Privacy policy

Last updated 10 September 2026

This policy covers the personal information we collect when you book a room directly through this booking engine. It is written to be read, not to be skimmed past.

1. Who is responsible

We decide what is collected here and why, so we are the data controller for it. Questions about your information reach Herlan, our General Manager, who is responsible for handling them — write to the address above and mark it for his attention.

2. What we collect when you book

• Required: first name, last name and email address.
• Optional: phone number, country, and any special requests you type. You can leave all three blank and still book.
• Your booking: dates, room, number and ages of guests, prices, deposit, booking reference and payment status.
• Not your card details. Payment happens on our provider’s pages. We never receive, see or store your card number.
• Only if you cancel and are owed a refund: your bank details. Refunds are made by bank transfer, so we cannot return your money without them. We ask for them at that point and not before, and we keep them only as part of the record of that refund.

We use this to hold your room, take the deposit, prepare for your arrival and keep the accounting records we are required by law to keep. We need it to perform the booking contract with you — without a name and an email we cannot confirm a room.

3. Who else receives it

• Xendit, our payment provider, receives your first name, last name and email address, together with the booking reference and your stay dates, so it can take the payment and match it to your booking.
• Our own staff are notified of a new booking by WhatsApp, and that message contains your name and email address so the arrival can be prepared. WhatsApp is operated by Meta.
• Our hotel systems, which we run on our own servers rather than renting from a third party.

We do not sell your information, and we do not share it for anyone else’s marketing. We may disclose it where the law requires it.

4. Analytics and advertising cookies

We do not run advertising on this site and we do not use these cookies to target you with adverts. They exist to tell us where the booking form is going wrong. If you accept, three things load and may set cookies:

• Our own measurement — first-party, on our own servers: which pages you saw, which rooms you compared, how far you scrolled, and where you left. It records what you did, not who you are.
• Google Analytics — the same kind of measurement, held by Google, linked across bonibeach.com and selong-belanak.com so a visit that starts on one and finishes on the other is counted once rather than twice.
• Microsoft Clarity — records how the page is used, including mouse movement, clicks and scrolling, so we can see where the booking form is confusing.

These run only on your consent, which you can withdraw at any time by clearing this site’s cookies in your browser — the choice is stored in a cookie, so removing it brings the question back. Withdrawing does not affect what was collected beforehand.

5. Where your information goes

We are in Indonesia, so booking with us means your information is handled there. The providers named in sections 3 and 4 are international and process data outside Indonesia and outside the European Economic Area. Where we send personal data to a provider abroad we rely on that provider’s standard contractual protections.

6. How long we keep it

We keep your booking and the record of what you paid for as long as we need it for your stay, for handling any dispute afterwards, and for the accounting and tax records Indonesian law requires us to retain. Measurement data is kept in aggregate for as long as it is useful for improving the booking process; the retention period for each third party in section 4 is set by that provider.

7. Your rights

You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to a particular use. If you are in the United Kingdom or the European Economic Area you also have the right to receive your data in a portable form and to complain to your national data protection authority.

Email info@bonibeach.com and we will answer. We may need to check who you are first, and we may have to keep records we are legally obliged to retain even after a deletion request.

8. Keeping it safe

The site is served over an encrypted connection, payment happens entirely on our provider’s systems, and access to booking records inside the hotel is limited to staff who need it for their work.

9. Children

The booking engine is for adults. Where a booking includes children or infants we collect only how many there are and their age bracket, given to us by the adult booking — never their names or any detail about them.

10. Changes, and how to reach us

If this policy changes we will update the date at the top. For anything about your information, write to info@bonibeach.com or call +62 811 3800 355. Our booking terms are here.