Here is the Komodo Cruise privacy policy in brief. Juara Holding Group publishes komodocruise.com, and Komodo Luxury runs its cruise desk. We only collect what you send us by WhatsApp or email, plus basic website analytics. We use it to quote, book and register your Komodo cruise, and we never sell personal data.
Last updated: 16 September 2026. This policy covers komodocruise.com and any inquiry that starts from it.
Who is responsible for your personal data?
Two organisations handle your data, each at a different stage:
- Juara Holding Group publishes this website. It controls website, analytics and first-inquiry data.
- Komodo Luxury runs the Komodo Cruise desk. It was founded in 2015 in Labuan Bajo, and its reservations team handles bookings directly. Once you ask for a confirmed booking, Komodo Luxury controls your booking, payment and manifest data.
You don’t need to work out which one to contact. Both can be reached at one address: sales@komodoluxury.com, or WhatsApp +62 811-3823-875 (wa.me/628113823875).
Which laws does this policy follow?
We process personal data under Indonesia’s Personal Data Protection Law, Undang-Undang No. 27 Tahun 2022 (UU PDP). It was enacted on 17 October 2022, and compliance has been mandatory since 17 October 2024. We also follow Government Regulation 71 of 2019 on electronic systems.
Many of our guests come from the EU, the UK and other places with similar laws. For them, we follow the main GDPR principles: a clear purpose for each use, collecting as little as possible, limited retention, and rights you can actually use.
What personal data do we collect?
| Category | Examples | How it reaches us |
|---|---|---|
| Inquiry details | Name, WhatsApp number, email, travel dates, guest count, cruise type (3D2N share trip, private phinisi, day or sunset cruise) | You send it by WhatsApp or email |
| Booking details | Names of all guests, nationality, cabin choice, Labuan Bajo hotel for pickup | You provide it when you confirm |
| Park registration data | Full name as in passport, passport number, date of birth, nationality | Needed for operator manifests |
| Health and safety notes (optional) | Allergies, mobility limits, swimming ability | Only if you choose to share them |
| Payment records | Invoice, amount, payment reference | Created during booking |
| Technical data | Device type, browser, pages viewed, referring site, approximate location | Cookies and analytics |
We never ask for full card numbers, CVV codes or online banking passwords over WhatsApp or email. Anyone who asks for them in our name is not us.
Health notes count as specific personal data under UU PDP. We process them only with your explicit consent, and only so the crew can keep you safe on board.
Why do we use your data, and on what legal basis?
| Purpose | Legal basis (UU PDP Art. 20; GDPR Art. 6 equivalent) |
|---|---|
| Sending a quote, e.g. a 3D2N share cabin from USD 300 per person or a private charter priced per vessel (as of 2026) | Steps you asked for before a contract |
| Passing your booking to the Komodo Luxury reservations team and crew | Performing the contract |
| Submitting passport details for Komodo National Park pre-registration | Legal obligation |
| Keeping invoices and tax records | Legal obligation |
| Measuring which pages help visitors plan a cruise | Consent or legitimate interest |
| Sending departure updates or offers | Only if you opt in; you can withdraw any time |
Reports say Komodo National Park has used digital pre-registration with passport details since 2026. Operators submit these details through manifests, and walk-in entry is not reliable. So we cannot confirm a place on board without them. Please check the current rules with the desk before you travel.
How long do we keep your data?
| Data | Retention |
|---|---|
| Inquiries that never became a booking | Up to 24 months, then deleted |
| Booking records and invoices | 10 years, as Indonesian tax bookkeeping rules require |
| Passport numbers and scans | Deleted within 90 days after your trip ends, unless an authority asks us to keep them longer |
| Health and safety notes | Deleted after disembarkation |
| Analytics data | Up to 14 months, in aggregated form |
Do we use cookies?
Yes, but only a few. Essential cookies keep the site secure and working. Analytics cookies, from a service such as Google Analytics, tell us which cruise pages people read, like the 4D3N itinerary or the vessel comparisons.
You can block or delete cookies in your browser settings. Blocking analytics does not stop you from reading the site or messaging the desk.
