Privacy policy: how your booking data is handled on princessnabila.com

The data controller for this site and for every booking made through it is PT Komodo Explorer Indonesia, NIB 1805260128363. This page applies the privacy policy of PT Komodo Explorer Indonesia, with its data-deletion instructions, to princessnabila.com. The law behind it is Indonesia's Personal Data Protection Law (UU No. 27 of 2022) and, for visitors in the European Economic Area, the GDPR.

You can reach the privacy contact at sales@princessnabila.com or at info@komodoexplorer.com, or by WhatsApp on the numbers shown on the contact page. Our team answers it.

One note about pictures: this site shows real photographs of the boat, and the few that include guests keep them small in the frame. None is a portrait.

• Contact details: your name, email address and WhatsApp number, to answer you and run the booking.
• Booking details: dates, head count, cabins and the rooming list.
• Identity details for the passenger list: names as printed in the passport, nationality and passport numbers where the boarding pass and the park ticket require them.
• Dietary and medical notes: for catering and safety on board, and for nothing else.
• Payment details: the provider you pay through receives what that payment needs, which can include your email address, so that the payment can be created and completed.

We collect only what the trip needs. The legal basis is the contract you make with us when you book, our legitimate interest in running and securing the service, and your consent where we ask for it, as in the advertising section below.

When you message us on WhatsApp, we receive your phone number, your profile name and the content of your messages through the WhatsApp Business Cloud API, which Meta Platforms, Inc. operates. We use them to answer you, manage the booking and give customer service. The conversation can be mirrored into our internal customer-relationship system so that whoever picks up your file can read the history.

We apply no fixed maximum retention period to WhatsApp history. It is kept as part of the booking and customer-service records until you ask us to delete it.

Some message text can be processed by an AI service, Cerebras Systems, Inc. in the United States, to help the team understand a request and draft or route a reply. That processing prepares a reply. It does not accept or reject a booking or set a price, and a person is involved in every decision that affects your reservation. Brevo sends our transactional emails, such as booking confirmations, using your name and email address.

We use Microsoft Clarity to see how visitors use the site. It records interactions as session replays and heatmaps, which helps us find technical friction. Microsoft processes that data under its own privacy statement.

With your consent, and only then, we share a hashed version of your email address or phone number (SHA-256, one way) with Google and Meta, together with technical ad identifiers such as GCLID and fbclid. The purpose is to measure whether our advertising worked. If you decline, we share neither your email address nor your phone number with Google or Meta.

You can withdraw consent at any time, through the privacy banner or by writing to us. Withdrawal applies from that moment on and changes nothing about your booking, the service or the price.

Our internal systems connect to Google Ads, Analytics, Search Console and Drive and Sheets through the company's own accounts. We do not access, collect or store the Google account data of visitors or customers.

• Meta Platforms: the WhatsApp channel, and the advertising identifiers described above.
• Cerebras Systems: AI assistance with message text.
• Stripe and Airwallex, which secure card payments made with American Express, Visa and Mastercard, and PayPal, Wise, Revolut, QRIS, Alipay and our payment partner for WeChat Pay: the details the method you choose needs to create and complete a payment. A bank transfer runs through your own bank to our company account.
• Brevo: transactional emails.
• Google: an off-site backup of our operational database, which can include booking and message records.
• Cloudflare: delivery, DNS and security for the website and the WhatsApp integration.

We do not sell your personal data to anyone. Some of these providers are outside Indonesia, including in the United States, and where data crosses a border we rely on each provider's own data-protection commitments and contractual safeguards.

Backups sit in an access-restricted Google Drive folder. We keep a limited number of recent backups, and older ones are removed automatically.

You can ask to see the data we hold about you, to correct it, or to have it erased. To ask for deletion, email info@komodoexplorer.com with the subject line Data deletion request, or message customer service on WhatsApp. Use the phone number, email address or booking reference tied to your data and give enough for us to find the record. We can ask you to verify who you are first.

We confirm receipt. The term is the one in our data-deletion instructions of 22 September 2026: we complete the deletion within 30 days of verification, or tell you which part we cannot complete and why. It removes your contact details and conversation history from our systems, your marketing consent records and identifiers, and free-text notes and preferences.

Indonesian law requires us to keep invoices, payment records and accounting entries for completed bookings for a statutory period. We keep the minimum needed for that and anonymise the rest. We also keep what we need to bring or defend a legal claim.

Deleting a record on our side does not delete your copy of a WhatsApp conversation or Meta's, which Meta manages under its own terms.