Privacy Policy

1. Introduction

Nusa Gili Boat respects the privacy of our customers, passengers, and every user of our website. We are committed to processing personal data responsibly, transparently, securely, and in accordance with applicable law.

This Privacy Policy applies when you visit our website, search for a journey, make a booking, complete a payment, retrieve a booking, contact customer support, or use another service provided by Nusa Gili Boat.

By using our services, you acknowledge that you have received and read this Privacy Policy. Where consent is required for a specific processing activity, we will request that consent separately where necessary.

2. Data controller

Nusa Gili Boat acts as the party that determines the purposes and methods of processing personal data in connection with the operation of our website and booking services.

In connection with travel and payment services, fast boat operators and payment providers may act as data controllers or data processors according to their respective roles, services, and policies.

Questions or requests relating to personal data may be submitted using the contact information provided at the end of this Privacy Policy.

3. Personal data we collect

The types of data we collect depend on how you use our services. This data may include:

A. Customer information

• Full name.
• Email address.
• Telephone or WhatsApp number.
• Nationality where required.
• Other contact information provided voluntarily.

B. Passenger information

• Passenger names.
• Passenger category, such as adult, child, or infant.
• Number of passengers.
• Nationality or identification information where required by an operator.
• Information about special assistance requirements provided voluntarily.

C. Booking and travel information

• Booking code.
• Travel route and date.
• Departure and destination ports.
• Departure and arrival schedule.
• Selected operator and vessel.
• One-way or round-trip journey.
• Number of seats and travel price.
• Booking, change, cancellation, and refund status.

D. Payment information

• Reference number or transaction ID.
• Order ID issued by the payment provider.
• Transaction amount.
• Payment method.
• Payment status.
• Transaction time.
• Refund or payment cancellation information.

E. Technical information

• IP address.
• Browser type and version.
• Operating system.
• Device type.
• Access date and time.
• Pages visited.
• Referring website or page.
• Log data, system errors, and security activity.
• Cookies, session storage, and similar technologies.

F. Communications and customer support

• Email and WhatsApp messages.
• Change or cancellation requests.
• Complaints and descriptions of events.
• Documents or evidence provided to handle a request.
• Customer preferences relating to marketing communications.

Please do not send a PIN, CVV, banking password, OTP code, or other confidential financial information through email, WhatsApp, or a customer support form.

4. Sources of personal data

We may obtain personal data:

• Directly from customers when they search for a journey, make a booking, or contact us.
• From a person making a booking on behalf of another passenger.
• From the fast boat operator responsible for the journey.
• From PayPal, a card issuer, a bank, a QRIS payment recipient, or another payment or refund service involved in a transaction.
• From technical systems, server logs, cookies, and security tools.
• From service providers that support our website and booking operations.

A customer who provides another passenger's data must ensure that the data is provided for a lawful travel purpose and that the passenger has received the necessary information about how their data will be processed.

5. Purposes for which we use data

We may use personal data to:

• Display and process travel options.
• Create, manage, and confirm bookings.
• Allocate seats on a selected journey.
• Provide necessary information to a fast boat operator.
• Process and verify payments.
• Issue and send booking confirmations.
• Issue and send e-tickets when that feature becomes available.
• Provide check-in and departure information.
• Communicate schedule changes, delays, or cancellations.
• Process booking changes, complaints, and refunds.
• Provide customer support.
• Detect and prevent fraud or misuse.
• Protect the security of the website, server, database, and transactions.
• Analyze and improve website performance and user experience.
• Comply with accounting, tax, legal, and regulatory obligations.
• Handle claims, disputes, audits, or inspections.
• Send marketing communications where the customer has chosen to receive them.

6. Legal bases for processing

Depending on the circumstances, personal data may be processed on the basis of:

• Performance of a contract or action requested by a customer to create and fulfill a booking.
• Customer consent for specific processing, such as marketing communications.
• Compliance with legal and regulatory obligations.
• Protection of the vital interests of a customer or passenger in certain circumstances.
• Legitimate interests relating to security, fraud prevention, service management, and system improvement, provided those interests do not override user rights.
• Another legal basis permitted under applicable laws and regulations.

