This policy explains which personal data we collect when you use this website or reserve a stay, and what we do with it.
The controller is PT PMA Swiss Bali Atelier, operating The Freya Ubud, Bali, Indonesia. Contact: [email protected].
Reservation details: name, email address, phone number, country, arrival and departure dates, number of guests, breakfast choice and any message you write to us. On arrival we may also ask for a copy of your passport or identity document, as required for guest registration in Indonesia.
Payment details are handled by our payment provider, Xendit. We do not store card numbers.
Technical data: IP address, browser and pages visited, kept in server logs for security and operation.
To handle your reservation, receive payment and welcome you at the villa, which is necessary to perform our contract with you. To answer your enquiries and to keep this website secure, which is our legitimate interest. To meet legal duties such as tax, accounting and guest registration.
Where we ask for your consent, for example before loading the map, you can withdraw it at any time.
Only service providers that help us operate the website and your stay: our hosting provider (Hetzner, Germany), our network and security provider (Cloudflare), our email provider (Namecheap Private Email), our booking system (Beds24), our payment provider (Xendit) and the messaging service we use to inform our team of new reservations (Telegram). They process data on our behalf. We do not sell personal data.
Some of these providers are located outside Indonesia and the European Union. We share only the data they need, and we rely on their contractual and technical safeguards.
Reservation records are kept as long as accounting and tax law require, in Indonesia up to ten years. Enquiries that do not lead to a booking are deleted after 12 months. Copies of identity documents are kept only as long as the registration requires.
The website uses encrypted connections. Access to reservation data is limited to the people who need it for your stay.
You may ask us for access to your data, correction, deletion or restriction, and you may object to processing. Write to [email protected]. If you live in the European Union, you may also complain to your local data protection authority. We handle personal data in line with Indonesian Law No. 27 of 2022 on Personal Data Protection and, for guests from the EU, the GDPR.
This website is not directed at children. Reservations are made by adults, who may tell us the number of children in their party.
This website itself uses only technically necessary cookies and no advertising or tracking cookies. The location map is provided by Google Maps. It loads only when you ask for it, and Google then receives your IP address and may set its own cookies. See Google’s privacy policy for details.
To understand how many people visit our website and which pages they read, we use Cloudflare Web Analytics. According to Cloudflare, this service works without cookies and does not track individual visitors across websites. On our own server we also count, without names or other personal details, how many price enquiries and reservations are made.
We may update this policy. The date of the latest version is shown here: 9 November 2026.