PRIVACY POLICY

Lombok Sunset Bay Resort

Last updated: 9 October 2026

1. Introduction

Welcome to the website of Lombok Sunset Bay Resort ("we", "us" or "our").

We respect your privacy and are committed to protecting your personal data in accordance with applicable data protection laws, including, where applicable, the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), relevant national data protection legislation, applicable electronic communications and cookie rules, and Indonesian Law No. 27 of 2022 on Personal Data Protection.

This Privacy Policy explains how we collect, use, disclose, store and protect personal data when you visit our website, contact us, request information, make or enquire about a reservation, use our services, or otherwise interact with us.

This policy applies to website visitors, prospective guests, guests, booking contacts and other individuals whose personal data we process in connection with our resort and website.

We process personal data only for specified, legitimate purposes and in accordance with applicable law.

2. Data Controller and Contact Details

The data controller responsible for the processing described in this policy is:

Legal name: Tjandra Suwarto & Norbert Fechter 
Trading name: PT. Lombok Sunset Bay Resort
Registered or business address: Sekotong Barat, Sekotong West Lombok Regency, West Nusa Tenggara 83365 Indonesia 
Location: Lombok, Indonesia
Email: norbert.fechter50@gmail.com
Telephone: +628776376888
Website: lomboksunsetbayresort.com

The data controller determines the purposes and means of processing personal data.

Where a booking platform, travel agency or other business independently determines how it processes your personal data, that business may act as a separate data controller and provide its own privacy notice.

If we are legally required to appoint a Data Protection Officer or an EU representative, the relevant contact details will be provided here.

3. When Does This Policy Apply?

This policy applies when you:

• Visit or browse our website.

• Submit an enquiry or contact form.

• Contact us by email, telephone or messaging service.

• Request room, villa, bungalow, restaurant or other resort information.

• Make, amend or cancel a reservation.

• Make a payment or request a refund.

• Subscribe to newsletters or marketing communications.

• Interact with our social media pages or embedded third-party content.

• Participate in promotions, surveys or guest feedback activities.

• Contact us with a complaint, request or data protection enquiry.

This policy applies to personal data processed through these activities. Separate notices may apply to third-party booking platforms, payment providers or other services that operate under their own privacy policies.

4. Categories of Personal Data We Collect

Depending on how you interact with us, we may collect the following categories of personal data.

4.1 Identification and contact information

• First and last name.

• Email address.

• Telephone number.

• Postal address and country of residence, where necessary.

• Preferred language.

4.2 Enquiry and reservation information

• Requested arrival and departure dates.

• Number of guests.

• Accommodation preferences.

• Reservation reference.

• Booking, cancellation and communication history.

• Special requests relevant to your stay.

• Information required to arrange services you have requested.

4.3 Payment and transaction information

• Payment status.

• Transaction reference.

• Refund and invoice information.

• Billing details required for accounting or payment processing.

Where payments are processed by an external payment provider, card details and other sensitive payment credentials are generally processed by that provider. We do not intentionally collect or store full payment card details unless this is specifically required and lawfully arranged.

4.4 Communications

We may process the content of emails, contact forms, messages, feedback and other communications you send us, together with the information necessary to respond.

4.5 Technical and usage information

When you visit our website, technical information may be collected, including:

• IP address.

• Browser type and version.

• Operating system and device information.

• Date and time of access.

• Pages visited and referring website.

• Server log information.

• Security events and error reports.

• Cookie identifiers and consent preferences, where applicable.

The information collected depends on the website hosting provider, website platform, security configuration and technologies actually used.

4.6 Marketing preferences

Where applicable, we may process your newsletter subscription status, communication preferences, marketing consent records and unsubscribe requests.

4.7 Information requiring special protection

We do not intentionally request special-category personal data, such as health information, religious beliefs or biometric data, unless it is necessary for a specific legitimate purpose and an applicable legal condition permits the processing.

If you voluntarily provide health-related or other sensitive information, for example to communicate an accessibility or dietary requirement, please limit it to what is necessary. We will handle it in accordance with applicable law.

4.8 Information about other guests

If you make a reservation on behalf of other individuals, we may receive their names and other booking information from you.

Please ensure that you are authorised to provide this information and, where appropriate, inform the individuals concerned about this Privacy Policy.

5. How We Collect Personal Data

We may collect personal data:

• Directly from you when you use our website or contact us.

• From a person who makes a reservation on your behalf.

• Through a booking platform, travel agent or other service provider involved in your reservation.

• Automatically through website server logs, cookies and similar technologies, subject to applicable law and consent requirements.

• From payment providers where information is necessary to confirm a payment or process a refund.

• From public sources where this is lawful and relevant to a specific business purpose.

Where personal data is obtained from another source, we will provide the information required by applicable data protection law, unless a lawful exception applies.

6. Purposes and Legal Bases for Processing

We process personal data only where an applicable legal basis permits us to do so.

Depending on the circumstances, the legal bases under Article 6 GDPR may include:

6.1 Responding to enquiries and taking steps before a contract

We use your contact details and enquiry information to answer questions, provide availability information, prepare quotations and respond to reservation requests.

Legal basis: Article 6(1)(b) GDPR, where processing is necessary to take steps at your request before entering into a contract; otherwise, where appropriate, Article 6(1)(f) GDPR, our legitimate interest in responding to enquiries.

6.2 Managing reservations and providing resort services

We process booking details, contact information, requested services and necessary guest information to confirm and manage reservations, provide accommodation and deliver requested services.

Legal basis: Article 6(1)(b) GDPR, where processing is necessary for the performance of a contract or pre-contractual steps requested by you.

6.3 Processing payments, refunds and invoices

We process necessary transaction and billing information to confirm payments, manage refunds, prevent payment errors and fulfil applicable accounting obligations.

Legal basis: Article 6(1)(b) GDPR for contractual payment administration and Article 6(1)(c) GDPR where processing is required by law.

6.4 Guest communication and customer service

We use relevant information to communicate with guests, address requests, resolve complaints and improve the quality of our services.

Legal basis: Article 6(1)(b) GDPR where contractually necessary, or Article 6(1)(f) GDPR where we have a legitimate interest in providing customer service and managing our business.

6.5 Website operation, security and fraud prevention

We may process technical data and server logs to maintain website availability, identify errors, protect against cyberattacks, investigate misuse and prevent fraud.

Legal basis: Article 6(1)(f) GDPR, where our legitimate interests are not overridden by your rights and freedoms, or Article 6(1)(c) GDPR where a legal obligation applies.

6.6 Website analytics and performance measurement

Where analytics tools are used, we may analyse website traffic and user interactions to understand how visitors use the website and improve its performance.

Legal basis: Consent under Article 6(1)(a) GDPR where required, including where the relevant cookies or tracking technologies require prior consent. Any analytics processing claimed to be based on legitimate interests must independently satisfy applicable law, including electronic privacy rules.

6.7 Marketing and promotional communications

We may send newsletters, offers or promotional communications where we have obtained valid consent or where another specific legal basis and all applicable electronic marketing requirements permit it.

Legal basis: Article 6(1)(a) GDPR where consent is required, or another applicable legal basis where permitted by law.

You can withdraw your marketing consent or unsubscribe at any time. This does not affect the lawfulness of processing carried out before withdrawal.

6.8 Legal claims and compliance

We may process relevant information to comply with legal obligations, respond to lawful requests, establish or defend legal claims and maintain legally required records.

Legal basis: Article 6(1)(c) GDPR for legal obligations and Article 6(1)(f) GDPR for legitimate interests in establishing, exercising or defending legal claims, where applicable.

6.9 Consent-based processing

Where we rely on consent, we will explain the relevant purpose and request consent before the processing begins where required. You may withdraw consent at any time.

Withdrawal does not affect processing lawfully carried out before withdrawal.

7. Cookies and Similar Technologies

Our website may use cookies, pixels, local storage and similar technologies.

Cookies are small files stored on your device. Depending on their function, they may support website operation, remember preferences, measure website performance or enable marketing and embedded third-party services.

