Your data in plain terms

The summary first

You can read every page of Mount Batur Sunrise Hike without an account. The site sets no cookies and runs no analytics, advertising or tracking scripts. What does reach us is the connection data any web server sees when it sends you a page, and it is described below.

Nothing is booked here. Choose a tour and the booking is made on GetYourGuide, where their own privacy rules take over.

Who stands behind this site

Mount Batur Sunrise Hike
[email protected]

No law obliges us to appoint a data protection officer, so we have none. For any question about your data, write to [email protected].

What the server keeps

Whenever your browser asks for a page or a file, our web server logs the IP address behind the request, the date and time, the address asked for, the page you arrived from and the identification text your browser sends about itself and your operating system.

We need these records to deliver the site, keep it stable, recognise attacks and abuse, and count how often each page is read. The legal basis is Article 6(1)(f) GDPR: our legitimate interest is a site that works and stays safe. Raw records are deleted after 90 days at most; counts without an IP address are kept longer. A hosting company runs the server and handles this data for us, on our instructions only.

The network layer before our server

Pages and email for this domain run through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which delivers the site quickly, filters attacks and forwards email to our mailbox. For that, Cloudflare processes your IP address and technical connection data.

Our legal basis is Article 6(1)(f) GDPR: we want the site fast and protected. Cloudflare is certified under the EU-US Data Privacy Framework, and the European Commission's standard contractual clauses apply on top. Cloudflare describes its own handling at cloudflare.com/privacypolicy.

Pictures from the tours

Photographs of the tours load straight from the image servers of GetYourGuide (GetYourGuide Deutschland GmbH, Sonnenburger Straße 73, 10437 Berlin, Germany). To show one, your browser contacts those servers and gives them your IP address, an exchange we cannot influence.

The legal basis is Article 6(1)(f) GDPR: our interest is to show every tour with the provider's current pictures.

On the way to a booking

A booking link goes directly to GetYourGuide. It includes our partner number, which lets the platform attribute the booking to us.

After you arrive on GetYourGuide, that platform uses its own cookies and processes your details under its privacy policy. What comes back to us is a commission statement with sums alone, never names, contact details or payment information.

Videos on our pages

Videos are embedded in YouTube's privacy-enhanced mode and stay a still picture until you press play, so your browser does not contact YouTube before that. Once you press play, the video loads from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which receives your IP address and may set cookies.

Pressing play is your consent: Article 6(1)(a) GDPR and Section 25(1) TDDDG. Google sets out its policy at policies.google.com/privacy.

What our site leaves in your browser

Some small notes live in your own browser so that the site does what you asked. They stay on your device and are invisible to us:

• the boxes you ticked on a list, so they are still ticked on your return (local storage, until you clear it);
• the currency you chose in the menu, so every page shows prices in it (local storage, until you clear it);
• after starting a chat: its reference number, an access key, your email address and a copy of the exchange, so the thread is waiting for you later (local storage, until you clear it);
• that the chat bubble was shown once, so it does not pop up again (session storage, cleared when the tab closes);
• that the window shown as you leave has appeared once, so it does not come back (session storage, cleared when the tab closes).

These notes are strictly necessary for features you use yourself (Section 25(2) No. 2 TDDDG). You can delete them whenever you like in your browser settings.

The chat panel

To chat, you give us your name, your email address and your messages. The chat service additionally logs the country your connection comes from, a scrambled form of your IP address (a salted hash that cannot be reversed into the address) and the page and language you were writing from.

The conversation is stored with Cloudflare (named above), and every message you write is forwarded to our account on the Telegram messaging service, which processes it outside the European Union; our answers return by the same route. More at telegram.org/privacy. Nothing else is done with your email address except sending the reply.

The legal basis is Article 6(1)(b) GDPR, as you ask and we answer, and Article 6(1)(f) GDPR for the scrambled IP address, which serves only to stop abuse and spam. A conversation is deleted automatically 180 days after its last message.

Mail you send us

We use an email you send only to answer it. The legal basis is Article 6(1)(f) GDPR, and Article 6(1)(b) GDPR where the message concerns a contract. When the conversation is over we delete it, unless a legal duty makes us keep it.

Typefaces

The fonts are served from our own server, so no font service learns about your visit.

Where our references live

Our guides cite official and expert sources and link to them. Those sites learn nothing from us until you open a link; after that their own privacy rules apply.

What you can ask for

You may ask what data we hold about you (Article 15 GDPR), have it corrected (Article 16) or erased (Article 17), have its processing restricted (Article 18) and receive it in a portable form (Article 20). Where we rely on our legitimate interest you may object at any time (Article 21), and a consent you gave can be withdrawn for the future. Just write to [email protected] and that suffices.

Complaints can also go to a data protection supervisory authority, most naturally in the EU country of your home, workplace or the alleged breach (Article 77 GDPR).

We take no automated decisions about you and create no profiles. You owe us no data, although without the technical connection data a page cannot reach your screen.