Privacy Policy

Villa Zambala is owned and operated by Zambala Beach House ("we", "us", or "our"). We value your privacy and are committed to looking after the personal information you share with us. This policy explains what we collect, why we collect it, how it is used, and the rights you have over it.

It applies to anyone visiting zambalavillas.com, contacting us by email, registering interest in a future property, or enquiring about a stay.

Who we are

Zambala Beach House operates a private luxury villa in Berawa, Canggu, Bali (trading as Villa Zambala Canggu), and is preparing a second property on Nusa Lembongan. For any questions about your data, please contact us at hello@zambalavillas.com.

For the purposes of UK and EU data protection law, Zambala Beach House is the data controller of the personal information described in this policy.

What we collect

We only collect information you choose to share with us, plus a small amount of technical data your browser sends automatically.

• Information you give us directly — your name and email address when you register interest in Villa Zambala Nusa Lembongan; any contact details, dates of interest, or message content you provide when you email us or use the WhatsApp or booking buttons.
• Information collected automatically — if you accept analytics cookies, we collect anonymised usage information such as the pages you visit, your approximate location (country/region), the device and browser you use, and how you reached the site (referrer). No cookies are set for analytics unless you click "Accept All" in our cookie banner.
• Booking information — if you proceed to book, the booking is handled by our reservation system (Cloudbeds), which collects whatever information is necessary to process the booking (name, contact details, payment details, stay dates). Villa Zambala does not store payment card details on this website.

How we use your information

We use the information we collect for a small number of clear purposes:

• To respond to enquiries — answering your questions about the villa, availability, or events.
• To process bookings — confirming your reservation and managing your stay.
• To keep you informed — sending you launch news about Villa Zambala Nusa Lembongan, but only if you have asked us to via the Coming Soon registration form. You can unsubscribe at any time.
• To understand how the site is used — anonymised analytics, only if you have opted in.
• To meet legal obligations — for example, tax, accounting, and regulatory record-keeping.

We will never sell or rent your personal information. We do not use your data for advertising or share it with third parties for marketing purposes.

Legal bases for processing

Under UK and EU data protection law, we rely on the following legal bases:

• Consent — for analytics cookies and for marketing emails about future properties. You can withdraw consent at any time.
• Contract — to process a booking or respond to a stay enquiry.
• Legitimate interests — to respond to general enquiries, prevent spam and abuse on the website, and improve our services. We assess this against your rights and only rely on it where reasonable.
• Legal obligation — to comply with applicable laws (e.g. tax records).

Cookies and similar technologies

Cookies are small files stored on your device when you visit a website. We use cookies sparingly and only after you have given us permission for non-essential ones.

• Strictly necessary cookies — these are essential for the site to function, including remembering your cookie preferences. They are set automatically and do not require consent.
• Analytics cookies (Google Analytics 4) — set only if you click "Accept All". They help us understand which pages and content are most useful. We use Google Consent Mode v2, which means GA4 sends no tracking data before you consent.
• Booking engine cookies (Cloudbeds) — set only on the Book page, and only when the booking widget is used. They support the booking flow itself.

You can change your choices at any time using the "Cookie settings" link in the footer. You can also clear cookies through your browser settings.

Third parties who process data on our behalf

We rely on a small number of trusted providers to run the website and respond to enquiries. Each is subject to their own privacy commitments, linked below.

• Vercel — website hosting and edge delivery. Vercel does not have access to the content of form submissions beyond the brief transit time. Vercel privacy policy.
• Resend — used to deliver form submissions from the Coming Soon page to our team inbox. Resend privacy policy.
• Cloudbeds — our reservation and booking engine. Provides the booking widget on the Book page and handles all booking-related data including payment. Cloudbeds privacy policy.
• Google Analytics 4 — analytics (consent-only). Google privacy policy.
• Google Maps — embedded on the Explore page to show our location. Google may collect data when the map is loaded. Google privacy policy.

We also link to our public Instagram profile. Following the link will take you to Instagram, where Meta's own privacy policy applies. We do not share data with Instagram from this site.

International transfers

Villa Zambala operates from Bali, Indonesia. Some of our service providers (Vercel, Google, Cloudbeds, Resend) are based in the United States or use globally distributed infrastructure. This means your data may be transferred outside the UK or European Economic Area.

Where we transfer personal data to providers outside the UK/EEA, we rely on appropriate safeguards (such as Standard Contractual Clauses or other approved mechanisms) so that your data continues to be protected to UK and EU standards.

How long we keep your information

• Coming Soon registrations — until you ask us to remove your details or until Villa Zambala Nusa Lembongan launches and the list is retired, whichever is sooner.
• Enquiry correspondence — up to 24 months after our last contact, unless you have become a guest, in which case we keep records as set out below.
• Booking and guest records — for as long as required by Indonesian and applicable accounting/tax law (typically up to 10 years).
• Analytics data — Google Analytics stores anonymised event data for the retention period we set in GA4 (currently 14 months). It cannot be linked back to an individual.

Your rights

If you are in the UK, the EEA, or any jurisdiction with similar data protection laws, you have the following rights over the personal information we hold about you:

• Access — ask for a copy of the personal information we hold.
• Rectification — ask us to correct anything that is inaccurate or incomplete.
• Erasure — ask us to delete your information ("right to be forgotten"), subject to legal record-keeping obligations.
• Restriction — ask us to pause our use of your information while we resolve a concern.
• Portability — receive your information in a portable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — at any time, where we rely on consent (e.g. analytics, marketing emails). Withdrawing consent does not affect the lawfulness of processing before withdrawal.
• Complain — to a supervisory authority. In the UK this is the Information Commissioner's Office; in the EU, your local data protection authority.

To exercise any of these rights, email us at hello@zambalavillas.com. We respond within 30 days.

Security

We take reasonable technical and organisational measures to protect your personal information:

• The website is served entirely over HTTPS with modern TLS only (1.2 and 1.3).
• Form submissions are transmitted encrypted in transit and processed by reputable, security-audited providers.
• Access to enquiry and booking records is restricted to authorised members of the Villa Zambala team.
• We do not store payment card data on this website. Card payments are handled by Cloudbeds, which is PCI DSS compliant.

Children

Our website and services are not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. Any updates will be posted on this page with a revised "Last updated" date. Material changes affecting how we use your data will be communicated more prominently where appropriate.

Contact

Questions about this policy, or about how we handle your data? Please email hello@zambalavillas.com. We will be in touch within a few working days.