7.1 Categories of cookies

Depending on the technologies actually installed, cookies may fall into these categories:

• Strictly necessary cookies: required to provide a service you have requested or to operate the website securely.

• Preference cookies: remember settings such as language or other preferences.

• Analytics cookies: measure website traffic and visitor interactions.

• Marketing cookies: support advertising measurement, personalised advertising or cross-site tracking.

• Third-party media cookies: may be set when you view embedded maps, videos, social media content or other external services.

7.2 Consent requirements

We will obtain prior consent for non-essential cookies and similar technologies where required by applicable law.

Strictly necessary technologies may be used without consent only where they meet the relevant legal exemption.

Where a consent mechanism is required, it will allow you to accept or reject non-essential cookies and manage your preferences. Refusing non-essential cookies should be as straightforward as accepting them.

You may withdraw or change your consent at any time through the website's cookie settings, where available.

7.3 Cookie information

The exact cookie names, providers, purposes, durations and legal bases depend on the website's actual configuration.

A cookie inventory should be maintained and made available through a cookie notice or consent-management interface where appropriate. We will not represent that a particular cookie is used unless it is actually installed or used by the website.

7.4 Browser controls

You can also manage or delete cookies through your browser settings. Blocking certain cookies may affect some website functions.

8. Third-Party Services and Recipients

We may share personal data with third parties only where necessary for the purposes described in this policy and where an appropriate legal basis exists.

Depending on the services actually used, recipients may include:

8.1 Website hosting and technical providers

Providers responsible for hosting, website operation, maintenance, technical support, security and backup services.

8.2 Booking and reservation providers

External reservation systems, online travel agencies, travel agents or other intermediaries involved in handling your booking.

8.3 Payment and financial service providers

Payment processors, banks and financial service providers involved in collecting payments, processing refunds and reconciling transactions.

8.4 Communication providers

Email, telephone, messaging and customer relationship management services used to communicate with you.

8.5 Analytics, advertising and social media providers

Providers of analytics, advertising measurement, social media integration and embedded content, where these services are actually used and any required consent has been obtained.

8.6 Professional advisers and service providers

Accountants, auditors, lawyers, insurers and other professional advisers where access is necessary for legitimate business purposes or legal compliance.

8.7 Public authorities

Courts, regulators, law enforcement authorities and other public bodies where disclosure is required by applicable law or is otherwise lawful.

8.8 Corporate transactions

In connection with a potential or completed sale, restructuring, merger or transfer of the resort business, relevant information may be disclosed where lawful and subject to appropriate confidentiality and data protection safeguards.

We do not sell personal data to third parties in exchange for payment. Where advertising technologies involve sharing personal data for targeted advertising or similar purposes, the applicable legal requirements and consent rules will be respected.

A final website-specific version of this section should identify the principal service providers actually used.

9. International Data Transfers

The resort operates in Indonesia, and certain service providers may process personal data in Indonesia or other countries outside the European Economic Area (EEA).

Where the GDPR applies and personal data is transferred to a country outside the EEA, we will ensure that the transfer complies with Chapter V GDPR.

Depending on the circumstances, an international transfer may rely on:

• An applicable European Commission adequacy decision.

• Standard Contractual Clauses approved by the European Commission.

• Appropriate supplementary safeguards following an assessment of the transfer, where necessary.

• Another legally recognised transfer mechanism or derogation that applies to the specific circumstances.

We will not assume that a transfer is lawful simply because a service provider operates internationally.

Where required, we will inform you of the relevant transfer mechanism and how you can obtain a copy of the applicable safeguards.

Indonesia is not automatically treated as an adequate destination for GDPR purposes merely because it has its own personal data protection legislation.

10. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, subject to applicable legal obligations and the need to establish or defend legal claims.

Retention periods depend on the category of information and the circumstances.

As a general framework:

• Enquiry information: retained for the time needed to respond and follow up, normally up to 12 months after the last meaningful communication unless a longer period is justified.

• Reservation and guest records: retained for the duration of the booking relationship and for an appropriate period afterwards to handle complaints, disputes and legal obligations.

