Privacy Policy

1. Introduction & Data Controller

Welcome to Yalla Bali (yallabali.com), an online travel, tour package, and private car charter platform owned and operated by PT Virtuoso Bali Indonesia(“Company”, “we”, “us”, or “our”), headquartered at Sedang, Abiansemal, Badung, Bali, 80352, Indonesia.

We are committed to protecting your personal data in accordance with the laws of the Republic of Indonesia, including Law No. 27 of 2022 on Personal Data Protection (Undang-Undang Pelindungan Data Pribadi / UU PDP), and applicable international data privacy standards.

2. Personal Information We Collect

When you browse our catalog, register an account, or book a tour or private vehicle charter, we collect only the information necessary to fulfill your reservation and provide customer support:

• Account & Contact Information: First name, last name, email address, WhatsApp/telephone number, and optional date of birth provided during account registration or checkout.
• Booking & Passenger Manifest Data: Participant full names, pickup hotel or villa details, preferred departure dates and times, and special travel notes required for tour logistics, fast boat ticketing, or attraction entry passes.
• Transaction Metadata: Order reference numbers, selected payment channel, currency exchange rate at purchase, payment status, and electronic receipt timestamps.
• Technical & Security Data: IP address, browser user-agent, authentication session cookies, and anti-bot verification tokens used to protect our platform against automated abuse.

3. How We Use Your Information

• Reservation Fulfillment: Coordinating private hotel transfers, assigning licensed drivers and multilingual tour guides (English, Arabic, Indonesian), and issuing attraction or inter-island fast boat tickets.
• Transactional Communications: Sending automated booking confirmations, electronic payment receipts (e-receipts), pickup reminders, and schedule updates via email or WhatsApp.
• Order Management & Customer Support: Processing rescheduling or cancellation requests submitted through your My Orders dashboard in accordance with our Terms and Conditions.
• Security & Fraud Prevention: Verifying authentic transactions, preventing unauthorized account access, and complying with Indonesian financial and tourism regulations.

4. Payment Processing & Financial Security

All online payments—including Visa, Mastercard, JCB, QRIS, Bank Virtual Accounts (BCA, Mandiri, BNI, BRI, Permata, CIMB, BSI, BNC), and E-Wallets (OVO, DANA, ShopeePay)—are processed directly through our licensed payment gateway partner, Pivot Payment, using encrypted Redirect Payment Sessions and 3D Secure (3DS) authentication. We only receive cryptographic payment status notifications and transaction reference IDs to confirm your booking.

5. Data Sharing & Third-Party Service Providers

We do not sell, rent, or trade your personal information to third-party marketers. We share limited booking data strictly on a need-to-know basis with trusted operational partners:

• Local Activity & Transport Operators: Assigned drivers, tour guides, and licensed harbour/fast-boat operators who require guest names for mandatory passenger manifests and insurance coverage.
• Payment Gateway & Acquiring Banks: Pivot Payment and partner financial institutions for transaction authorization, settlement, and anti-fraud screening.
• Cloud & Security Infrastructure: Supabase (encrypted database and authentication with Row-Level Security) and Cloudflare Turnstile (privacy-preserving bot protection).

6. Cookies & Session Technologies

We use essential first-party cookies and local browser storage solely to maintain your authenticated login session, preserve items in your shopping cart, and verify Cloudflare Turnstile security challenges. You may clear or disable cookies in your browser settings at any time, though doing so may prevent authenticated checkout features from functioning properly.

7. Data Retention & Your Rights

We retain booking and transaction records for as long as your account remains active and as required by Indonesian tax, accounting, and tourism regulations. Under applicable data protection laws, you have the right to:

• Access and review the personal information stored in your Profile.
• Update or correct inaccurate contact details prior to tour departure.
• Request deletion or anonymization of your account data (subject to mandatory legal retention for completed financial transactions).

8. Contact Us

If you have any questions about this Privacy Policy, or wish to exercise your personal data rights, please contact our Data Protection & Operations Team: