Data summary

Short summary

You can read every page of Uluwatu Kecak without an account. The site sets no cookies and runs no analytics, advertising or tracking scripts. What does reach us is the connection data that any web server sees when it sends you a page, and it is described below.

This site takes no bookings. A ticket is bought on GetYourGuide or Viator, and their privacy rules apply to that purchase.

Who answers for your data

Uluwatu Kecak Guide
[email protected]

The law does not oblige us to name a data protection officer, so we have none.. Write to [email protected] about anything that concerns your data.

Log entries from visits

Whenever your browser asks for a page or file, our web server notes the IP address it arrived from, the date and time, the address asked for, the page that referred you and the text your browser sends to describe itself and your operating system.

These records let us deliver the site, keep it steady, spot attacks and abuse, and count how often pages are read. The basis is Article 6(1)(f) GDPR: a legitimate interest in a site that works and is safe. Raw records are erased after 90 days at the latest; tallies without an IP address last longer. A hosting company runs the server and handles this data on our behalf and our instructions only.

Cloudflare in the middle

This domain's pages and email travel through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which serves the site fast, blocks attacks and passes email on to our mailbox. For this Cloudflare handles your IP address and technical connection details.

The basis is Article 6(1)(f) GDPR, our interest in a quick and protected site. Cloudflare holds EU-US Data Privacy Framework certification, and the European Commission's standard contractual clauses apply as well. Its own practices are described at cloudflare.com/privacypolicy.

Pictures of the show

Show and temple photos come directly from the image servers of GetYourGuide (GetYourGuide Deutschland GmbH, Sonnenburger Straße 73, 10437 Berlin, Germany). To display one, your browser reaches those servers and hands over your IP address, an exchange we cannot control.

The basis is Article 6(1)(f) GDPR: we want to show the show with its operator's own pictures.

Moving on to book

A booking link sends you straight on to GetYourGuide or Viator. It holds our partner number, which lets the platform credit us for a sale that began here.

After you land on GetYourGuide or Viator, that platform sets its own cookies and treats your data under its own privacy policy. We get only commission statements with totals, with no names, contact details or payment data.

YouTube clips on these pages

Videos use YouTube's privacy-enhanced mode and stay a still frame until you press play, so until then your browser makes no contact with YouTube. After you press it the video loads from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which receives your IP address and may set cookies.

Your consent is the press of the play button: Article 6(1)(a) GDPR and Section 25(1) TDDDG. Google's policy is at policies.google.com/privacy.

Notes left in your browser

Your browser keeps a handful of small notes so the guide works as you set it up. They never leave your device and we have no way to read them:

• which checklist boxes you ticked, so they are still ticked on your return (local storage, until you clear it);
• the currency chosen in the menu, so every page keeps showing prices in it (local storage, until you clear it);
• if you open a chat: its reference number, an access key, your email address and a copy of the exchange, so you find it again later (local storage, until you clear it);
• a flag that the chat bubble already appeared once, so it stays away afterwards (session storage, gone when the tab closes);
• a flag that the leaving-the-page window was already offered, so it does not come back (session storage, gone when the tab closes).

These notes are strictly necessary for features you switch on yourself (Section 25(2) No. 2 TDDDG). You can wipe them any time in your browser settings.

Chat window

Opening a chat hands us your name, email address and messages. The chat service also logs your connection's country, a salted hash of your IP address (the address cannot be recovered from it), and the page and language you wrote from.

Cloudflare (named above) stores the conversation, and each message you write is passed to our account on the messenger Telegram, which handles it outside the European Union; our replies return the same way. Details: telegram.org/privacy. Your email address serves only to reply to you.

The basis is Article 6(1)(b) GDPR, as you ask and we reply, together with Article 6(1)(f) GDPR for the hashed IP address, used solely against abuse and spam. A chat is wiped automatically 180 days after its final message.

Mailing the cliff desk

We use an email only to answer it. The basis is Article 6(1)(f) GDPR, plus Article 6(1)(b) GDPR when the message is about a contract. Once the exchange is closed we delete it, unless the law obliges us to keep it.

Type and map tiles

Typefaces load from our own server, so no font provider hears of your visit. The maps are images kept on our own server and drawn from OpenStreetMap data; viewing or zooming them contacts no map service. A "Google Maps" link opens Google only when you press it.

Outbound reference links

Our guides name official and expert sources and link to them. No data goes to those sites unless you open a link, and after that their own privacy terms apply.

Requests you can make of us

You are entitled to ask what data we hold about you (Article 15 GDPR), have it corrected (Article 16) or erased (Article 17), have its processing restricted (Article 18) and receive it in a portable form (Article 20). Where we rely on our legitimate interest, you may object at any time (Article 21), and any consent you gave can be withdrawn for the future. An email to [email protected] and we will take it from there.

You may also lodge a complaint with a data protection supervisory authority, notably in the EU country where you live or work, or where you think the breach occurred (Article 77 GDPR).

No automated decision-making and no profiling happens here. You do not have to give us data, but a page cannot reach your screen without the technical connection data.