Privacy policy.

Who looks after your information

Banyak Surf Villas is operated by PT BANYAK SURF VILLAS, Indonesia. Our registered business address is Kepulauan Banyak, Pulau Baguk, Pulau Banyak, Aceh Singkil, Aceh 24791, Indonesia.

For privacy questions or requests, email bookings@banyaksurfvillas.com.

What we collect

When you enquire, we collect your name, email address and telephone number, including your country calling code. You can also provide preferred dates, length of stay, group size, occasion, surfing experience and a message. When you book or contact us, we keep the correspondence and trip information needed to help arrange your stay.

Please only share information about other guests when you have their permission. Avoid sending passports, payment-card details or sensitive medical information through the enquiry form.

Our hosting and security services also process technical information such as IP addresses, browser and device information, request times and security logs to deliver the website and prevent abuse.

How we use it

• Answer your questions and send the automatic enquiry acknowledgement.
• Discuss availability, arrange bookings and coordinate your stay, meals and transfers.
• Keep appropriate business records, resolve issues and meet applicable obligations.
• Protect the website from spam and understand which pages visitors use.

We use information to respond to your request, provide agreed services, operate and protect our business, and meet legal obligations. Where consent is required, we ask for it and you can withdraw it.

Email updates and your choices

Submitting an enquiry does not automatically add you to our marketing list. Where you have agreed to receive offers or news, we use your contact details to send those updates. You can unsubscribe using the link in a marketing email or ask our bookings team to remove you.

Unsubscribing from offers does not stop necessary replies about an enquiry or an existing booking.

Who receives information

Our team uses your information to help with your enquiry and stay. We share relevant details with people arranging your accommodation, meals or transfers where needed to deliver your booking.

We use Vercel for website hosting and analytics, Resend for enquiry emails and marketing contacts, and Google Workspace for our bookings mailbox. These service providers process information to provide their services. If you contact us on WhatsApp, that conversation is also handled by WhatsApp under its own privacy terms.

These providers may process information outside Indonesia. We use service-provider arrangements and safeguards appropriate to the information and applicable law. We do not sell your personal information. We may disclose information when required by law or to protect legitimate rights and safety.

Website analytics, storage and other services

We use Vercel Web Analytics to understand visits and page usage. It uses a temporary request-derived identifier rather than third-party analytics cookies. Our enquiry form fields are not sent as custom analytics events.

The photo-review library saves selections and tags in your browser’s local storage. Those choices are shared only when you use the review-link or export tools. Clearing browser storage removes locally saved choices.

Google Fonts receives a request when fonts load. YouTube films connect to YouTube’s privacy-enhanced player when you choose to play them; YouTube may then process information and use storage under its own policies. Links to Google reviews, social media and WhatsApp take you to services with their own privacy policies.

Retention and security

We retain enquiry and booking information for as long as needed to respond, provide services, keep required business records and resolve disputes. Marketing details are retained until you unsubscribe or ask for removal; a limited suppression record may remain so we can respect that choice.

The website uses HTTPS. Our enquiry service uses validation and anti-spam limits, and business messages are handled through our service-provider accounts. No internet transmission or storage system can be guaranteed completely secure.

Your rights and contacting us

Depending on the law that applies to you, you may ask to access, correct or delete your information, restrict or object to its use, receive a copy, or withdraw consent. Contact our bookings team and we will respond in accordance with applicable law. We may need to confirm your identity before acting on a request. You may also contact the relevant data-protection authority.

Adults should handle enquiries for family trips. We do not knowingly collect information directly from children for marketing. If a child has submitted information, please contact us so we can review and remove it where appropriate.

We may update this policy when our services or information practices change. The date above shows the latest version.