Privacy policy

Who is responsible for your personal data?

Two organisations handle your data, each at a different stage: You don't need to work out which one to contact. Both can be reached at one address: sales@komodoluxury.com , or WhatsApp +62 811-3823-875 ( wa.me/628113823875 ).

• Juara Holding Group publishes this website. It controls website, analytics and first-inquiry data.
• Komodo Luxury runs the Komodo Cruise desk, and its reservations team handles bookings directly. Once you ask for a confirmed booking, Komodo Luxury controls your booking, payment and manifest data.

Which laws does this policy follow?

We process personal data under Indonesia's Personal Data Protection Law, Undang-Undang No. 27 Tahun 2022 (UU PDP) . It was enacted on 17 October 2022, and compliance has been mandatory since 17 October 2024. We also follow Government Regulation 71 of 2019 on electronic systems. Many of our guests come from the EU, the UK and other places with similar laws. For them, we follow the main GDPR principles: a clear purpose for each use, collecting as little as possible, limited retention, and rights you can actually use.

What personal data do we collect?

We never ask for full card numbers, CVV codes or online banking passwords over WhatsApp or email. Anyone who asks for them in our name is not us. Health notes count as specific personal data under UU PDP. We process them only with your explicit consent, and only so the crew can keep you safe on board.

• Category — Examples — How it reaches us
• Inquiry details — Name, WhatsApp number, email, travel dates, guest count, cruise type (3D2N share trip, private phinisi, day or sunset cruise) — You send it by WhatsApp or email
• Booking details — Names of all guests, nationality, cabin choice, Labuan Bajo hotel for pickup — You provide it when you confirm
• Park registration data — Full name as in passport, passport number, date of birth, nationality — Needed for operator manifests
• Health and safety notes (optional) — Allergies, mobility limits, swimming ability — Only if you choose to share them
• Payment records — Invoice, amount, payment reference — Created during booking
• Technical data — Device type, browser, pages viewed, referring site, approximate location — Cookies and analytics

Why do we use your data, and on what legal basis?

Reports say Komodo National Park has used digital pre-registration with passport details since 2026. Operators submit these details through manifests, and walk-in entry is not reliable. So we cannot confirm a place on board without them. Please check the current rules with the desk before you travel.

• Purpose — Legal basis (UU PDP Art. 20; GDPR Art. 6 equivalent)
• Sending a quote, e.g. a 3D2N share cabin priced per person or a private charter priced per vessel — Steps you asked for before a contract
• Passing your booking to the Komodo Luxury reservations team and crew — Performing the contract
• Submitting passport details for Komodo National Park pre-registration — Legal obligation
• Keeping invoices and tax records — Legal obligation
• Measuring which pages help visitors plan a cruise — Consent or legitimate interest
• Sending departure updates or offers — Only if you opt in; you can withdraw any time

How long do we keep your data?

• Data — Retention
• Inquiries that never became a booking — Up to 24 months, then deleted
• Booking records and invoices — 10 years, as Indonesian tax bookkeeping rules require
• Passport numbers and scans — Deleted within 90 days after your trip ends, unless an authority asks us to keep them longer
• Health and safety notes — Deleted after disembarkation
• Analytics data — Up to 14 months, in aggregated form

Do we use cookies?

Yes, but only a few. Essential cookies keep the site secure and working. Analytics cookies , from a service such as Google Analytics, tell us which cruise pages people read, like the 4D3N itinerary or the vessel comparisons. You can block or delete cookies in your browser settings. Blocking analytics does not stop you from reading the site or messaging the desk.

Who else sees your data?

We share data only as far as each purpose needs: We do not sell, rent or trade personal data, and we do not share it with advertisers as lists.

• Komodo Luxury reservations staff and vessel crew. They see names, cabin choice, dietary needs and safety notes.
• Komodo National Park authorities and the Labuan Bajo harbourmaster (KSOP). They receive manifest data as the regulations require.
• WhatsApp (Meta). Meta processes your messages and their metadata under its own privacy policy.
• Email, hosting, content delivery and security providers, such as Cloudflare. They store or route data on our behalf.
• Analytics providers. They receive technical data, not passport or booking details.
• Partner hotels in Labuan Bajo. They receive data only if you book a "tour with hotel" bundle.

Is your data transferred outside Indonesia?

It can be, because some cloud and messaging providers store data abroad. UU PDP Article 56 says the receiving country or provider must protect it at least as well as Indonesian law does. For visitors from the EEA or UK, we rely on our providers' recognised safeguards, such as standard contractual clauses.

What rights do you have?

Under UU PDP, with matching rights under GDPR, you can: To make a request, email sales@komodoluxury.com with the subject line "Privacy request", or message the desk on WhatsApp. We confirm who you are with your booking reference and the contact details you used. Please never send a passport scan just to prove your identity. UU PDP sets short deadlines for some requests. We aim to meet them. If you are not satisfied with our answer, you can complain to the data protection authority set up under UU PDP. EEA and UK residents can also go to their local supervisory authority.

• Know who processes your data and why
• Access your data and get a copy
• Correct details that are wrong or incomplete
• Delete data we no longer need, or data we hold without a valid basis
• Withdraw consent , for example for marketing or analytics
• Object to decisions made only by automated processing
• Restrict processing while a complaint is looked at
• Receive your data in a common format so you can move it elsewhere
• Claim compensation if we break the law in handling your data

How do we protect passport and booking data?

You can help too. Send passport details to the desk directly, not in a shared group chat with fellow share-trip guests.

• Only reservations staff who prepare manifests can see passport details
• Passport scans are never posted in group chats or shared with other guests
• Manifest files are deleted on the schedule in the retention table above
• If a data breach affects you, we notify you and the authority in writing within 3 × 24 hours, as UU PDP Article 46 requires

What are the limits of our responsibility for bookings?

This policy is about privacy, but a few booking terms affect what you can rely on: Your booking confirmation sets out the cancellation and refund terms. Those terms take priority over any general website text.

• Prices are indicative. Open trips are quoted per person for your dates, cabin and guest count, and private charters per vessel. A price is only binding once Komodo Luxury confirms it in writing.
• Private charters are priced per vessel. Prices depend on the vessel, the duration and the number of guests, and never per person.
• Park fees are extra. They are paid once per trip; confirm the current amount with the desk.
• Nature and regulators decide some things. We cannot guarantee dragon or manta sightings, calm seas or exact routes. Reports say a daily cap of about 1,000 visitors has applied since 1 April 2026, and tourist boats face restrictions after dark in higher-risk park zones. Both can change an itinerary.
• Third parties set their own terms. This includes flights from Denpasar (DPS) to Labuan Bajo (LBJ), WhatsApp, and any sites we link to.

Do we collect data from children?

This site is not aimed at anyone under 18. A parent or guardian must provide and consent to a minor's passport and booking details. That covers both the manifest and the booking, as UU PDP requires.

How will changes to this policy be announced?

When we update this policy, we change the date at the top of this page. For bigger changes, such as a new purpose or a new type of recipient, we will also tell guests with active bookings by email or WhatsApp.

How do I contact the privacy desk?

Website publisher: Juara Holding Group. Cruise desk and reservations: Komodo Luxury, Labuan Bajo, Flores, East Nusa Tenggara, Indonesia.

• Email: sales@komodoluxury.com (subject: "Privacy request")
• WhatsApp: +62 811-3823-875, wa.me/628113823875