Privacy Policy

When you make a reservation, enquire about our services, or interact with our website, we may collect the following personal information:

• Full name, email address, and telephone number

• Passport or national identification details (required for Indonesian hotel registration)

• Payment card information (processed securely via our booking partners)

• Check-in and check-out dates, number of guests, room preferences, and special requests

• IP address, browser type, and browsing behaviour on our website

• Communications you send to us via email, telephone, or WhatsApp

When you contact us through a form on our website (the enquiry form on our Contact page, or the form shown before WhatsApp opens), we save your name, contact details (WhatsApp number and/or email address), the topic and message, whether you asked to receive offers, and technical details of the enquiry: which page and button you used, how you reached our website (for example a search engine or an advertising campaign), your browser language and time zone, and the type of device. Your IP address is not stored, only a scrambled code used to block spam.

When you request a treatment at Mandalika Spa on our website, we save the treatments and the time you asked for, your name, whether you are staying at the resort and your room number, your WhatsApp number if you give it, the number of people, and any note you write for the therapist. A note can include health information (for example an injury, an allergy or a pregnancy): it is used only to give you a safe treatment, it is seen only by the spa team and the website administrators, and it is not sent by email. The language of the page and the type of device are saved as well; your IP address is not stored, only a scrambled code used to block spam.

We use the personal information we collect to:

• Process and confirm your reservation and provide the services you have requested

• Communicate with you before, during, and after your stay

• Meet our legal obligations under Indonesian hospitality regulations

• Send you promotional offers, newsletters, and special packages (only where you have opted in)

• Improve our website, services, and guest experience

• Respond to reviews and handle complaints or feedback

We process your personal data on the following legal bases:

• Contractual necessity — to fulfil your booking and deliver the services you have booked

• Legal obligation — to comply with Indonesian law, including hotel guest registration requirements

• Legitimate interests — to operate and improve our business, prevent fraud, and ensure security

• Consent — where you have explicitly opted in to receive marketing communications

We do not sell, rent, or trade your personal information. We may share your data with:

• Booking platforms (Booking.com, Agoda, Expedia) where your reservation was made

• Payment processors and banking partners for secure transaction handling

• Indonesian government authorities as required by hotel registration law

• Service providers who assist us in operating our website and delivering services (they are bound by confidentiality obligations)

We require all third parties to respect the security of your personal data and to treat it in accordance with applicable law.

We retain your personal data for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Reservation records are kept for a minimum of 5 years in compliance with Indonesian tax and hospitality regulations.

Marketing preferences and consent records are retained until you withdraw consent.

Spa treatment requests are kept only as long as needed to arrange your treatment and keep the spa's accounts. You can ask us to delete your request and its note at any time (see Contact Us).

Subject to applicable law, you have the right to:

• Access the personal data we hold about you

• Request correction of inaccurate or incomplete data

• Request deletion of your data, subject to our legal obligations

• Withdraw consent for marketing communications at any time

• Object to the processing of your data for direct marketing

To exercise any of these rights, please contact us at: info@holidayresortlombok.com

Our website uses Google Analytics 4, a service of Google LLC, to measure how it is used: which pages are viewed, how far pages are scrolled, and which buttons and links are clicked (for example booking, WhatsApp, phone and email links). We use this only to improve our website and promotions.

Google Analytics stores two first-party cookies in your browser (_ga and _ga_5TX41LYCPM), which last up to 2 years. Google Analytics does not log or store IP addresses, and we keep analytics data for no longer than 14 months. We do not use advertising or remarketing cookies on this website. The website itself needs no cookies to work.

• Visitors in the European Economic Area, the United Kingdom and Switzerland: Google Analytics stores no cookies unless you click Accept. Until you accept, and if you decline, it only sends Google cookieless signals without an identifier (Google Consent Mode).

• Visitors elsewhere: Google Analytics is on unless you click Decline.

Your choice is saved in your browser. You can change it at any time with Cookie settings at the bottom of every page or the button below, and you can also block or delete cookies in your browser settings.

If you choose English or Bahasa Indonesia with the language switch, that choice is saved in your browser too (as hrl_lang), so we don't suggest the other language again. It is not a cookie, it is not sent to us or to Google, and it stays until you clear your browser's data for this website.

Reservations are made on our booking engine at book-directonline.com, operated by SiteMinder, which uses its own cookies and tracking under its own privacy policy.

When you click a button to our booking engine, our website keeps an anonymous note of the click: the time, how you reached our website (for example a search engine or an advertising campaign, but never an advertising click ID), the page and button, and the dates and number of guests you chose. No name, contact details, IP address, cookie or visitor ID is stored, so the note cannot be linked to you. We use it only to see which of our promotions lead to bookings, and it is kept whether or not you accept cookies because it contains nothing that identifies you.

Some pages show a YouTube video. Nothing is loaded from YouTube until you press play; the video then plays from youtube-nocookie.com under Google's privacy policy.

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, and unauthorised disclosure or access.

Payment card data is processed by PCI DSS-compliant third-party payment processors and is never stored on our servers.

While we take all reasonable precautions, no data transmission over the internet can be guaranteed to be 100% secure.

Our website may contain links to third-party websites including booking platforms, travel guides, and social media networks. We are not responsible for the privacy practices or content of those websites.

We encourage you to read the privacy policy of any third-party website you visit.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post the updated policy on this page with a revised effective date.

Continued use of our website following any changes constitutes your acceptance of the updated policy.

If you have any questions about this Privacy Policy or the way we handle your personal data, please contact us:

Holiday Resort Lombok

Jln. Raya Senggigi, Mangsit, Senggigi, NTB 83355, Lombok, Indonesia

Email: info@holidayresortlombok.com

Phone / WhatsApp: +62 821 4440 4046