This policy explains what personal data we process, why we need it, who we can share it with, and what rights you have.
1. Who processes your personal data?
The personal data controller is PT FUSION PARTNERS GROUP, a company of the type Perseroan Terbatas – Penanaman Modal Asing (PT PMA), operating under the brand name AMANI Journeys.
Registered office: Jalan Batuyang Gang Garuda III No. 5, Batubulan Kangin, Kec. Sukawati, Kab. Gianyar, Bali 80582, Indonesia
NIB: 1503230115558
NPWP16: 0402565279907000
Email for enquiries and exercise of rights: bali@transformacnypobyt.sk
Phone and WhatsApp: +62 822 2422 2209
This policy applies to the websites, campaign sub-pages, forms, and services operated under the AMANI Journeys brand, unless otherwise specified for a particular service.
2. What legal regulations do we apply?
We process personal data primarily in accordance with Indonesian Law No. 27 of 2022 on the Protection of Personal Data (Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi).
If we offer services to individuals within the European Union, the relevant provisions of the European Parliament and Council Regulation (EU) 2016/679 (GDPR) shall also apply.
3. What personal data can we process?
Depending on how you communicate with us and the service you order, we may process, in particular:
- identification details: name, surname, date of birth, nationality, and address (if required for the contract or reservation);
- contact details: email address, phone number, WhatsApp, and country of residence;
- data from forms: chosen retreat or trip, dates, number of people, travel preferences, message, and answers to optional questions;
- data required for the trip: flight details, accommodation information, details of fellow travellers, emergency contact information, and travel document details (only if required for booking or compliance with local regulations);
- payment and accounting details: invoice information, amount, currency, date, and payment reference; we do not provide or store complete payment card details where the payment is processed by a bank or payment gateway;
- information regarding health, physical, or dietary restrictions or allergies, provided only to the extent necessary to ensure the safe provision of services;
- content of communication via email, form, phone, WhatsApp, or social media;
- photographs, videos, testimonials, and reviews, if you give us separate consent to use them;
- technical data: IP address, device and browser type, visit time, security logs, and cookies based on your settings.
4. What are the purposes for which we use the data, and what is the legal basis for doing so?
We use the data solely for specific and legitimate purposes:
- responding to your enquiry, providing the requested programme or PDF, and preparing a quotation – taking steps prior to entering into a contract, or our legitimate interest in responding to your enquiry;
- booking and provision of the stay, retreat, trip, transfer, lodging, or other services – fulfilling the contract;
- communication before, during, and after the journey, organisational information, and emergency assistance – fulfilling the contract and ensuring the safety of travellers;
- invoice generation, accounting, and fulfilling tax or other legal obligations – legal obligation;
- handling of claims, complaints, debt collection, and legal claim protection – fulfilling a contract, legal obligation, or legitimate interest;
- processing of health, allergy, or dietary information – your explicit consent; in urgent situations, also protection of vital interests;
- sending newsletters and marketing offers – your voluntary consent, which you can withdraw at any time;
- publishing a photograph, video, review, or customer story – requires separate, voluntary consent;
- website protection, prevention of misuse, and technical operation – our legitimate interest in ensuring the security and functionality of the website;
- analytical and marketing cookies – your consent obtained through the cookie banner or cookie settings.
Submitting the form to request the programme or contacting us does not constitute automatic consent to receive the newsletter. Marketing consent must be obtained separately.
5. Is the provision of data mandatory?
The information marked as required in the form is necessary for us to provide a response or deliver the requested service. Without it, we may be unable to process the enquiry, conclude a contract, or secure a reservation.
The information marked as optional is provided voluntarily. Do not include sensitive health information in the standard contact form unless it is specifically required and the form is designed for that purpose.
6. Whom can we share the data with?
We only provide personal data to the extent necessary for the specific purpose. Recipients or processors may include, but are not limited to:
- hotels, villas, transport providers, drivers, boat operators, guides, instructors, activity organisers, ceremony organisers, and other local suppliers needed to deliver the requested service;
- hosting providers, web form providers, and web technical support providers, particularly Netlify, if used on a specific website;
- providers of email, cloud storage, communication tools, and WhatsApp;
- banks, payment gateways, and payment providers;
- accountants, tax advisors, lawyers, auditors, and IT service providers bound by a duty of confidentiality;
- governmental bodies, courts, police, immigration or tax authorities, if required by law.
We do not sell personal data to data brokers or third parties for their own marketing purposes.
