Kanha phinisi privacy policy

The controller is PT Komodo Explorer Indonesia, NIB 1805260128363, Jl. Trans Flores 35, Desa Gorontalo, Labuan Bajo, NTT 86763. Two laws apply: Indonesia's Personal Data Protection Law (UU No. 27 of 2022) and, for visitors in the European Economic Area, the GDPR.

• Contact details: name, email address and WhatsApp number, so we can answer you and run the booking.
• Booking details: dates, number of guests, boat and cabin choices.
• Identity details for the passenger list: names as listed in the passport, nationality and, where the boarding documents and the park ticket require them, passport numbers.
• Dietary and medical notes, used for catering and safety on board and for nothing else.
• Payment details: the provider you choose receives what it needs to create and complete the payment, which can include your email address.

The legal basis is the contract you make when you book, our legitimate interest in running and securing the service, and your consent where we ask for it.

We share limited data with providers, each for one job, and we do not sell personal data.

• Messaging: WhatsApp, run by Meta Platforms, delivers your messages. We receive your number, your profile name and the text. The thread can be copied into our customer system so that whoever opens your file can read the history.
• AI help: some message text goes to an AI service provider in the United States, which helps our team understand a request and draft a reply. It prepares a draft and nothing more; a person decides every booking and every price.
• Payments: the card, bank, PayPal, Wise, Revolut, QRIS, Alipay and WeChat Pay providers receive what each method needs.
• Email: a transactional email service sends booking confirmations in your name and address.
• Infrastructure: Cloudflare delivers and protects the site, and Google holds an off-site backup of our operational records, which can include booking and message data.

Our websites also use Microsoft Clarity, which records how visitors use a page as session replays and heatmaps so that we can find what is broken. With your consent only, we share a one-way hashed email or phone number with Google and Meta to measure whether our advertising worked. Decline it on the privacy banner and we share neither.

Several providers sit outside Indonesia, including in the United States. For those transfers we rely on each provider's own data-protection commitments and contractual safeguards.

We set no fixed limit on WhatsApp history. It stays with the booking and service records until you ask us to delete it.

To ask, email sales@kanha-phinisi.pages.dev with the subject Data deletion request, or message us on WhatsApp, and give the phone number, email address or booking reference tied to your data. We can first ask you to verify who you are. We acknowledge the request within a few business days and complete it within 30 days of verification. Any part we cannot complete comes with a reason.

Indonesian law requires us to keep invoices, payment records and accounting entries for completed bookings for a statutory period. We keep the minimum for that and anonymise the rest. Deleting a record on our side does not delete your own copy of a chat, or the copy that Meta holds under its own terms.

You can ask to see the data we hold about you, to correct it, and to have it deleted. You can withdraw consent for advertising measurement at any time on the privacy banner or by writing to us; withdrawal applies from that moment and changes nothing about your booking, your service or your price.

A person on our team answers every request. If you are not satisfied, you can complain to the competent data-protection authority, and visitors in the European Economic Area can complain to their own supervisory authority.

Questions about this policy go to sales@kanha-phinisi.pages.dev or to us on WhatsApp. We update this page when our practice changes, and the policy in force is the one shown here.