Privacy policy

Who we are

Tropical Bali Retreats is an Australian business. ABN [[NEEDS INPUT: ABN]]. Our address is [[NEEDS INPUT: Australian business address]]. We run small-group, all-inclusive holidays to Bali for guests departing from Australia.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. [[NEEDS INPUT: confirm with the solicitor whether the business is an APP entity, given the small business exemption and annual turnover]] Either way, we follow the Principles as a matter of course. This policy sets out how.

What we collect

We only collect what we need to answer you and to run your trip. Depending on how you deal with us, that can include the following.

When you send an enquiry

• Your name, email address and phone number.
• Which package you're interested in and the month you'd like to travel.
• Who is travelling with you, including the ages of any children.
• Anything you choose to tell us in the notes, such as mobility, dietary needs, or that you're celebrating something.

When you download the Itinerary Pack or join The Bali Letter

• Your first name and email address. Nothing else.

When you book

• Full names as they appear on passports, dates of birth and passport details, so we can book flights and hotels.
• Your home address and an emergency contact in Australia.
• Health information you choose to share: mobility, medical conditions, medications, allergies and dietary requirements. This is sensitive information and we only collect it with your consent, so that we can look after you properly on the trip.
• Travel insurance policy details, because insurance is compulsory on our trips.
• Payment details, which are handled by our payment provider. We do not store full card numbers.

When you use the website

• Basic technical information such as your browser, device and the pages you visit. We only collect this through analytics tools if you accept cookies (see the cookies section below).
• Information you send through our contact forms, along with the time it was sent, which we use to filter out spam.

When you phone or message us

• What you tell us on the phone, by WhatsApp or by email. We keep notes so you never have to repeat yourself.

Why we collect it

We use your personal information to:

• answer your enquiry and talk you through which trip fits;
• send you the Itinerary Pack or The Bali Letter, if you've asked for them;
• book and manage your trip, including flights, accommodation, transport and activities;
• look after your health, safety and comfort while you're travelling with us;
• contact you or your emergency contact if something goes wrong;
• process payments and refunds;
• meet our legal obligations, such as tax and record-keeping;
• understand how people use the website so we can improve it.

We don't sell your information to anyone, and we don't rent our mailing list out. We never will.

Who we share it with

Running a trip means a few other people need some of your details. We share only what each one needs to do their part.

• Airlines, hotels and transport providers, to make your bookings. They need passport names, dates of birth and sometimes dietary needs.
• Our local guides and drivers in Bali, who need your first name, and any mobility or dietary notes that affect how a day is run.
• Bali Sunny Kids, our childcare partner, for family bookings only. They receive children's names, ages, allergies and any care notes, plus a parent's phone number.
• Our email provider and customer database (CRM), which store your details so we can reply to you and keep track of your booking. [[NEEDS INPUT: names of the email and CRM providers used]]
• Our payment provider, which processes deposits and balances. [[NEEDS INPUT: name of the payment provider]]
• Analytics providers (Google Analytics and Meta), only if you accept cookies.
• Medical providers and your travel insurer, if you need care while travelling and it's in your interest for us to pass on your details.
• Government agencies, where the law requires it, such as for border processing or a lawful request.

Sending your information overseas

Because your holiday is in Indonesia, some of your information has to go there. Hotels, transport companies, our guides and Bali Sunny Kids are in Bali. Airlines may process your details in the countries they operate in.

Indonesian privacy law is different from Australian law. Before we send anything overseas, we limit it to what the recipient actually needs, and we work only with businesses we know and deal with directly. By booking with us, you consent to your information being sent overseas for these purposes.

Some of our software providers, such as email, database and analytics tools, store data on servers outside Australia, including in the United States. [[NEEDS INPUT: confirm the countries where each provider stores data]]

Cookies, analytics and consent

When you first visit the site you'll see a cookie notice with two choices: accept all, or essential only. We don't load Google Analytics or the Meta Pixel until you accept all. If you choose essential only, no analytics or advertising cookies are set.

Essential cookies and browser storage are used only to remember your cookie choice and to stop the same message showing you twice in one visit. They don't identify you.

You can change your mind at any time by clearing your browser's site data, which will bring the cookie notice back. Analytics data is used in aggregate to see which pages are useful. Advertising data may be used to show you our ads on other sites and to measure whether those ads work.

How we store and protect it

Your information is stored in password-protected systems with two-factor sign-in where the provider offers it. Access is limited to the people who need it to do their job. Paper copies of passport details for a trip are kept only while the trip is running, then destroyed.

We keep booking records for as long as the law requires, which is generally seven years for financial records. Enquiry details that don't lead to a booking are kept for [[NEEDS INPUT: retention period for enquiries, e.g. two years]] and then deleted. Health information is deleted once it's no longer needed for a trip, unless you ask us to keep it for a future booking.

No system is perfectly secure. If we ever have a data breach that is likely to cause you serious harm, we'll tell you and the Office of the Australian Information Commissioner as the law requires.

Seeing and correcting your information

You can ask to see the personal information we hold about you at any time. Email or ring us using the details below. We'll usually send it within 30 days, and we don't charge for this. If something is wrong or out of date, tell us and we'll fix it.

You can also ask us to delete your information. We'll do that unless we're required by law to keep it, for example booking and payment records. If we can't delete something, we'll tell you why.

Marketing emails and unsubscribing

If you download the Itinerary Pack, you'll receive a short series of follow-up emails about our trips. If you join The Bali Letter, you'll get one email a month. Every email has an unsubscribe link at the bottom, and it works the first time. You can also reply to any email and ask to be taken off, or ring us.

We don't send text-message marketing. If you enquire, we may phone or message you about that enquiry, but that's a conversation, not a campaign.

Complaints

If you think we've handled your information badly, please tell us first. Email [[NEEDS INPUT: email address]] or ring [[NEEDS INPUT: phone number]] during business hours, Monday to Friday, 9am to 5pm AEST. We'll acknowledge your complaint within a few days and aim to resolve it within 30 days.

If you're not happy with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

Changes to this policy

We'll update this policy if our practices change or the law does. The date at the top tells you when it was last changed. If a change is significant, we'll let existing guests know by email.

How to contact us

• Email: [[NEEDS INPUT: email address]]
• Phone: [[NEEDS INPUT: phone number]]
• Hours: Monday to Friday, 9am to 5pm AEST
• Post: Tropical Bali Retreats, [[NEEDS INPUT: Australian business address]]

This is a draft for review by an Australian solicitor before publication. [[NEEDS INPUT: legal review]]