Where processing is based on consent, a user may withdraw that consent in accordance with applicable law. Withdrawal of consent does not affect the lawfulness of processing completed before the withdrawal.

7. Sharing data with fast boat operators

We may provide necessary information to the operator responsible for the journey selected by the customer.

This information may include:

• Customer and passenger names.
• Contact number.
• Booking code or reference.
• Number and category of passengers.
• Travel route, schedule, and date.
• Information required for check-in and boarding.
• Relevant special assistance information provided by the customer.

The operator may process this data for transportation, safety, passenger manifest, check-in, and applicable legal purposes.

8. Payment processing

The current payment flow is handled manually. Customers may request official QRIS payment instructions or a PayPal payment link through the Nusa Gili Boat WhatsApp support channel.

For a QRIS payment, Nusa Gili Boat may receive payment proof, a transaction reference, payer information, the payment amount, payment time, and other information required to verify the payment manually.

For a card payment made through a PayPal payment link, PayPal, the card issuer, and related financial service providers may collect and process the information required to authorize, complete, cancel, dispute, or refund the transaction.

Nusa Gili Boat may receive transaction information such as a reference number, transaction ID, payment method, payment amount, transaction status, payment time, and refund status. Payment and booking confirmation are reviewed manually by the admin before the booking is marked Confirmed.

Nusa Gili Boat does not ask customers to send or intend to store complete card numbers, CVV codes, PINs, banking passwords, or OTP codes through WhatsApp, email, or a customer support form. Card credentials entered on PayPal are processed through PayPal and the relevant financial service providers.

9. Other parties that may receive data

Where necessary to operate our services, we may share data with:

• Hosting, server, cloud, database, and data storage providers.
• Email, notification, and customer communication providers.
• Security, monitoring, and fraud prevention providers.
• Analytics and website performance measurement providers.
• Accounting, audit, tax, or professional service providers.
• Banks, PayPal, card issuers, QRIS payment recipients, and other payment or refund service providers.
• Government agencies, regulators, courts, or law enforcement authorities where required.
• Other parties acting on the user's instructions or with the user's consent.

We aim to provide only the data that is relevant and necessary for the purpose of the recipient's service.

10. Sale of personal data

Nusa Gili Boat does not sell or rent customer personal data as a commercial database to another party.

Data is shared with operators, payment providers, and technical service providers to deliver services or fulfill lawful obligations, not for the purpose of selling personal data.

11. Cookies and browser storage

Our website may use cookies, session storage, local storage, and similar technologies to:

• Maintain website navigation and user sessions.
• Temporarily store booking information.
• Help customers access a confirmation page.
• Maintain security and prevent misuse.
• Remember certain choices or preferences.
• Measure website performance and usage.
• Detect and resolve technical errors.

Users may delete or restrict cookies through their browser settings. Some website functions may not operate properly when these technologies are disabled.

12. Analytics and marketing communications

We may use website usage information to understand page performance, improve the booking process, and enhance the user experience.

If a third-party analytics tool is used, information about that tool will be added to this Privacy Policy or the relevant cookie notice.

Promotional communications, ticket offers, destination information, and newsletters will only be sent based on customer choice or consent where required.

Customers may stop receiving promotional communications using an unsubscribe link or by contacting us. Important booking and travel messages may still be sent where necessary to provide the service.

13. Accuracy of data

Customers are responsible for providing accurate, complete, and current information.

Incorrect information may result in failed communication, an incorrect e-ticket, check-in difficulties, boarding refusal, or problems with a refund.

Customers should contact us immediately if they identify an error in booking or passenger information.

14. Storage and retention periods

Data may be stored in booking systems, databases, servers, backups, payment systems, emails, and customer support records.

We retain data only for as long as necessary to:

• Complete and provide evidence of booking transactions.
• Provide customer support.
• Handle changes, refunds, claims, and disputes.
• Prevent fraud and maintain security.
• Comply with accounting, audit, tax, and legal obligations.
• Maintain backups and service continuity.

Retention periods may vary depending on the type of data, purpose of processing, relationship with the customer, and legal obligations.

Data that is no longer required will be deleted, destroyed, anonymized, or restricted from further processing in accordance with applicable policies and requirements.

