Privacy Policy

Aventuro Tour ("we", "us", or "our") operates private tours, customized travel itineraries, and cultural and outdoor expeditions across Indonesia, including Yogyakarta, Central Java, Bali, East Java, and volcano trekking regions (Mount Merbabu, Mount Batur, Mount Bromo, and Kawah Ijen).

For the purposes of applicable data protection legislation — including the Indonesian Personal Data Protection Law (Undang-Undang Republik Indonesia Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi / UU PDP) and, where applicable, the General Data Protection Regulation (EU Regulation 2016/679 - GDPR) — Aventuro Tour acts as the Data Controller responsible for determining the purposes and means of processing your personal data.

This Privacy Policy applies to all personal information collected via our website (https://aventurotour.com), through our WhatsApp customer support channels, via electronic mail, or in-person during the execution of our travel services.

Depending on the specific services you inquire about or book, we may collect and process the following categories of personal information:

• Identity Data: Full legal name (matching your government passport or KTP), gender, date of birth, and nationality. Why this is required: Indonesian national heritage and conservation bodies (such as Balai Konservasi Borobudur, Balai Besar Taman Nasional Bromo Tengger Semeru / BBTNBTS, and Balai Besar Konservasi Sumber Daya Alam / BBKSDA Jawa Timur for Kawah Ijen) mandate official visitor identification to issue timed-entry passes and climber permits.
• Contact Data: Primary email address, mobile phone number (with active WhatsApp for operational coordination), and residential address or country of residence.
• Travel & Logistics Data: Flight arrival and departure numbers, pickup hotel details in Yogyakarta, Surabaya, Malang, or Bali, drop-off destinations, and names of accompanying travel companions.
• Health, Fitness & Dietary Disclosures (Special Category Data): For physically demanding itineraries — including sunrise trekking on Mount Merbabu (3,145m), Mount Batur, and the Kawah Ijen crater rim (with potential volcanic sulfur gas exposure) — we request voluntary disclosures regarding respiratory conditions, cardiovascular health, or mobility limitations. We also collect dietary requirements (vegetarian, vegan, gluten-free, halal, or severe food allergies) to ensure meal arrangements with local providers are safe.
• Financial & Payment Data: Credit/debit card billing addresses and transaction verification tokens. All payments are processed through PCI-DSS compliant payment gateways (such as Midtrans and WooCommerce). Aventuro Tour does not store raw credit card numbers, CVVs, or cardholder banking passwords on our local servers.

We obtain your personal data through several transparent touchpoints:

• Direct Interactions: You provide details directly when you submit a tour reservation through our website checkout, complete an itinerary inquiry form, contact our team via WhatsApp or telephone, or correspond with us via email.
• Automated Technologies: As you navigate our website, our web servers collect standard technical log data (including your IP address, browser type, operating system version, referring URLs, and pages viewed) using cookies and anonymous session tokens to ensure website stability, speed, and language preferences.
• Third-Party Travel Partners: When a travel agent, corporate partner, or family member makes a group booking on your behalf, they warrant that they have obtained your explicit authorization to share your details with Aventuro Tour.

Under the Indonesian PDP Law (UU No. 27/2022) and international data protection standards, we process your personal information only when we have a legitimate legal ground:

• Contractual Performance (Fulfilling Your Tour): Processing is necessary to execute your travel agreement: scheduling private air-conditioned vehicles, assigning licensed English-speaking drivers, securing temple climbing slots, and booking local accommodations.
• Legal & Regulatory Obligations: Compliance with statutory Indonesian tourism permits, transport manifests, fiscal invoice reporting, and immigration reporting required by local authorities.
• Vital Interests & Emergency Response: In the rare event of a medical emergency, volcanic activity alert, or altitude sickness during a trekking expedition, we may share relevant health disclosures and emergency contacts with medical responders and mountain rescue units (SAR).
• Legitimate Commercial Interests: Monitoring website performance, fraud prevention during payment checkout, and continuously improving tour quality based on post-trip feedback.
• Explicit Consent: Sending promotional updates, travel guides, or special seasonal discounts via email newsletter (which you can opt out of at any time).