7. Data transfers outside the European Union
The controller is based in Indonesia, and services are primarily provided within Indonesia. Therefore, the data may be processed in Indonesia, and potentially in other countries, such as the United States, depending on the specific technology provider used.
Regarding transfers covered by GDPR, we use contractual and technical protective measures as appropriate, such as standard contractual clauses, an approved data transfer framework, or other legal exceptions. We only provide data to local suppliers to the extent necessary for booking and providing your service.
8. How long do we retain the data?
The storage periods are determined according to the purpose and legal requirements:
- Non-binding enquiries and offers that do not result in a booking: up to 12 months after the last communication.
- Contracts and booking records: for the duration of the contract and generally for 5 years after the service ends, unless the law or a legal claim requires longer retention.
- Accounting, tax and payment records: 10 years, unless Indonesian law requires a different retention period.
- Health, allergy and dietary information: generally for up to 30 days after the trip ends, unless there has been an incident, complaint or legal claim.
- Newsletters and marketing: until you withdraw consent. We may retain a basic record of the withdrawal to demonstrate that we must not send you further messages.
- photographs, videos, and reviews: until consent is withdrawn or the purpose for which they were provided is fulfilled;
- technical and security logs: typically no more than 12 months;
- cookies: in accordance with the duration specified in the cookie settings or cookie information.
Once the specified period has elapsed, we will securely delete or anonymise the data, unless its continued storage is required by law or to protect legal claims.
9. Web forms, bookings, and emails
Forms and trip bookings submitted on the websites transformacnypobyt.sk, transformacnipobyt.cz, and transformationsretreat.de are sent to our server system on the Netlify platform (Netlify Functions and Netlify Blobs storage). A backup copy of the submitted form is also stored in the Netlify Forms service. Netlify acts as a technical processor according to our instructions; data may also be processed in the USA.
Confirmations and notifications are sent via email through the WebSupport (Slovakia) email server. The actual sending of the requested programme or confirmation is not a marketing newsletter.
If online payment is enabled for a trip, the payment gateway (Stripe or Xendit) processes the payment. You enter your payment card details directly with the payment gateway, and we do not receive them; we only store the amount, currency, date, and payment reference.
Access to the booking and enquiry database is password-protected, and only authorised personnel have access. Non-binding enquiries are automatically deleted from our database after 12 months from the last record; we apply the same timeframe to backup copies in Netlify Forms. Bookings and payment records are retained in accordance with the periods specified in section 8.
10. Cookies and similar technologies
We use Google Analytics (Google) to measure website traffic, but only with your consent.
The website may use necessary cookies for security, form functionality, saving language or cookie settings, and the proper display of the page.
We use analytical and marketing cookies only with your consent. You can refuse or change your cookie preferences at any time through the cookie banner or your cookie settings. Refusing non-essential cookies does not prevent you from browsing the website, but some additional features may not be available.
11. Your Rights
If the processing of personal data is subject to the GDPR or comparable data protection laws, you may be entitled to request:
- access to your personal data and a copy thereof;
- correction of inaccurate data or completion of incomplete data;
- data deletion;
- restriction of processing;
- data portability;
- objection to processing based on legitimate interest;
- withdrawal of consent, without affecting the lawfulness of processing before its withdrawal;
- submitting a complaint to the relevant supervisory authority.
Please send your request to bali@transformacnypobyt.sk. We may verify your identity appropriately before processing it. We will respond to a valid request promptly and within the timeframe specified by the relevant legislation.
12. Automated decision-making
We do not engage in automated individual decision-making or profiling that would have legal or similarly significant effects on you.
13. Children’s Information
If a person under the age of 18 participates in the service, their parent or legal guardian provides their information to us and carries out the contractual acts. We process the information of minors only to the extent necessary for travel, safety, and the fulfilment of the contract.
14. Security
We implement appropriate organisational and technical measures, particularly access control, secure accounts, data limitation to the necessary scope, secure data transfer, and regular data deletion. However, no electronic system can be considered absolutely secure.
15. Changes to this policy
This policy may be updated, particularly when the website, forms, suppliers, or legal requirements change. The current version is always available on the website, with the effective date clearly stated.
16. Contact
PT FUSION PARTNERS GROUP – AMANI Journeys
Jalan Batuyang Gang Garuda III No. 5, Batubulan Kangin, Kec. Sukawati, Kab. Gianyar, Bali 80582, Indonesia
Email: bali@transformacnypobyt.sk
Phone/WhatsApp: +62 822 2422 2209