Политика конфиденциальности

What we receive with a request

Date and time, party size, name, email, WhatsApp number, your comment, and the language of the page you wrote from. We also record the moment you ticked the consent box.

Allergies and religious restrictions

You may add allergies and religious restrictions to a request. Under data protection law this is sensitive data, so we treat it apart: stored separately from the rest of the request, deleted sooner, kept out of any analytics, and never shown to contractors. It is passed to the kitchen so your table is safe - that is its only use.

Why we process it

To answer your request and confirm the table by email. The legal ground is your consent - the box you tick before sending.

Where it lives and who sees it

The request is stored on our own server. The notification to our team is delivered by email through Google Workspace, which acts as our processor.

If you accept advertising cookies, three more companies receive something from your browser: Google (Google Ireland Ltd, and Google LLC in the United States), Meta (Meta Platforms Ireland Ltd) and Yandex (Yandex LLC, Russia). What they get is described in "Cookies and your browser" below - page addresses, cookie identifiers and events, never your name, email, phone, allergies or religious notes. We do not sell your data.

How long we keep it

No longer than needed to handle requests; allergy and religious notes are deleted before the rest of the request. A request is kept 365 days from the day you send it, allergies and religious notes 180 days, the notification email to our team 365 days. After that the rows are deleted, not archived.

Cookies and your browser

A banner asks you about cookies when you first open the site. Until you answer it, nothing from another company loads: no advertising tag, no analytics, no fonts, maps or videos from anywhere else.

There are two answers. "Accept all" turns on advertising cookies from Google, Meta and Yandex. "Only necessary" turns nothing on and means the same as not answering at all.

Your answer is kept in your browser for six months. It never reaches our server and is not part of your request. Clear your browser data and the banner asks again.

To change your mind, use the "Cookie settings" link at the bottom of any page: it opens the same banner with your current answer.

If you accept advertising, up to three tags load, each one only if we have a key for that account: Google Ads (Google Ireland Ltd, and Google LLC in the United States), Meta Pixel (Meta Platforms Ireland Ltd) and Yandex Metrica (Yandex LLC, Russia). They receive the address of the page you are on, cookie identifiers from your browser, and events with no name behind them: menu viewed, dish viewed, QR code scanned, link followed, request sent. Your name, email, phone, allergies and religious notes are never sent to them, their "advanced matching" features are switched off, and Yandex Metrica records neither your screen nor your clicks.

These companies process that data outside Indonesia, in the European Union, the United States and Russia, under their own rules: policies.google.com/privacy, facebook.com/privacy/policy and yandex.com/legal/confidential.

Four small scripts of our own run whether you answer or not, and none of them sets a cookie. The banner script keeps your answer, the tag script stays idle until you accept advertising, and the other two act only when you do: one remembers where you were on the page when you switch language; the other keeps what you typed in the request form if a field comes back for correction. Both write only inside your browser tab (sessionStorage), never to our server, and both disappear when you close the tab.

Links to Google Maps, WhatsApp or Instagram open only when you tap them, and then you are on their site, under their rules.

Clicks from ads

An ad brings you to the site with a tag in the address of the page - gclid, fbclid or utm. If you then send a request, that tag is stored next to it, apart from your name and contacts.

If you accepted advertising cookies, the tag is also kept inside your browser tab while you move between pages, so a request sent from another page still carries it. It never reaches our server on its own and disappears when you close the tab; answer "Only necessary" and nothing is kept at all.

It has one use: to tell Google that a request came from an ad. We match it by the click identifier alone, without your name, email or phone. A tag is kept 180 days and then deleted - sooner than the request it came with.

What the server records

Our web server keeps an ordinary access log: IP address, moment, page asked for, and the browser line. It exists to keep the site running and to stop abuse, and it is not tied to your request. We keep it 90 days, then it is deleted.

From that log we count daily totals - pages, languages, devices, QR scans - and keep the counts. There is no line about you in them.

Your rights

Ask what we hold about you, have it corrected, or have it deleted - one email to reservations@teamobali.com is enough. We answer from the same address.

Law

We operate in Indonesia and follow its personal data protection law (UU PDP). If you write from the EU, your GDPR rights stand as well.