How we handle your information

Briefly

You can read every page of Ubud Day Route without an account. The site sets no cookies and runs no analytics, advertising or tracking scripts. What does reach us is the connection data that any web server sees when it sends you a page, and it is described below.

Bookings never happen on this site. You book a tour on GetYourGuide or Viator, and their privacy rules apply there.

Who is responsible for which part

Ubud Day Route
[email protected]

No law obliges us to name a data protection officer, so Ubud Day Route has none. Questions about your data go to [email protected].

What the server records

Whenever your browser requests a page or a file, our web server notes the IP address of the request, the date and time, the address asked for, the page you arrived from and the identification string your browser sends about itself and your operating system.

These records are needed to deliver the site, keep it stable, spot attacks and abuse, and count how often each page is read. The legal basis is Article 6(1)(f) GDPR: our legitimate interest is a site that works and stays safe. Raw records are erased after 90 days at the latest; counts without any IP address are kept longer. The server belongs to a hosting company that processes this data for us and only on our instructions.

The service in front of this site

Pages and email for this domain run through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which serves the site fast, blocks attacks and forwards email to our mailbox. For this, Cloudflare handles your IP address and technical connection data.

The legal basis is Article 6(1)(f) GDPR, our interest in a quick and protected site. Cloudflare is certified under the EU-US Data Privacy Framework and the standard contractual clauses of the European Commission apply as well. Cloudflare describes its own practice at cloudflare.com/privacypolicy.

Photos of tours and places

Tour photographs come straight from the image servers of GetYourGuide (GetYourGuide Deutschland GmbH, Sonnenburger Straße 73, 10437 Berlin, Germany). To display such a photograph your browser contacts those servers and gives them your IP address, an exchange we cannot influence.

The legal basis is Article 6(1)(f) GDPR: we want each tour to appear with the provider's current pictures.

Once you follow a booking link

Booking links go straight to GetYourGuide or Viator. Each carries our partner number, which lets the platform credit us when a booking is made through it.

Once you are on GetYourGuide or Viator, that platform sets its own cookies and handles your data under its own privacy policy. We receive only commission reports with totals: no names, no contact details and no payment data.

Videos on the page

Videos are embedded in YouTube's privacy-enhanced mode and remain a still picture until you press play, so your browser does not contact YouTube at all before then. After you press play the video loads from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which receives your IP address and may set cookies.

You consent the moment you press play: article 6(1)(a) GDPR and section 25(1) TDDDG. Google's own policy: policies.google.com/privacy.

What this browser keeps after your Ubud visit

Some small notes are kept in your own browser so the site behaves as you asked. They never leave your device and we cannot read them:

• the boxes you tick on a checklist, so they remain ticked on your return (local storage, kept until you clear it);
• the currency chosen in the menu, so every page keeps showing prices in it (local storage, kept until you clear it);
• if you open a chat: its reference number, an access key, your email address and a copy of the conversation, so it is waiting when you come back (local storage, kept until you clear it);
• a note that the chat bubble has already appeared, so it stays quiet afterwards (session storage, gone when the tab closes);
• a note that the window shown as you leave has already appeared, so it does not return (session storage, gone when the tab closes).

These notes are strictly necessary for features you use yourself (Section 25(2) No. 2 TDDDG). Your browser settings can remove them at any time.

The Ubud Day Route chat box

If you open a chat, you give us your name, your email address and your messages. The chat service also notes the country your connection comes from, a scrambled version of your IP address (a salted hash that cannot be turned back into the address) and the page and language you wrote from.

The conversation is kept with Cloudflare (named above), and each message you write is passed on to our account with the messaging service Telegram, which handles it outside the European Union; our replies travel back the same way. Further reading: telegram.org/privacy. We use the email address for the reply, nothing more.

The legal basis is Article 6(1)(b) GDPR, since you ask and we answer, and Article 6(1)(f) GDPR for the scrambled IP address, which serves only to stop abuse and spam. Each conversation is deleted automatically 180 days after its last message.

Writing by email

If you write to us by email, we use what you send in order to reply. The legal basis is Article 6(1)(f) GDPR, and Article 6(1)(b) GDPR when your message concerns a contract. Once the exchange is finished we delete it, unless a legal duty obliges us to keep it.

Fonts, map pictures

The typefaces come from our own server, so no font service hears about your visit. The maps are pictures kept on our own server and drawn from OpenStreetMap data; viewing or magnifying them contacts no map service. A "Google Maps" link opens Google only once you press it.

Where each fact was sourced

Our pages cite official and expert sources and link to them. Nothing is sent to those sites unless you open one of the links; after that their own privacy rules govern.

What you are entitled to request from us

You may ask what data we hold about you (Article 15 GDPR), have it corrected (Article 16) or erased (Article 17), have its processing restricted (Article 18) and receive it in a portable format (Article 20). Where our legitimate interest is the basis you may object whenever you wish (Article 21), and a consent you gave can be withdrawn going forward. Please send a message to [email protected].

You may also complain to a data protection supervisory authority, in particular in the EU country where you live or work, or where you think the infringement happened (Article 77 GDPR).

No automated decision is made about you and no profile is built. You do not have to give us any data, though without the technical connection data a page cannot reach your screen.