Privacy Policy

Section 01

Data Controller

The data controller responsible for your personal information is:

Section 02

Information We Collect

We collect personal information you provide directly when you make a booking, submit an enquiry, or use our services — including your name, email address, phone number, nationality, passport or ID details, and payment information.

We also collect the following information automatically when you visit our website:

• IP address and approximate location
• Browser type, device type, and operating system
• Pages visited, time spent on site, and referring website
• Cookies and similar tracking technologies (see Section 07)

We may also receive information about you from third parties, including online travel agencies (such as Booking.com or Agoda), our direct booking platform, payment processors, and review platforms such as TripAdvisor or Google.

Section 03

How We Use Your Information

We use your personal information for the following purposes:

• To process and manage reservations, check-ins, and payments
• To communicate with you about your booking, stay, or enquiry
• To provide personalised guest services and experiences
• To send promotional offers and newsletters (with your consent)
• To process spa bookings, activity arrangements, and event planning
• To comply with Indonesian legal and regulatory requirements, including immigration reporting for foreign guests
• To improve our website and services through analytics
• To detect and prevent fraud or security incidents
• To respond to reviews, complaints, or legal claims

Section 04

Legal Basis for Processing

We process your personal data on the following legal grounds under Indonesian data protection law (UU PDP No. 27 Tahun 2022) and applicable international standards:

• Contractual necessity — to fulfil your reservation or service agreement
• Legal obligation — to comply with immigration, tax, and hospitality regulations
• Legitimate interests — to operate our resort safely, prevent fraud, and improve services
• Consent — for marketing communications and non-essential cookies, which you may withdraw at any time

Section 05

Sharing Your Information

We do not sell your personal data. We may share it only in the following circumstances:

• Service providers — trusted third parties who assist in operating our resort and website, including payment processors, booking engine providers, and IT service providers. These parties are contractually bound to protect your data
• Government & regulatory authorities — we are required by Indonesian law to report guest information to immigration and local authorities, applicable to all foreign nationals
• Business partners — excursion operators, spa suppliers, or event vendors, only to the extent necessary to fulfil your requested service
• Legal requirements — if required to disclose data by court order or legal process, or to protect the rights and safety of our guests and staff

Section 06

Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this Policy, or as required by Indonesian law.

• Guest reservation records are retained for a minimum of 5 years for tax and legal compliance
• Marketing preferences and email records are retained until you withdraw consent
• Website analytics data is retained for up to 26 months
• Payment records are retained in accordance with applicable banking regulations

Section 07

Cookies & Tracking Technologies

Our website uses cookies and similar technologies to enhance your browsing experience and analyse website traffic. We use:

• Essential cookies — required for the website to function correctly and cannot be disabled
• Analytics cookies — to understand how visitors use our site (e.g. Google Analytics)
• Marketing cookies — to deliver relevant content, only placed with your prior consent

You can control cookie preferences through your browser settings at any time. Disabling certain cookies may affect the functionality of our website.

Section 08

Data Security

We take the security of your personal information seriously and implement appropriate technical and organisational measures to protect your data against unauthorised access, disclosure, alteration, or destruction.

• SSL/TLS encryption for all data transmitted via our website
• Secure payment processing through PCI-DSS compliant providers
• Access controls limiting data access to authorised staff only
• Regular review and updating of our data security practices

Section 09

Your Rights

Subject to applicable law, you have the following rights in relation to your personal data:

• Access — request a copy of the personal data we hold about you
• Correction — request that inaccurate or incomplete data be corrected
• Deletion — request erasure of your personal data, subject to legal obligations
• Objection — object to processing for direct marketing or legitimate interest purposes
• Withdrawal of consent — withdraw any previously given consent at any time
• Data portability — receive your data in a structured, machine-readable format

To exercise any of these rights, please contact us at info@belairresort-giliair.com. We will respond within 30 days.

Section 10

Children's Privacy

Our website and services are not directed to children under the age of 18. We do not knowingly collect personal data from minors without verifiable parental consent. If you believe we have inadvertently collected such data, please contact us immediately and we will take prompt steps to remove it.

Section 11

International Data Transfers

Bel Air Resort & Spa is located in Indonesia and your data is primarily stored and processed within Indonesia. Where we use cloud-based service providers that may process data internationally, we ensure appropriate safeguards are in place, including standard contractual protections equivalent to those required under Indonesian law.

Section 12

Third-Party Websites

Our website may contain links to third-party websites such as booking platforms, activity providers, or social media channels. We are not responsible for the privacy practices of those sites and encourage you to review their own privacy policies before providing any personal information.

Section 13

Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the Republic of Indonesia, including UU PDP No. 27 Tahun 2022. Any disputes arising from this Policy shall be subject to the exclusive jurisdiction of the courts of Lombok, West Nusa Tenggara, Indonesia.

In the event of a concern or complaint, we encourage you to contact us directly so that we may resolve the matter promptly and amicably.

Section 14

Amendments to This Policy

Bel Air Resort & Spa reserves the right to update or amend this Privacy Policy at any time. Changes will be effective immediately upon publication on this website. When we make material changes, we will update the "Last Updated" date at the top of this page.

We recommend checking this page periodically to stay informed of any updates. Your continued use of our website or services following any changes constitutes your acceptance of the updated Policy.

Section 15

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please do not hesitate to get in touch: