Privacy Policy

Last updated: 26 October 2026

CV Hi Bali Nusa Tenggara ("Gilifast", "we") is committed to protecting your privacy in accordance with Indonesia's Personal Data Protection Law (UU PDP No. 27/2022).

1. Data We Collect

Booking data: Names, email, phone, nationality, ID/passport numbers of the booker and passengers.
Payment data: Method (QRIS, e-wallet, etc.), amount, timestamp. Card numbers and PINs are handled by DOKU; we never see them.
Technical data: Anonymized IP, browser type, and pages visited to improve performance.
Measurement data (only with your consent): how you reached us (for example the ad campaign or website that sent you), the pages and journeys you viewed, and, for advertising measurement, the click identifiers Google and Meta add to ad links plus your IP address and browser user agent. This is linked to your booking so we can tell which ads lead to paid trips.

2. How We Use Your Data

Process bookings and issue e-tickets.
Share necessary passenger info with the listed boat operator so they can fulfill the trip.
Send transactional emails (booking confirmation, cancellation, refund updates).
Respond to customer service queries.
Comply with legal and tax obligations.

3. Who We Share With

Boat operators: Only the data necessary for transport (passenger names, departure, contact phone in case of disruption).
DOKU (payment gateway): Payment details so the transaction can be processed.
Email provider (Google Workspace / Gmail): Recipient email and ticket details to deliver e-tickets.
Google (Analytics, Ads) and Meta (Facebook/Instagram ads), only with your consent: that a booking was paid, its value, route and party size, with the ad click identifier, analytics cookie id and, for Meta, your IP address and user agent. We never send your name, email, phone number or passport details to them.
Law enforcement: When required by valid legal request under Indonesian law.

We do not sell your data to advertisers or marketing networks.

4. Data Retention

Booking records are retained for 10 years to comply with Indonesian tax law.
Marketing email opt-ins can be withdrawn at any time.
Anonymized analytics: 24 months.
Ad click identifiers, IP address and user agent linked to a booking for measurement: deleted after 90 days.
Your cookie choice: 6 months, after which we ask again.

5. Your Rights (UU PDP)

Access the personal data we hold about you.
Correct inaccurate data.
Request deletion (subject to legal retention requirements).
Withdraw consent for marketing communications.
Lodge a complaint with the Indonesian data protection authority.

To exercise these rights, contact info@balinusafast.com.

6. Security

We use industry-standard encryption (HTTPS/TLS) for all data in transit. Database access is restricted, payment data is tokenized via DOKU, and we log every administrative action. Despite this, no internet service can be guaranteed 100% secure.

7. Cookies

Essential cookies (session, sign-in, language, your cookie choice) are always on because bookings cannot work without them.

With your permission we also use:

Analytics: Google Analytics and our own visit counts, to understand which pages and routes people look at.
Marketing: Google Ads and Meta (Facebook/Instagram) measurement, to learn which of our ads lead to paid bookings.

Both are off until you choose. You can change your choice at any time through "Cookie settings" at the bottom of every page. Saying no never affects your ability to book or pay.

8. Children

Gilifast is not intended for users under 18. Minors travel under the booking of a parent or guardian who accepts these terms on their behalf.

9. Changes

Material changes to this policy will be notified by email to active account holders at least 30 days before taking effect.

10. Contact

Data Protection Officer · info@balinusafast.com
CV Hi Bali Nusa Tenggara · Jl. Swakarya Raya No.5B, Kekalik Jaya, Kec. Sekarbela, Kota Mataram, Nusa Tenggara Barat 83114, Indonesia