Privacy Policy

Privacy Policy

1. Introduction

Welcome to Dikaloha Surfcamp & SurfSchool (“we,” “our,” “us”).
We value your trust and are committed to protecting your personal information.
This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit our website. make a booking, or participate in our services.

By using our website or booking our services, you agree to the terms of this Privacy Policy.

2. Information We Collect

We collect personal information necessary to provide accommodation, surf lessons, yoga sessions, and related travel services safely and effectively.
The types of data we may collect include:

a. Personal Information

• Full name

• Email address

• Phone number or WhatsApp contact

• Nationality and country of residence

• Date of birth (for age verification in surf lessons)

• Passport or ID details (for check-in purposes)

b. Booking & Payment Information

• Dates of stay, room type, and package details

• Payment method and transaction details

• Special requests (dietary preferences, surf level, medical conditions)

c. Technical & Usage Data

• IP address and browser type

• Device information and language settings

• Pages visited, time spent on site, and referring URLs

• Cookies and similar tracking technologies (see section 9)

d. Optional Information

• Feedback or testimonials

• Photos or media voluntarily shared for promotional purposes

3. How We Use Your Information

We use your information only for legitimate purposes related to your stay and experience at Dikaloha.

Your personal data may be used for:

1. Booking management: to confirm reservations, issue invoices, and communicate booking details.

2. Customer service: to provide assistance, respond to inquiries, and ensure your comfort during your stay.

3. Surf & yoga program coordination: to tailor lessons to your skill level, health condition, or preferences.

4. Marketing (optional): to send updates, special offers, or newsletters — only if you have given consent.

5. Legal compliance: to meet local regulations, taxation, and safety requirements.

6. Website improvement: to enhance user experience and optimize content.

We never sell or share your personal information for profit or unauthorized use.

4. Legal Basis for Processing (GDPR Compliance)

If you are a resident of the European Economic Area (EEA), our legal basis for collecting and using your personal data depends on the context in which it is collected:

• You have given consent for specific purposes (e.g., newsletter subscription).

• Processing is necessary for the performance of a contract (e.g., booking confirmation).

• Processing is necessary for legitimate interests, such as improving our services and marketing communication.

• We have a legal obligation to retain certain records (e.g., local tourism or taxation requirements).

5. How We Store and Protect Your Data

We use secure systems to protect your personal data against unauthorized access, loss, or misuse.

• All booking data is stored in password-protected systems accessible only by authorized staff.

• Online payments are processed via secure, encrypted payment gateways.

• We regularly review data-handling policies and maintain strict confidentiality among all employees.

• Personal data is retained only as long as necessary to fulfill the purposes described in this policy.

Once the data is no longer needed, it is securely deleted or anonymized.

6. Data Retention

We retain your information only for as long as it’s required to:

• Complete your booking and provide services.

• Comply with legal, accounting, or tax obligations.

• Maintain customer relationship records for a limited time (up to 24 months) after your stay.

You may request deletion of your personal data at any time (see section 8).

7. Sharing of Information

We respect your privacy and only share your data when necessary to operate our services:

• Service providers: such as payment gateways, insurance partners, or transport companies assisting in your booking.

• Legal authorities: if required by Indonesian law (e.g., immigration reporting).

• Marketing partners: only when you have provided explicit consent (e.g., newsletter or testimonials).

We never sell or rent your data to third parties.

8. Your Rights

Depending on your location and applicable laws (e.g., GDPR, PDPA, Indonesian Privacy Regulation), you have the right to:

1. Access – request a copy of your personal data we hold.

2. Correction – update or rectify incorrect or incomplete information.

3. Deletion (“Right to be Forgotten”) – request removal of your data when it’s no longer needed.

4. Restriction – limit how your data is processed.

5. Data Portability – obtain a copy of your data in a machine-readable format.

6. Withdraw Consent – opt-out of marketing emails or data collection at any time.

You can exercise these rights by contacting us at privacy@dikaloha.com.

9. Cookies & Tracking Technologies

Our website uses cookies to improve user experience and site performance. Cookies are small text files stored on your device that help us:

• Remember your preferences (language, region, etc.)

• Analyze site traffic and optimize design

• Track marketing performance anonymously

You can disable cookies in your browser settings, but certain site features may not function properly as a result.

We do not use cookies to collect personal or financial information.

10. Marketing Communications

From time to time, we may send emails about promotions, surf packages, or upcoming retreats.
You will only receive these communications if you have subscribed voluntarily.

You may unsubscribe at any time using the link provided in the email or by contacting us directly.

11. Links to Other Websites

Our website may contain links to third-party websites (e.g., surf schools, booking partners, travel agencies).
We are not responsible for the privacy practices or content of those websites.
We encourage you to review their Privacy Policies before providing any personal data.

12. Children’s Privacy

Our services are not intended for children under the age of 13 without parental consent.
We do not knowingly collect personal data from minors.
If we discover such information has been provided without consent, we will delete it immediately.

13. Updates to This Policy

We may update this Privacy Policy from time to time to reflect legal requirements, operational changes, or improvements to our services.
The latest version will always be available on our website, and the “Last Updated” date will be revised accordingly.