BestBaliTour's Privacy Policy

Last Updated: February 19, 2026 - Effective Date: February 19, 2026

Who we are

What this policy covers

This privacy policy explains how we (as data controller) collect and use personal data about:
- visitors to bestbalitour.com
- people who book or contact us

Quick summary

We respect your privacy. Our website does not load any analytics or advertising cookies until you provide consent through our cookie banner (powered by Cookiebot).
If you opt in, we may use Google Analytics 4, Google Ads, Microsoft/Bing Ads, and LinkedIn Ads cookies.
We do not sell your personal data.
You can change or withdraw cookie consent at any time via “Cookie Settings” on our site.

Account and profile: name, email, phone number, company details, VAT number, country.
Communications: emails or messages you send to support.
Billing references: purchase records from Stripe (we don’t store full card numbers).

Essential logs (no consent needed): IP address, device/browser info, pages visited in our app, timestamps, API usage, error and security logs. Used to run, secure, and troubleshoot the service.
Cookies and similar tech (consent-based):
- Analytics: Google Analytics
- Advertising/measurement (only if you opt in): Google Ads.

Provide and secure the service (create and manage your account, authenticate you, provide support, prevent fraud and abuse): contract and legitimate interests.
Payments and invoices (via Stripe): contract and legal obligation.
Service messages (e.g., account, security, product updates): contract/legitimate interests. You can opt out of non-essential marketing at any time.
Analytics (to understand usage and improve our website and app): consent (only after you opt in).
Advertising and measurement (to reach or measure audiences): consent (only after you opt in).
Legal, compliance, and security: legal obligation and legitimate interests.

We use Cookiebot to collect your consent before setting non‑essential cookies.
Categories:
- Necessary (always on; required for the site to work).
- Preferences (optional).
- Statistics/Analytics (optional); Google Analytics.
- Marketing/Advertising (optional); Google Ads.
Change/withdraw consent anytime: use the “Cookie Settings” link shown in our footer or cookie banner.
Your consent choices are logged by Cookiebot for compliance.

Sharing your data (processors and partners) We share personal data only with trusted service providers and only for the purposes above:

Hosting and infrastructure: Google Cloud Platform (EU regions), OVHcloud (EU data centers).
Consent management: Cookiebot by Usercentrics A/S.
Payments: Stripe.
Analytics/ads (only if you consent): Google Analytics, Google Ads.
Professional advisors and authorities: where required by law or to protect rights and safety.

We do not sell your personal data.

Primary storage and processing are in the EEA (EU regions of Google Cloud/OVHcloud).
Some providers may process data outside your country. When required, we rely on approved transfer tools (for example, Standard Contractual Clauses) and apply data‑minimization measures.

Account data: while your account is active. If you delete your account, we delete personal data; we keep billing records as required by law.
Support communications: typically up to 24 months after the last interaction.
Essential logs (security/operations): typically up to 12 months.
Cookie consent logs (Cookiebot): typically up to 12 months.
Analytics data (GA4): retained only if you consent; we aim for a 14‑month retention setting unless we state otherwise in our Cookie Declaration.

Cookies: change or withdraw consent via “Cookie Settings” at any time.
Email preferences: you can opt out of marketing emails from any marketing message we send.
Access, correction, deletion, portability, and restriction/objection (GDPR/UK GDPR/Swiss FADP): contact@bestbalitour.com and we will respond without undue delay.
Singapore PDPA: you can request access and correction of your personal data; contact us at contact@bestbalitour.com.
California (CPRA): we do not sell personal information. If you consent to Marketing cookies, we may “share” data for cross‑context behavioral advertising via ad tags. You can opt out anytime by turning off Marketing cookies in “Cookie Settings.” Where supported, we honor browser signals like Global Privacy Control (GPC) as an opt‑out of sale/sharing.
If we act as your processor (verification data you upload), please use your account tools or contact us per the DPA; we will act on your instructions.

When you connect and use third-party messaging channels (such as Facebook Pages, Instagram accounts, or WhatsApp Business accounts), we may process:

We process this data solely to provide you with messaging management services, including:

We do not use message content for advertising purposes.

We use encryption in transit, access controls, secure hosting, logging and monitoring, backups, and other safeguards. No system is 100% secure, but we work to protect your data and review our controls regularly.

Our services are not directed to children. Do not use our sites or submit personal data if you are under 13 (or under 16 in the EEA) without proper consent.

Our website may link to other sites. Their privacy practices are their own. Please review their policies.

We may update this notice. We will post the new date above and, for material changes, we will also notify you in‑app or by email.