Who else sees your data?
We share data only as far as each purpose needs:
- Komodo Luxury reservations staff and vessel crew. They see names, cabin choice, dietary needs and safety notes.
- Komodo National Park authorities and the Labuan Bajo harbourmaster (KSOP). They receive manifest data as the regulations require.
- WhatsApp (Meta). Meta processes your messages and their metadata under its own privacy policy.
- Email, hosting, content delivery and security providers, such as Cloudflare. They store or route data on our behalf.
- Analytics providers. They receive technical data, not passport or booking details.
- Partner hotels in Labuan Bajo. They receive data only if you book a “tour with hotel” bundle.
We do not sell, rent or trade personal data, and we do not share it with advertisers as lists.
Is your data transferred outside Indonesia?
It can be, because some cloud and messaging providers store data abroad. UU PDP Article 56 says the receiving country or provider must protect it at least as well as Indonesian law does. For visitors from the EEA or UK, we rely on our providers’ recognised safeguards, such as standard contractual clauses.
What rights do you have?
Under UU PDP, with matching rights under GDPR, you can:
- Know who processes your data and why
- Access your data and get a copy
- Correct details that are wrong or incomplete
- Delete data we no longer need, or data we hold without a valid basis
- Withdraw consent, for example for marketing or analytics
- Object to decisions made only by automated processing
- Restrict processing while a complaint is looked at
- Receive your data in a common format so you can move it elsewhere
- Claim compensation if we break the law in handling your data
To make a request, email sales@komodoluxury.com with the subject line “Privacy request”, or message the desk on WhatsApp. We confirm who you are with your booking reference and the contact details you used. Please never send a passport scan just to prove your identity.
UU PDP sets short deadlines for some requests. We aim to meet them. If you are not satisfied with our answer, you can complain to the data protection authority set up under UU PDP. EEA and UK residents can also go to their local supervisory authority.
How do we protect passport and booking data?
- Only reservations staff who prepare manifests can see passport details
- Passport scans are never posted in group chats or shared with other guests
- Manifest files are deleted on the schedule in the retention table above
- If a data breach affects you, we notify you and the authority in writing within 3 × 24 hours, as UU PDP Article 46 requires
You can help too. Send passport details to the desk directly, not in a shared group chat with fellow share-trip guests.
What are the limits of our responsibility for bookings?
This policy is about privacy, but a few booking terms affect what you can rely on:
- Prices are indicative, as of 2026. The 3D2N open trip starts from USD 300 per person, and weekday open trips from USD 220 per person. A price is only binding once Komodo Luxury confirms it in writing.
- Private charters are priced per vessel. Prices depend on the vessel, the duration and the number of guests, and never per person.
- Park fees are extra. Komodo Luxury guidance is USD 40–50 per person, paid once per trip.
- Nature and regulators decide some things. We cannot guarantee dragon or manta sightings, calm seas or exact routes. Reports say a daily cap of about 1,000 visitors has applied since 1 April 2026, and tourist boats face restrictions after dark in higher-risk park zones. Both can change an itinerary.
- Third parties set their own terms. This includes flights from Denpasar (DPS) to Labuan Bajo (LBJ), WhatsApp, and any sites we link to.
Your booking confirmation sets out the cancellation and refund terms. Those terms take priority over any general website text.
Do we collect data from children?
This site is not aimed at anyone under 18. A parent or guardian must provide and consent to a minor’s passport and booking details. That covers both the manifest and the booking, as UU PDP requires.
How will changes to this policy be announced?
When we update this policy, we change the date at the top of this page. For bigger changes, such as a new purpose or a new type of recipient, we will also tell guests with active bookings by email or WhatsApp.
How do I contact the privacy desk?
- Email: sales@komodoluxury.com (subject: “Privacy request”)
- WhatsApp: +62 811-3823-875, wa.me/628113823875
Website publisher: Juara Holding Group. Cruise desk and reservations: Komodo Luxury, Labuan Bajo, Flores, East Nusa Tenggara, Indonesia.