Privacy, briefly

Summary in a line

Every page of Mount Batur Sunrise Trekking can be read without an account. We set no cookies and run no analytics, advertising or tracking scripts. What does reach us is the connection data any web server sees when it serves a page, listed below.

No booking happens on this site. You book on GetYourGuide after choosing a tour, and their privacy rules apply there.

Who answers for this site

Mount Batur Sunrise Trekking
[email protected]

The law does not oblige us to appoint a data protection officer, so there is none. Questions about your data go to [email protected].

What the web server notes

For every page or file your browser requests, the web server notes the IP address, the moment, the address asked for, the page that referred you, and the self-description your browser and operating system send.

These records are needed to deliver the site, keep it stable, detect attacks and misuse, and count page reads. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a site that works and stays safe. Raw records go after 90 days at the latest; counts holding no IP address stay longer. A hosting company operates the server and handles this data on our instructions alone.

The service ahead of the server

Web traffic and email for this domain go through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which speeds up delivery, repels attacks and forwards email to our inbox. That requires Cloudflare to process your IP address and technical connection data.

The legal basis is Article 6(1)(f) GDPR, our interest in a fast, protected site. Cloudflare is certified under the EU-US Data Privacy Framework and the European Commission's standard contractual clauses also apply. Cloudflare describes its practice at cloudflare.com/privacypolicy.

Photos of the trek

Tour photographs load directly from the image servers of GetYourGuide (GetYourGuide Deutschland GmbH, Sonnenburger Straße 73, 10437 Berlin, Germany). Showing one means your browser contacts those servers and gives them your IP address, which we cannot influence.

The legal basis is Article 6(1)(f) GDPR: we want each trek shown with the provider's current photographs.

After you click Book

A booking link goes straight to GetYourGuide and includes our partner number, which tells the platform that the booking began on our pages.

Once you are on GetYourGuide, the platform uses its own cookies and processes your data under its own privacy policy. We receive only commission totals: no names, contact details or payment data.

Videos on the pages

Videos are embedded through YouTube's privacy-enhanced mode and stay as a still image until you press play, so your browser does not touch YouTube beforehand. After you press play, the video streams from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which gets your IP address and may set cookies.

Your press of the play button is your consent: Article 6(1)(a) GDPR and Section 25(1) TDDDG. Google's policy is at policies.google.com/privacy.

What this browser retains

Your browser stores a few small notes so the site can follow your choices. They never leave your device, and we cannot see them:

• checklist boxes you have ticked, remembered for your return (local storage, kept until you wipe it);
• the currency chosen in the menu, applied to prices on every page (local storage, kept until you wipe it);
• after you open a chat: its reference number, an access key, your email address and a copy of the exchange, so the thread survives a reload (local storage, kept until you wipe it);
• a flag that the chat bubble was already displayed, so it does not repeat (session storage, gone once the tab closes);
• a flag that the leaving-the-page offer was already displayed, so it does not repeat (session storage, gone once the tab closes).

These notes are strictly necessary for functions you use yourself (Section 25(2) No. 2 TDDDG). Your browser settings let you remove them whenever you like.

The chat box

A chat means handing us your name, email address and messages. The chat service additionally notes your connection's country, a salted hash of your IP address (the address cannot be read back from it), and the page and language you used.

The conversation sits with Cloudflare (named above) and each message you write is relayed to our account on the Telegram messaging service, which handles it outside the European Union; our replies return by the same path. See telegram.org/privacy. Your email address is used for the reply and nothing else.

The legal basis is Article 6(1)(b) GDPR, because you ask and we answer, and Article 6(1)(f) GDPR for the salted IP hash, which only helps us block abuse and spam. A conversation is erased on its own 180 days after the last message.

When you write by email

What you write in an email is used only to answer you. The legal basis is Article 6(1)(f) GDPR, together with Article 6(1)(b) GDPR if you ask about a contract. We delete the thread when it ends, unless a legal duty makes us keep it.

Our fonts and map images

Typefaces are delivered by our own server, so no font provider learns of your visit. Maps are pictures hosted on our server and drawn from OpenStreetMap data; looking at or zooming them calls no map service. A "Google Maps" link reaches Google only when you press it.

Links to our sources

The guides cite official and expert sources and link to them. Those sites learn nothing about you until you open a link; from then on their own privacy terms apply.

Rights you can use

You may request information on the data we hold about you (Article 15 GDPR), its correction (Article 16) or erasure (Article 17), restriction of processing (Article 18) and a portable copy (Article 20). Where we rely on legitimate interest you can object at any time (Article 21), and consent can be withdrawn for the future. One email to [email protected] will do.

You may also lodge a complaint with a data protection supervisory authority, notably in the EU country where you live or work or where the alleged infringement took place (Article 77 GDPR).

We make no automated decisions about you and build no profiles. You do not have to give us data, but a page cannot reach your screen without technical connection data.