• Invoices and accounting records: retained for the period required by applicable tax and accounting law.

• Marketing records: retained until consent is withdrawn or the individual unsubscribes, subject to limited records necessary to document consent and prevent further marketing.

• Cookie consent records: retained for the period needed to demonstrate and manage consent, in accordance with applicable law.

• Technical and security logs: retained for a proportionate period based on security, troubleshooting and legal requirements.

• Legal claims and disputes: retained for as long as reasonably necessary to establish, exercise or defend the relevant claims.

These are proposed retention guidelines, not a statement that every category is currently collected. Actual periods should be set according to the applicable legal requirements, the relevant provider's settings and the resort's retention schedule.

When data is no longer required, it will be deleted, anonymised or securely archived where legally permitted.

11. Your Data Protection Rights

Where the GDPR applies, you may have the following rights, subject to applicable conditions and exceptions:

11.1 Right of access

You may request confirmation as to whether we process your personal data and, where applicable, obtain a copy of that data and information about the processing.

11.2 Right to rectification

You may request correction of inaccurate personal data or completion of incomplete data.

11.3 Right to erasure

You may request deletion of personal data where the legal requirements for erasure are met. This right is not absolute; certain information may need to be retained to comply with law or establish, exercise or defend legal claims.

11.4 Right to restriction

You may request restriction of processing in circumstances specified by law.

11.5 Right to data portability

Where the applicable conditions are met, you may receive personal data you provided to us in a structured, commonly used and machine-readable format and request its transmission to another controller where technically feasible.

11.6 Right to object

You may object to processing based on our legitimate interests on grounds relating to your particular situation. We will assess your objection in accordance with applicable law.

You have an unconditional right to object to processing of personal data for direct marketing, including related profiling.

11.7 Right to withdraw consent

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing carried out lawfully before withdrawal.

11.8 Rights relating to automated decision-making

Where Article 22 GDPR applies, you may have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you, unless a legal exception applies.

We will provide additional information if such decision-making is introduced and subject to applicable transparency requirements.

11.9 Right to lodge a complaint

You may lodge a complaint with a competent data protection supervisory authority, particularly in the EU Member State of your habitual residence, place of work or the place of the alleged infringement, where the GDPR applies.

11.10 How to exercise your rights

Please contact us using the contact details in Section 2.

We may request proportionate information to verify your identity and protect your personal data from unauthorised disclosure.

We will respond within the time limits prescribed by applicable law. Under the GDPR, the normal deadline is one month, subject to permitted extensions for complex or numerous requests.

Exercising your rights is generally free of charge, except where the law permits a reasonable fee or refusal in exceptional circumstances.

12. Direct Marketing and Newsletters

We will send promotional emails or other electronic marketing communications only where permitted by applicable law.

Where consent is required, we will obtain it before sending marketing communications and provide a simple way to unsubscribe or withdraw consent.

Where a limited existing-customer exception is available under applicable law, we will use it only if all statutory conditions are met.

We will not treat a request for a reservation quotation as automatic consent to receive unrelated marketing communications.

Service messages necessary to administer an enquiry, reservation, payment or stay are distinguished from promotional messages.

13. Data Security

We implement appropriate technical and organisational measures designed to protect personal data against accidental loss, destruction, alteration, unauthorised disclosure and unauthorised access.

Depending on the nature of the processing and available technology, measures may include:

• Access controls and appropriate authentication.

• Secure website and hosting configurations.

• Encryption in transit where appropriate.

• Regular software updates and security monitoring.

• Access restrictions based on business need.

• Backup and recovery procedures.

• Confidentiality obligations for personnel and service providers.

• Secure deletion and appropriate retention controls.

• Procedures for responding to suspected data breaches.

No internet transmission or storage system can be guaranteed to be completely secure. We therefore cannot guarantee absolute security.

If a personal data breach occurs, we will assess it and notify the relevant authorities and affected individuals where required by applicable law.

14. Personal Data Breaches

We maintain appropriate procedures for identifying, assessing and responding to personal data breaches.