To deliver seamless private travel experiences across Indonesia, Aventuro Tour coordinates with verified local service providers on a strict "need-to-know" basis:

• Licensed Tour Guides & Local Drivers: We provide your primary name, pickup hotel room, flight arrival time, and chosen language preference to your assigned licensed English-speaking guide (certified by Himpunan Pramuwisata Indonesia / HPI) and private driver.
• Community Transport Cooperatives: For off-road journeys, we coordinate with local driver cooperatives — including the Paguyuban Jeep Bromo (BBTNBTS) and Paguyuban Jeep Merapi Lava Tour — providing party size and voucher manifests.
• National Parks & Conservation Offices: Passenger manifests including names, ages, and passport/KTP numbers are submitted to official ticketing portals for Balai Konservasi Borobudur, Taman Nasional Bromo Tengger Semeru, and Balai Konservasi Sumber Daya Alam (Kawah Ijen).
• Technology & Infrastructure Providers: Highly vetted cloud hosting providers, transactional email servers, and certified payment gateways that maintain rigorous enterprise security standards.

Our Strict Non-Sale Guarantee: Aventuro Tour has never sold, rented, leased, or traded personal traveler data to any third party for commercial marketing, and we will never do so.

We implement robust technical and organizational security measures to protect your personal information from unauthorized access, accidental alteration, loss, or disclosure:

• Encryption in Transit: All data transmitted between your browser and our website is protected using industry-standard Transport Layer Security (TLS 1.3 / SSL 256-bit encryption).
• Access Controls & Least Privilege: Operational staff access traveler booking data strictly on a need-to-know basis. Internal administration requires multi-factor authentication (MFA) and encrypted session controls.
• Secure Cloud Infrastructure: Our databases and digital assets are hosted on secured server environments with regular automated vulnerability scans, firewall protection, and isolated database clusters.
• Physical Safety: Paper forms and operational manifests used during field operations are securely shredded once trip reconciliation is completed.

We retain personal information only for the period necessary to fulfill the specific purposes outlined in this Privacy Policy:

• Active Booking & Tour Execution Data: Retained throughout the duration of your travel planning, tour execution, and for up to 90 days post-tour to facilitate feedback and customer care inquiries.
• Statutory Financial & Tax Records: In accordance with Indonesian Law (Undang-Undang Ketentuan Umum dan Tata Cara Perpajakan) and Indonesian corporate accounting standards, invoice records, transaction references, and fiscal receipts must be maintained for a statutory period of 5 (five) to 7 (seven) years.
• National Park Manifest Records: Park climbing permits and permit correspondence are archived for up to 12 months for compliance auditing, after which they are permanently expunged.
• Marketing Subscriptions: Maintained until you unsubscribe or withdraw your consent, which is processed immediately upon request.

Our website utilizes cookies — small text files stored on your device — to optimize your digital experience:

• Essential Functional Cookies: Required for the fundamental operation of our website, including managing your tour booking session, preserving your language preference (EN / ID), and maintaining security nonces.
• Performance & Analytics Cookies: We utilize Google Analytics with anonymized IP masking to evaluate aggregate visitor behavior, popular destination views, and mobile browsing speeds. These cookies do not identify you individually.
• Managing Cookies: You have the right to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser settings to decline non-essential cookies. Please note that disabling essential cookies may impact certain interactive features on our booking portal.

Under the Indonesian Personal Data Protection Act (UU No. 27/2022) and international privacy frameworks, you possess comprehensive legal rights regarding your personal information:

• Right of Access & Information: You have the right to obtain confirmation as to whether we process your personal data, and to receive a clear copy of the data held.
• Right to Rectification: You may request the immediate correction or completion of inaccurate or outdated personal information (such as an updated passport number or flight schedule).
• Right to Erasure ("Right to be Forgotten"): You can request that we delete or permanently de-identify your personal data once the tour has completed, provided the data is no longer required for statutory Indonesian tax or accounting compliance.
• Right to Restrict or Object to Processing: You have the right to request that we restrict the processing of your data under certain circumstances (such as contesting accuracy or objecting to direct marketing).
• Right to Data Portability: You may request to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Withdraw Consent: Where processing is based on your consent (such as promotional newsletters), you may withdraw your consent at any time without affecting the lawfulness of prior processing.

If you have questions, feedback, or wish to formally exercise any of your privacy rights, please contact our dedicated Data Protection team:

• Data Protection Officer (DPO) Email: privacy@aventurotour.com
• Customer Support Email: booking@aventurotour.com
• WhatsApp Data Protection Hotline: +62 812-3456-7890
• Operational Headquarters: PT Aventuro Tour Indonesia, Daerah Istimewa Yogyakarta, Indonesia.
• Response Timeframe: We acknowledge all formal data subject requests within 72 hours and complete verification and resolution within 30 days, in full compliance with Indonesian PDP legislation.