Your data on Nusa Penida Day Trip

Briefly

You can read every page of Nusa Penida Day Trip without an account. The site sets no cookies and runs no analytics, advertising or tracking scripts. What does reach us is the connection data that any web server sees when it sends you a page, and it is described below.

Nothing is booked on this site. When you choose a trip you book it on Viator or GetYourGuide, where their privacy rules apply.

Who is accountable for what

Nusa Penida Day Trip
[email protected]

The law does not require us to name a data protection officer, so Nusa Penida Day Trip has none. Questions about your data go to [email protected].

Records kept by the server

Whenever your browser requests a page or a file, the web server logs the IP address of the request, the date and time, the address asked for, the page that sent you and the identifier your browser gives for itself and its operating system.

These records let us deliver the site, keep it stable, spot attacks and abuse, and count how often each page is read. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a site that works and stays safe. Raw records are erased after 90 days at most, and counts without an IP address are kept for longer. A hosting company runs the server and handles this data for us, on our instructions only.

The service that sits in front of the site

Pages and email for this domain run through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which serves the site fast, blocks attacks and forwards email to our mailbox. For this Cloudflare handles your IP address and technical connection data.

The legal basis is Article 6(1)(f) GDPR, our interest in a quick and safe site. Cloudflare holds a certification under the EU-US Data Privacy Framework and the European Commission's standard contractual clauses apply in addition. Cloudflare describes its practice at cloudflare.com/privacypolicy.

Photos of the trips

Photos of the trips come directly from the image servers of GetYourGuide (GetYourGuide Deutschland GmbH, Sonnenburger Straße 73, 10437 Berlin, Germany). To display one, your browser contacts those servers and gives them your IP address, an exchange we cannot influence.

The legal basis is Article 6(1)(f) GDPR: we want each trip shown with the provider's up-to-date photos.

After you follow a booking link

A booking link sends you directly to Viator or GetYourGuide. It includes our partner number so that the platform can give us credit for a booking made through it.

On Viator or GetYourGuide the platform sets its own cookies and processes your data under its own privacy policy. What comes back to us are commission reports with totals only, containing no names, no contact details and no payment data.

Videos embedded here

Videos are embedded in YouTube's privacy-enhanced mode and remain a still image until you press play, so your browser makes no contact with YouTube before that. Once you press play, the video streams from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which receives your IP address and may set cookies.

Pressing play is your consent: Article 6(1)(a) GDPR and Section 25(1) TDDDG. Google's privacy policy is at policies.google.com/privacy.

What stays saved in your browser

Your browser keeps some small notes locally so the site can follow your choices. They remain on your device and are unreadable to us:

• the packing-list boxes you ticked, which stay ticked on your next visit (local storage, kept until you clear it);
• the currency you select in the menu, so every page shows prices in it (local storage, kept until you clear it);
• if you open a chat: its reference number, an access key, your email address and a copy of the exchange, so it is waiting when you return (local storage, kept until you clear it);
• a flag that the chat bubble has already appeared, so it stays quiet afterwards (session storage, wiped when the tab closes);
• a flag that the exit window has already appeared, so it does not return (session storage, wiped when the tab closes).

These notes are strictly necessary for features you use yourself (Section 25(2) No. 2 TDDDG). You can erase them at any moment in your browser settings.

The Penida chat box

Starting a chat means handing us your name, email address and messages. The chat service also logs the country of your connection, a scrambled copy of your IP address (a salted hash that cannot be converted back into the address) and the page and language you wrote from.

Cloudflare (named above) stores the chat, and each message you write is passed to our account at the Telegram messenger, which processes it outside the European Union; our replies return the same way. Details: telegram.org/privacy. We use your email address solely for answering you.

The legal basis is Article 6(1)(b) GDPR, because you write and we reply, plus Article 6(1)(f) GDPR for the scrambled IP address, which serves only to fend off abuse and spam. A conversation is deleted on its own 180 days after the last message.

Contact by email

When you write to us by email, we use your message to reply. The legal basis is Article 6(1)(f) GDPR, or Article 6(1)(b) GDPR if the message concerns a contract. Once the matter is closed we delete the exchange, unless the law obliges us to keep it.

Font and map handling

Fonts come from our own server, so no font provider learns that you visited. Maps are images held on our own server and drawn from OpenStreetMap data; looking at them or zooming contacts no map provider. A "Google Maps" link opens Google only once you press it.

Pointers to outside sources

Our pages cite official and expert sources and link to them. Those sites learn nothing about you until you open a link, and from that point their own privacy rules apply.

What you may request from us

You can ask which data we hold about you (Article 15 GDPR), have it corrected (Article 16) or erased (Article 17), have its processing restricted (Article 18) and receive it in a portable form (Article 20). Where our legitimate interest is the basis, you may object at any time (Article 21), and consent you gave can be withdrawn for the future. An email to [email protected] is all we need.

You may also complain to a data protection supervisory authority, particularly in the EU country where you live, work or suspect an infringement took place (Article 77 GDPR).

We take no automated decisions about you and build no profiles. You are not obliged to give us data, although a page cannot reach your screen without the technical connection data.