Where the GDPR applies, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of a personal data breach if notification is required by Article 33 GDPR.

Where a breach is likely to result in a high risk to individuals' rights and freedoms, we will communicate it to affected individuals without undue delay unless a lawful exception applies.

Other applicable legal obligations, including Indonesian requirements where relevant, will also be observed.

15. Children and Minors

Our website is intended primarily for adults planning or arranging a stay at the resort.

We do not knowingly collect personal data directly from children through the website for independent marketing purposes.

Where information about a child is necessary for a family reservation or provision of a requested service, it will be processed only as necessary and in accordance with applicable law.

If we become aware that personal data has been collected unlawfully, we will take appropriate steps to address the issue.

Where consent is relied upon for an online service offered directly to a child, the applicable rules on parental authorisation and the relevant national age threshold will be observed.

16. Third-Party Websites and Social Media

Our website may contain links to third-party websites, social media pages, online booking services, maps, videos or other external content.

These third parties may process your personal data under their own privacy policies and terms.

We are not responsible for the independent privacy practices of third-party websites that we do not control.

Where embedded content or third-party technologies access information on your device or transmit personal data, we will apply the consent and transparency requirements that are relevant to the service.

We recommend reviewing the privacy policies of any third-party services you choose to use.

17. Website Hosting and Technical Logs

Our website is hosted by WIX.

The hosting provider may process technical information, including IP addresses, timestamps, requested pages and server logs, to deliver the website, maintain its security and troubleshoot technical problems.

Where the provider processes personal data on our behalf, we will put in place the contractual and organisational arrangements required by applicable law.

The hosting provider's location, retention settings and role in the processing should be confirmed before publication.

18. Online Reservations and Payments

If the website offers direct reservations, online booking or payment facilities, additional information may be collected to administer the requested transaction.

This may include reservation dates, accommodation selection, guest details, payment status, billing information, cancellation requests and transaction references.

Payment details may be processed directly by a third-party payment provider. The provider's own terms and privacy policy may apply.

We will not request or store payment credentials through insecure channels.

If the website does not offer direct online reservations or payments, this section applies only when those functions are introduced.

19. Indonesian Data Protection Law

The resort is located in Indonesia. Where applicable, the processing of personal data may also be subject to Indonesian Law No. 27 of 2022 on Personal Data Protection and other applicable Indonesian legal requirements.

We will assess the applicable Indonesian requirements according to the nature of our operations, the personal data involved and the territorial scope of the relevant law.

Where both European and Indonesian data protection laws apply, we will seek to comply with the requirements applicable to the relevant processing activity.

This policy does not replace any additional notices, registrations, procedures or other measures that may be legally required for the resort's Indonesian operations.

20. No Sale of Personal Data

We do not sell personal data as a business activity.

We share personal data only where necessary for the purposes described in this policy, where an applicable legal basis exists, or where disclosure is otherwise permitted or required by law.

If the website uses advertising, analytics or social media tools that involve disclosure of personal data to third parties, those arrangements will be assessed separately and disclosed as required by law.

21. Automated Processing and Profiling

We do not intend to make decisions about guests that produce legal or similarly significant effects solely through automated processing unless such processing is lawfully introduced and all applicable requirements are met.

If we introduce relevant automated decision-making or profiling, we will provide the information required by applicable law, including, where required, meaningful information about the logic involved and the envisaged consequences.

22. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, website functionality, service providers, legal obligations or data protection practices.

The latest version will be published on this page, together with the date of the most recent update.

Where required by law, we will provide additional information or seek renewed consent before introducing new processing activities that require it.

We encourage you to review this policy periodically.

23. Contact and Complaints

For questions about this Privacy Policy, to exercise your data protection rights or to raise a concern about the processing of your personal data, please contact:

Lombok Sunset Bay Resort
Legal operator: Tjandra Suwarto & Norbert Fechter 
Email: norbert.fechter50@gmail.com

You may also lodge a complaint with a competent data protection supervisory authority where the GDPR applies. If you are in Germany, the competent authority will depend on the relevant circumstances and jurisdiction.

End of Privacy Policy