Privacy Policy

What we collect

When you book: your name, email address, phone number, country of residence, arrival time, the dates and villa you selected, any requests you tell us about, and the extras you add.

When you pay: your card is entered directly into Stripe. We never see or store your full card number — only the last four digits, the card brand, and Stripe’s reference for the transaction.

When you browse: pages viewed, the dates and villa you searched, approximate location from your IP address, device and browser type. Only if you have accepted analytics cookies.

When you contact us: the content of your WhatsApp messages and emails.

Why we use it, and on what basis

To take and honour your booking — necessary to perform our contract with you.

To take payment and prevent fraud — contract, and our legitimate interest in not being defrauded.

To send you booking confirmations, arrival details and pre-stay messages — contract.

To send occasional offers if you asked for the members rate — your consent, withdrawable at any time from any email we send.

To understand how the site is used and improve it — your consent through the cookie banner.

To meet Indonesian guest-registration and tax obligations — legal obligation.

Who else sees it

Cloudbeds — our property management system, which holds the reservation.

Stripe — payment processing. Stripe is the controller of your card data; see stripe.com/privacy.

Google — analytics and maps, only with your consent.

Our villa team in Ubud, so your room is ready and your requests are met.

Authorities, where Indonesian law requires guest registration.

We do not sell your data. We never have and we will not.

Where your data goes

We are based in Indonesia and hold your data here. Some of our suppliers do not: Cloudbeds and Google operate from the United States, and payments are processed outside Indonesia. Your information therefore crosses borders.

Article 56 of Law 27/2022 permits those transfers where the destination has an adequate level of protection, or where we have put appropriate safeguards in place. We rely on the data-processing agreements we hold with each supplier. Where data moves out of the EEA or the UK we additionally rely on the European Commission's standard contractual clauses.

If you are in the EEA or the UK, the GDPR applies to us as well, because we offer accommodation to guests there. You can exercise your GDPR rights by writing to the contact address below and we will answer within one month.

How long we keep it

Reservation and payment records: seven years, to satisfy tax and accounting requirements.

Marketing consent and email address: until you withdraw it, then a suppression record so we do not email you again by mistake.

Analytics: fourteen months.

WhatsApp conversations: two years.

Your rights

You can ask us for a copy of your data, correct it, delete it, restrict or object to how we use it, or receive it in a portable format. You can withdraw consent at any time. Email us and we will respond within 30 days.

Write to reservations@sanctuaryvillas.co or message us on WhatsApp at +62 878 1727 4325. Under Law 27/2022 we must answer within 3 × 24 hours; we aim to answer the same day.

If you are not satisfied, you can complain to the Indonesian personal data protection supervisory authority established under Law 27/2022. If you are in the EEA or the UK you can also complain to your own national data protection authority.

Contact

Data requests and privacy questions: Reservations, reservations@sanctuaryvillas.co.

Or write to PT Conscious Design Bali, Jalan Bisma, Ubud, Kecamatan Ubud, Kabupaten Gianyar, Bali 80571, Indonesia.