through the Website are processed by Xendit, our third-party payment gateway provider.

3. Scope of the Policy

This Policy applies to:

visitors browsing the Website;
individuals making enquiries or contacting us through contact forms, email, telephone, WhatsApp, Telegram, or other communication channels;
prospective and confirmed guests who submit or complete a booking, whether directly through the Website or via a booking platform or travel agent that shares data with us;
subscribers to our newsletters or other marketing communications;
company representatives or other individuals who book accommodation on behalf of other guests; and
other individuals whose personal data we receive in connection with the operation of Surfside Bali.

This Policy does not apply to the personal data of our own employees or job applicants, which is addressed under separate arrangements, nor to information that has been anonymized such that it can no longer identify an individual.

4. Definitions

Personal Data: any data about an identified or identifiable individual, whether directly or indirectly identifiable.
Data Subject: the individual to whom personal data relates.
Processing: any operation performed on personal data, including collection, recording, storage, alteration, retrieval, use, disclosure, transfer, or deletion.
Data Controller: the party that determines the purposes and means of processing personal data — in this case, PT SURFSIDE DEVELOPMENT GROUP.
Data Processor: a party that processes personal data on behalf of the Data Controller.
Consent: a voluntary, specific, informed, and unambiguous indication of the Data Subject's agreement to processing.
Cookie: a small text file placed on a device when visiting a website, described further in Section 12.
Third Party: any person or entity other than the Data Subject and the Company.

5. Categories of Personal Data Collected

Depending on how you interact with us, we may collect the following categories of personal data:

identification data: full name, date of birth, nationality, and country of residence;
identity or travel document details, where applicable to a booking or check-in (for example, passport or identification information), where this is required under applicable hospitality reporting practice;
contact data: email address, phone number, and communication preferences;
booking data: booking and stay dates, number and composition of guests, selected room or unit category, and special requests;
payment-related data: billing details and transaction information necessary to process a booking; full payment card credentials are processed directly by our third-party payment providers or booking platforms and are not stored by us in full, as described in Section 17;
communication data: the content and history of your enquiries and correspondence with us;
marketing preference data: your subscription status and stated communication preferences;
technical and usage data: IP address, browser and device information, approximate location derived from your IP address, referral source, and Website usage data;
cookie identifiers and related tracking data collected through tools such as Google Analytics, Yandex Metrica, Meta Pixel, Exely, Google Ads, and anonymous A/B testing tools, as described in Sections 12 to 15;
marketing attribution data, such as UTM parameters and advertising campaign or creative identifiers, where you arrive at the Website through a marketing link or advertisement; and
data received from booking platforms, travel agents, or other partners in connection with a reservation made through them.

We do not intentionally collect special categories of personal data (such as health, religious, or biometric data), except where you voluntarily disclose such information in a special request (for example, a dietary or accessibility request), in which case we process it only to fulfill that specific request.

6. Sources of Personal Data

We may collect personal data:

directly from you, when you use the Website, submit a form, make a booking, or contact us;
automatically, through cookies and similar technologies when you browse the Website;
from booking platforms (such as Booking.com or Airbnb), travel agents, or other intermediaries, in relation to reservations made through them;
from a company representative or third party who makes a booking on your behalf; and
from publicly available sources, where relevant and permitted by law.

7. Purposes of Processing

We process personal data to:

respond to enquiries and provide customer support;
process, confirm, and manage reservations and guest stays;
perform our obligations under a booking or accommodation contract;
issue invoices and manage payments;
communicate with you about your stay, including administrative and service-related messages;
send marketing communications, where you have opted in or another valid legal basis applies;
maintain and improve the security, functioning, and performance of the Website;
analyze Website usage and the effectiveness of our marketing;
comply with legal, tax, and regulatory obligations, including applicable hospitality-sector reporting requirements; and
protect our legal rights and prevent fraud or misuse of the Website.

8. Legal Bases for Processing

We rely on one or more of the following legal bases, consistent with the PDP Law:

your explicit consent;
performance of a contract to which you are a party (for example, a booking), or steps taken at your request before entering into one;
compliance with a legal obligation applicable to us;
our legitimate interests, provided these do not override your rights and freedoms as a data subject (for example, maintaining Website security or preventing fraud); and
protection of vital interests, in exceptional circumstances.

9. Booking and Guest Data

When you make a booking — directly or through a booking platform or travel agent — we process the personal data necessary to confirm, manage, and deliver your stay, including your identification data, contact details, stay dates, room category, special requests, and payment-related information. Where required under applicable hospitality regulations, we may also record identity or travel document details at check-in. If you make or manage a booking on behalf of other guests, you confirm that you are authorized to share their personal data with us for this purpose and that you have made them aware of this Policy.

10. Communications and Customer Support

When you contact us by email, telephone, WhatsApp, Telegram, or through a Website form, we process your contact details and the content of your communication in order to respond to your enquiry, provide support, and maintain a record of our correspondence for quality and follow-up purposes.

11. Marketing Communications

Where you have subscribed to our newsletter or otherwise opted in, we may send you marketing communications about Surfside Bali by email or other channels you have provided. You may withdraw your consent to marketing communications at any time, free of charge, by using the unsubscribe link included in our messages or by contacting us as described in Section 26. Withdrawing your marketing consent does not affect communications that are necessary to manage an existing booking.

Our Website uses cookies and similar tracking technologies (such as pixels, tags, and local storage) to operate the Website, remember your preferences, understand how visitors use the Website, and, where you consent, support advertising. This section and Sections 13 to 15 together form the Cookie Policy applicable to the Website.

A cookie is a small text file stored on your device by your browser when you visit a website. Cookies may be set by us directly ("first-party cookies") or by third parties whose services we use, such as analytics or advertising providers ("third-party cookies"). Cookies may also be classified by duration: "session cookies," which are deleted when you close your browser, and "persistent cookies," which remain on your device for a set period or until you delete them.

13. Types of Cookies

We use the following categories of cookies:

Category	Purpose	Can be disabled?
Strictly necessary cookies	Enable core Website functions, such as security, language, currency, form state, and the booking service you request.	No — required for the Website to function
Analytics cookies	Google Analytics and Yandex Metrica help us understand Website performance and completed booking steps.	Yes
Advertising cookies	Meta Pixel, Exely, and Google Ads help us measure marketing campaigns and show relevant booking offers. Enabling this category also enables analytics.	Yes
Experience testing cookies	Support anonymous A/B testing to compare page variants and improve Website usability.	Yes

Strictly necessary cookies are used on the basis applicable to the operation, security, and delivery of the Website and its requested functions. The legal basis and consent requirements applicable to each cookie category should be confirmed under applicable Indonesian law. All other categories are optional and subject to your choice, as described in Section 14.

14. Cookie Consent and Cookie Settings

On your first visit to the Website, a cookie banner presents you with three choices: Accept all, Reject optional, and Customize. The "Reject optional" option is displayed with the same visibility and ease of use as "Accept all."

Optional cookies — covering analytics, advertising, and experience testing, as described in Sections 13 and 15 — stay disabled until you choose to enable them. Strictly necessary cookies remain active at all times, as they are required for security, language, currency, form state, and the booking service you request.

If you select Customize, you can switch each optional category (analytics, advertising, experience testing) on or off individually before saving your choices. Enabling the advertising category also enables analytics, as advertising measurement relies on the same underlying data.

You can change or withdraw your consent at any time through the "Cookie settings" link in the Website footer, which reopens your preference choices. You can also manage cookies through your browser settings. Disabling strictly necessary cookies may prevent parts of the Website (such as the booking enquiry form) from functioning correctly. Disabling optional cookies will reduce the relevance of the content and advertising you see and will limit our ability to test and improve the Website, but will not prevent you from using its core features.

15. Analytics and Advertising Technologies

Where you have enabled the relevant cookie category, we use: Google Analytics and Yandex Metrica for analytics, to help us understand Website performance and completed booking steps; Meta Pixel, Exely, and Google Ads for advertising, to measure marketing campaigns and show relevant booking offers; and anonymous A/B testing tools for experience testing, to compare page variants and improve usability. These tools are not activated until you have given the corresponding consent through the cookie banner described in Section 14. Each tool may set its own cookies or similar identifiers, subject to its own privacy policy.

16. Sharing of Personal Data

We do not sell or rent your personal data. We may share your personal data with third parties only in the following circumstances:

with your consent;
with the third-party service providers described in Section 17, acting on our instructions and under appropriate confidentiality and security obligations, including analytics and advertising tools such as Google Analytics, Yandex Metrica, Meta Pixel, Exely, and Google Ads;
with booking platforms and travel agents through which you made a booking, to the extent necessary to fulfill that booking;
to comply with a legal obligation, court order, or lawful request from a competent authority;
to establish, exercise, or defend legal claims; and
in connection with a corporate transaction (such as a merger, acquisition, or restructuring), subject to appropriate safeguards.

