SK Menkumham: AHU-0012891-AH.01.16 Tahun 2023 • NPWP: 61.849.201.5-305.000
Jl. Letda. Zainudin Aba No.26, Pangkal Lalang, Tanjung Pandan, Kabupaten Belitung, Kepulauan Bangka Belitung 33412
Privacy Policy
Our commitment to personal data protection pursuant to Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP).
Nusataway (CV. Satu Karya Muda) is dedicated to safeguarding your personal data privacy and security. This Privacy Policy sets forth how we collect, utilize, store, share, and protect information submitted when accessing nusataway.com and reserving our travel services.
Statutory Framework & Privacy Commitment
Personal data management across Nusataway services is subject to Republic of Indonesia Law No. 27 of 2022 on Personal Data Protection (UU PDP), relevant Electronic Systems and Transactions Regulations, and applicable statutory standards.
CV. Satu Karya Muda acts as the Data Controller determining the purposes and means of processing your personal data.
We pledge never to sell, rent, license, or monetize your personal information to third parties for external marketing purposes without your explicit consent.
Categories of Personal Data Collected
We collect only relevant, proportional, and necessary personal information required to execute your tour package reservations, including:
1. Identity & Manifest Registry Data:
- Full name as indicated on official government credentials (KTP / Passport / Driving License).
- National Identity Number (NIK) or Passport Number and nationality (required for mandatory Belitung Harbor Master / KSOP maritime safety manifests and hotel check-in registration).
- Date of birth and gender (required for underwriting standard travel insurance coverage).
2. Contact & Communication Records:
- Active cellular telephone and official WhatsApp number (for airport pickup handling and daily itinerary coordination).
- Valid email address (for delivering official invoices, booking confirmation vouchers, and travel advisories).
3. Technical & Travel Preference Specifications:
- Hotel room layout preferences (smoking / non-smoking, double / twin bed).
- Dietary restrictions, food allergies, or special mobility considerations voluntarily communicated to our concierge team.
- Automated website browsing technical logs, including IP addresses, browser specifications, pages visited, and load performance metrics.
4. Child & Minor Data Protection (UU PDP Article 25):
- Processing personal data of minors under 18 years of age (including full name, age, and family identity number) for geosite tickets, maritime insurance manifests, and hotel reservations is conducted STRICTLY with explicit consent and under direct accompaniment of lawful parents or guardians.
5. Visual Media & Traveler Likeness (Copyright Law Art. 12 & PDP Law):
- Photographic and video documentation captured by official Nusataway tour leaders or photographers during trip execution.
- Displaying traveler portraits on nusataway.com documentation galleries and official social channels is conducted pursuant to fair, ethical consent, and guarded under full copyright and official watermarks to deter third-party misappropriation.
- Guests retain the unconditional prerogative to request exclusion or prompt deletion of their likeness at any time via our expedited take-down mechanism.
Purposes of Personal Data Processing
Your personal data is processed on lawful grounds of contractual fulfillment and legitimate operational interest, namely:
1. Confirming tour package reservations, securing private island-hopping boat charters, and locking partner hotel reservations in Belitung.
2. Enrolling passenger names on the maritime safety manifest required by the Belitung Port Authority (KSOP) prior to boarding vessels to Lengkuas Island.
3. Facilitating registration of complimentary standard personal accident insurance coverage.
4. Dispatching booking confirmations, electronic receipts, designated guide contact details, and operational weather updates via WhatsApp and Email.
5. Complying with statutory corporate accounting audits, tax obligations, and legitimate government regulatory mandates in Indonesia.
Third-Party Data Disclosure to Trusted Partners
We disclose personal data to third parties solely to the minimal extent required to perform your trip services:
• Hotel & Resort Partners: Traveler names to execute room check-in reservations pursuant to issued vouchers.
• Boat Captains & Harbor Authorities (KSOP): Passenger safety manifest data required for maritime clearance.
• Regulated Payment Gateways: Credit card, Virtual Account, or QRIS transactions processed through Bank Indonesia-licensed payment processors with PCI-DSS encryption.
• Judicial & Law Enforcement Agencies: Only when strictly mandated by valid court summons or lawful Indonesian statutory proceedings.
Storage Security, Data Retention, & Cross-Border Transfers
All communications between your client device and our servers are encrypted utilizing modern Transport Layer Security (TLS 1.3 / 256-bit SSL).
Manifest and customer identity records are safeguarded within secure cloud repositories reinforced by Role-Based Access Control (RBAC) restricted strictly to authorized operations staff.
Travel passenger manifest records are retained for 12 (twelve) months following trip completion for internal auditing and potential insurance claim verification.
Commercial invoicing and financial transaction records are retained for 5 (five) years pursuant to Indonesian Tax Regulations, after which they are permanently and securely deleted.
Cross-Border Data Transfers (UU PDP Article 56): Nusataway's cloud hosting and computing infrastructure partners with globally recognized technology leaders (including Google Cloud, Microsoft Azure, Vercel, and Cloudflare, Inc.) that guarantee equivalent international standards of data encryption and security safeguards, including edge Content Delivery Network (CDN) acceleration and DDoS cyber-mitigation.
Data Breach Notification Commitment (UU PDP Article 46): In the unlikely event of an incident involving personal data security failure or data breach, Nusataway commits to issuing official written notifications to affected data subjects and statutory authorities within a maximum of 3 x 24 hours.
Rights of the Data Subject
Pursuant to the Indonesian Personal Data Protection Act (UU PDP), you are entitled to enforceable legal rights:
Data Subject Statutory Rights:
- Right to Information: Obtain transparent verification of data controller identity, legal basis, and specific processing purposes.
- Right of Access & Portability: Request an electronic copy of personal data retained in our databases.
- Right of Rectification: Correct, update, or rectify incomplete or inaccurate personal records.
- Right to Withdraw Consent: Revoke previously granted promotional communication permissions at any time.
- Right to Erasure & Media Take-Down: Request permanent deletion of your personal records once statutory audit requirements have lapsed, as well as submit an expedited take-down request to remove personal photographic likenesses from Nusataway public galleries and social channels within 24 business hours.
Data Protection Officer (DPO) Contact Channel
To exercise your statutory data rights, submit rectification requests, or lodge privacy questions, please contact our designated desk:
• Data Controller: CV. Satu Karya Muda
• Registered Address: Jl. Letda. Zainudin Aba No.26, Pangkal Lalang, Tanjung Pandan, Kabupaten Belitung, Kepulauan Bangka Belitung 33412
• Data Privacy Email: halo@nusataway.com
• Official WhatsApp Desk: +62 877-8808-4441
Our compliance officer will acknowledge and provide formal written determinations regarding verified data subject requests within 3 business days.
Inquiries Concerning Data Protection?
Reach our Data Protection Officer based in Tanjung Pandan, Belitung Island.