15. Data security

We implement reasonable administrative, technical, and organizational measures to protect data against:

• Unauthorized access.
• Unauthorized use or disclosure.
• Improper alteration of data.
• Loss or damage to data.
• Destruction of data.
• Attacks, fraud, and misuse of systems.

Protection measures may include encrypted connections, restricted server access, authentication, firewalls, security monitoring, backups, system updates, and activity logging.

No method of electronic transmission or storage can be guaranteed to be entirely risk-free. We will continue to adjust our protections according to service needs and identified risks.

16. Personal data breaches

If an incident results in damage, loss, alteration, disclosure, or unauthorized access to personal data, we will investigate, respond, recover, and take steps to mitigate the associated risks.

We will notify affected parties and the relevant authorities in the form and within the time required by applicable laws and regulations.

A notification may include the type of data affected, the known time and cause of the incident, the potential impact, and the response and recovery actions taken.

17. Cross-border processing and transfers

Some technology service providers may use infrastructure or personnel located outside the user's location or outside Indonesia.

Where data must be transferred outside Indonesia, we will consider applicable data protection requirements, including the level of protection, binding safeguards, or consent where required.

18. Children's data

The person making a booking must be at least 18 years old.

Data relating to a child or infant may be processed as passenger data where the booking is made by a parent, legal guardian, or responsible adult.

A person providing a child's data confirms that they have the authority required to provide that data for booking and travel purposes.

If we become aware that a child's data has been provided without appropriate authority, we may take steps to restrict or delete it, provided this does not conflict with legal obligations or a lawful booking.

19. User rights relating to personal data

Subject to applicable law and identity verification, users may have the right to:

• Obtain information about the purposes and legal basis of processing.
• Access and obtain a copy of their personal data.
• Complete, update, or correct inaccurate data.
• Withdraw consent where processing is based on consent.
• Request that data be stopped, deleted, or destroyed where permitted.
• Request the suspension or restriction of processing in certain circumstances.
• Object to decisions based solely on automated processing that produce legal or similarly significant effects.
• Obtain or transfer data in an appropriate format where applicable.
• Submit a complaint and seek compensation using an available legal mechanism.

Certain rights may be restricted where data remains necessary to fulfill a booking, comply with a legal obligation, prevent fraud, resolve a dispute, or protect the rights of another party.

20. How to exercise your data rights

A data-related request may be submitted by email or through the Nusa Gili Boat contact page.

The request should include:

• Full name.
• Email address or contact number used when making the booking.
• Booking code where the request relates to a transaction.
• The type of request being submitted.
• Supporting information required for verification.

We may request identity verification to prevent data from being disclosed, changed, or deleted at the request of an unauthorized person.

We will handle the request in accordance with the procedures and timeframes required by applicable laws and regulations.

21. Automated decisions and fraud prevention

Our systems may automatically check seat availability, input validity, booking status, session activity, and indicators of suspicious or abusive use.

Under the current manual QRIS and PayPal-link payment flow, Nusa Gili Boat does not mark a booking Confirmed solely through an automated payment decision. Payment evidence and the applicable transaction status are reviewed by the admin.

PayPal, card issuers, banks, and other financial service providers may use automated systems to assess risk, authorize transactions, and prevent fraud according to their own policies.

Where an automated decision has a significant effect on a user, the user may contact us to request an explanation or review to the extent that right applies.

22. Third-party links and services

Our website may contain links to operators, payment providers, maps, social media, or other third-party websites.

Data processing on a third-party website is subject to that party's privacy policy. Nusa Gili Boat does not control all privacy practices of those independent parties.

Users are encouraged to read a third party's privacy notice before providing personal data.

23. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our services, technology, payment providers, business processes, or regulations.

The latest version will be published on this page together with the date of the update.

Where a change materially affects how we process data, we will aim to provide an appropriate additional notice.

24. Governing law and language

This Privacy Policy is governed by and interpreted in accordance with the laws of the Republic of Indonesia, including requirements relating to personal data protection and electronic systems.

This policy was originally prepared in Bahasa Indonesia. A translation into another language may be provided for the convenience of users.

If there is any difference in interpretation, the Bahasa Indonesia version will prevail to the extent permitted by law.

25. Contact us

Questions, complaints, and requests relating to personal data may be submitted through: