This notice explains which personal data our homestay collects when you use this website, why we use it, who helps us process it, how long we keep it and which rights you have. If you have a question or want to use one of your rights, write to support@pasirputihhomestay.com.
What we collect
- Your account: name, email address, phone number (if you give it) and your password, which is stored only in a protected (hashed) form.
- Bookings: stay dates, number of guests, the guest details you enter, prices, the cancellation terms you accepted, payment and refund status, and invoices.
- Payments: online payments are handled by Midtrans; we never see or store your card details. For a bank transfer you may upload proof of payment, which only our staff can open.
- Messages: chat messages and files you send us, emails you send to our addresses, and messages sent with the contact form.
- Newsletter: your email address, a name if one was given, and a record of your consent (when you confirmed, and the device information and IP address of that request where available).
- Notifications: your notification settings and, if you switch on browser notifications, the technical address of your browser's push service.
- Security data: sign-in sessions, IP addresses used to limit abuse (for example too many sign-in attempts), and a log of the actions our staff take in the management system.
Why we use it
- To manage your account, take and confirm your booking, receive your payment, and handle changes, cancellations and refunds (to perform our agreement with you).
- To answer your messages and emails and to send you emails about your booking and account (to perform our agreement and for our legitimate interest in helping you).
- To keep the website and your account secure and to prevent fraud (our legitimate interest and legal obligations).
- To keep accounting records as the law requires (legal obligation).
- To send you our newsletter, only if you asked for it (your consent).
Newsletter
We only send our newsletter to people who asked for it. If you sign up on the website, we first send you an email with a confirmation link; you are on the list only after you click it. If you have an account, you can switch the newsletter on or off under Notification settings in your dashboard. Nobody is subscribed automatically, also not when you make a booking or create an account.
You can unsubscribe at any time with the link at the bottom of every newsletter, with the unsubscribe option of your email app, or in your dashboard. When you unsubscribe, we keep your email address on a short "do not email" list so that we never send you a newsletter again by mistake. A sign-up that is never confirmed is deleted 30 days after its confirmation link expired. Booking and account emails are not newsletters and still reach you.
Who processes data for us
We use these service providers, each only for its task:
- Neon (database hosting, Singapore region) and our server and file-storage providers, to run the website and keep its data;
- Resend, to send and receive email;
- Midtrans, to process online payments;
- Pusher, to deliver chat messages in real time;
- the push service of your browser (for example Google, Apple or Mozilla), only if you switch on browser notifications;
- Google Maps, when a page shows a map (Google then receives your IP address).
Some of these providers process data outside Indonesia. We only share what each one needs, and we do not sell your personal data.
Cookies
We use only the cookies that are needed to keep you signed in and to protect your account. We do not use analytics or advertising cookies.
How long we keep data
We keep personal data only as long as we need it. After that, our system deletes it automatically:
- Bookings, payments, refunds and invoices: until the end of the 10th year after the year of your stay, because Indonesian tax law requires us to keep accounting records that long. After that we remove your name, contact details, requests and payment proof from them; only anonymous figures (dates, room, amounts) remain.
- Bookings that were never paid (for example a checkout that was not completed): one year after the planned check-out date, then your personal details are removed in the same way.
- Your account: until you ask us to delete it. Your bookings, payments and invoices are kept for the periods above.
- Messages and emails: 3 years after the last message in a conversation, then erased with their attachments. When our staff delete a chat message or conversation, or move an email to the trash, it is hidden immediately and erased for good after 180 days.
- Notifications: in-app notifications and our records of emails sent to you, one year. Browser notification subscriptions, 30 days after you turn them off or they stop working.
- Newsletter: while you are subscribed; afterwards only the "do not email" entry described above. Unconfirmed sign-ups: 30 days after the confirmation link expired.
- Sessions and security data: sign-in sessions end when they expire or when you sign out; abuse-limit records are short-lived. The log of actions taken by our staff is kept for 10 years, like our accounting records.
Your rights
Depending on where you live, including under Indonesia's Personal Data Protection Law (Law No. 27 of 2022) and, for guests from the European Union, the General Data Protection Regulation, you can ask us for access to your personal data, for a copy, to correct or complete it, to delete it, or to restrict or object to its use. Where we rely on your consent, such as for the newsletter, you can withdraw it at any time; this does not affect anything we did before. Write to support@pasirputihhomestay.com; we may need to confirm that the request comes from you. If you ask us to delete your data, we delete what we no longer need; records the law requires us to keep, such as invoices, are kept until their period ends. You can also complain to the data protection authority where you live.
Changes
When we change this notice, we publish the new version on this page.