17. Third-Party Service Providers

We may engage third-party service providers that process personal data on our behalf, or that receive personal data in connection with your booking or enquiry, including providers of: booking engine and reservation systems (including Exely); property management systems (PMS); customer relationship management (CRM) tools; email and communication platforms; website hosting; analytics tools (including Google Analytics and Yandex Metrica); advertising and experience-testing tools (including Meta Pixel, Exely, and Google Ads); payment processing (including our payment gateway, Xendit); customer support and messaging services (including WhatsApp and Telegram, where used); professional advisers (legal, accounting, tax); government authorities, where legally required; and travel agents or booking platforms through which a reservation was made. Personal data is not shared with these providers beyond what is necessary for the purpose for which each provider is engaged, and, for analytics, advertising, and experience-testing tools, only where you have given the corresponding cookie consent as described in Section 14. We seek to put in place appropriate contractual or confidentiality arrangements with our service providers to protect your personal data.

18. International Data Transfers

Because Surfside Bali may use service providers, booking platforms, or communication tools based outside Indonesia, your personal data may be transferred to, stored, or processed in a country other than Indonesia. Where this occurs, we seek to ensure that:

the recipient country provides a level of personal data protection equivalent to or higher than Indonesia's; or
appropriate safeguards or binding data protection arrangements are in place with the recipient; or
your consent has been obtained for the transfer, where required by applicable law.

Indonesia's requirements for cross-border personal data transfers continue to develop through implementing regulations under the PDP Law, and additional government coordination obligations may apply to certain transfers.

19. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this Policy, taking into account:

booking and guest data, which we generally retain for the duration of your stay and thereafter for a period consistent with our accounting, tax, and legal record-keeping obligations under Indonesian law;
enquiry and communication data that does not result in a booking, which we retain for a limited period to allow for reasonable follow-up, after which it is deleted or anonymized;
marketing consent and preference data, which we retain until you withdraw your consent, plus a short period thereafter to record that withdrawal; and
cookie and analytics data, which is retained for the period indicated by the relevant cookie or analytics provider and described in our cookie settings.

Once personal data is no longer needed for these purposes, we securely delete or anonymize it.

20. Data Security

We implement technical and organizational measures designed to protect personal data against unauthorized access, use, alteration, disclosure, loss, or destruction, including access controls, appropriate encryption, and secure storage and backup practices. No method of transmission or storage is completely secure, and while we work to protect your personal data, we cannot guarantee its absolute security.

21. Rights of Data Subjects

Under the PDP Law, you have the right to:

obtain information about the processing of your personal data;
access your personal data;
correct or update inaccurate or incomplete data;
withdraw consent to processing based on consent;
object to certain processing;
request restriction or suspension of processing;
request erasure of your personal data ("right to be forgotten"), subject to applicable legal retention obligations;
request a copy of your personal data in a structured, commonly used format, where technically feasible; and
file a complaint with the competent Indonesian authority responsible for personal data protection.

As of the date of this Policy, Indonesia's dedicated Personal Data Protection Authority is in the process of being established. You may submit a complaint to the competent Indonesian data protection authority or other authority designated under applicable law.

To exercise any of these rights, please contact us using the details in Section 26. We may need to verify your identity before acting on your request.

22. Withdrawal of Consent

Where we rely on your consent, you may withdraw it at any time by contacting us at the email address in Section 26, by using the unsubscribe link in our marketing messages, or, for cookies, through the cookie settings described in Section 14. Withdrawal affects only processing based on consent. We may continue processing personal data where it is necessary to perform a booking contract, comply with legal obligations, or rely on another lawful basis, even if you withdraw consent for a related purpose such as marketing.

23. Data Relating to Children

Bookings must be made by an adult capable of entering into a binding contract. Where a child is included as a guest, we may process the child's personal data — such as name, age, nationality, identification/passport details, and accommodation information — where necessary to provide accommodation, comply with legal requirements, and manage the booking. Such data must be provided, or its collection authorized, by the child's parent or legal guardian, consistent with the PDP Law's treatment of children's personal data as a specific category requiring such consent.

24. Third-Party Links

The Website may contain links to third-party websites and services, including booking platforms and social media. We are not responsible for the privacy practices or content of such third parties, and we encourage you to review their respective privacy policies before providing them with your personal data.

25. Changes to the Policy

We may update this Policy from time to time to reflect changes in our practices or in applicable law. The updated version will be posted on the Website at https://surfsidebali.com/policy together with its effective date. We encourage you to review this Policy periodically.

26. Contact Information

If you have questions or requests regarding this Policy or the processing of your personal data, please contact us at: