Your data, explained

Boiled down

Every page of ATV Ubud can be read without an account. We set no cookies and run no analytics, advertising or tracking scripts. What does reach us is the connection data that any web server sees when it sends you a page, described below.

Nothing is booked on this site. Picking a ride sends you to GetYourGuide to book it, and their privacy rules apply from that point.

The people behind this site

ATV Ubud
[email protected]

We have no legal duty to name a data protection officer, so there is none. Questions about your data go to [email protected].

Server log contents

At every request for a page or file, our web server writes down the IP address it came from, the date and time, the address requested, the referring page and the identification text that your browser sends about itself and its operating system.

We need these logs to deliver the site, keep it stable, detect attacks and abuse, and count how often pages are read. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a site that works and is safe. Raw logs are deleted after 90 days at the latest; counts without IP addresses are kept longer. A hosting company operates the server and handles this data on our behalf and on our instructions alone.

The service in front of the server

This domain's pages and email go through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which speeds up delivery, filters attacks and forwards email to our mailbox. For this purpose Cloudflare handles your IP address and technical connection data.

The legal basis is Article 6(1)(f) GDPR: our interest in a fast, protected website. Cloudflare is certified under the EU-US Data Privacy Framework, and the standard contractual clauses of the European Commission apply too. Cloudflare describes its practice at cloudflare.com/privacypolicy.

Pictures of the rides

Photos of the rides load straight from the image servers of GetYourGuide (GetYourGuide Deutschland GmbH, Sonnenburger Straße 73, 10437 Berlin, Germany). To show one, your browser connects to those servers and hands over your IP address; we cannot steer that.

The legal basis is Article 6(1)(f) GDPR: our interest is to show every ride with the provider's current photos.

If you click through to book

Every booking link goes directly to GetYourGuide and carries our partner number, which lets the platform credit a booking to ATV Ubud.

After you arrive on GetYourGuide, that platform sets its own cookies and handles your data under its own privacy policy. All we receive back are commission reports with totals, never names, contact details or payment data.

Video clips

Videos are embedded in YouTube's privacy-enhanced mode and stay as a still picture until you press play, and before that your browser does not touch YouTube. After you press play the video loads from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which receives your IP address and may set cookies.

Your consent is the press of the play button: Article 6(1)(a) GDPR and Section 25(1) TDDDG. Google's privacy information: policies.google.com/privacy.

What the browser holds for ATV Ubud

Your browser stores a few small notes so that the site follows your choices. They stay on your device and we cannot read them:

• the checklist items you ticked, so the ticks are still there on a later visit (local storage, kept until you clear it);
• the currency chosen in the menu, so every page shows prices in it (local storage, kept until you clear it);
• after you open a chat: its reference number, an access key, your email address and a copy of the thread, so you can return to it (local storage, kept until you clear it);
• that the chat bubble was already shown once, so it stays hidden afterwards (session storage, wiped when the tab closes);
• that the pop-up offered as you leave was already shown once, so it does not come back (session storage, wiped when the tab closes).

These notes are strictly necessary for functions you request yourself (Section 25(2) No. 2 TDDDG). You can wipe them whenever you like in your browser settings.

Chat history

Opening a chat means handing us your name, your email address and what you write. The chat service additionally logs the country of your connection, a scrambled form of your IP address (a salted hash that cannot be reversed into the address) and the page and language you wrote from.

Chat threads are held by Cloudflare (named above), and every message you write is relayed to our account at the Telegram messaging service, which processes it outside the European Union; our replies return along the same route. See telegram.org/privacy. Your email address is used only for answering you.

The legal basis is Article 6(1)(b) GDPR, because you ask and we reply, plus Article 6(1)(f) GDPR for the scrambled IP address, which serves only to fend off abuse and spam. Each thread is deleted by itself 180 days after its final message.

Writing to the quad desk by email

When you email us, we use your message to answer you. The legal basis is Article 6(1)(f) GDPR, and Article 6(1)(b) GDPR if your message concerns a contract. We delete the exchange when it is closed unless a legal duty makes us keep it.

Fonts plus map images

Typefaces are delivered by our own server, so no font provider learns that you visited. Maps are images stored on our server and drawn from OpenStreetMap data; looking at or zooming them involves no map provider. A "Google Maps" link contacts Google only once you press it.

Sources we link to

Our pages quote official and expert sources and link to them. Those sites get nothing from you until you open a link, and then their privacy rules apply.

Your say over your data

You may ask what data we hold about you (Article 15 GDPR), request correction (Article 16) or erasure (Article 17), restrict its processing (Article 18) and take it with you in a portable form (Article 20). Where we rely on legitimate interest you can object at any time (Article 21), and a consent you gave can be withdrawn with effect for the future. A note to [email protected] is sufficient.

You can also complain to a data protection supervisory authority, particularly in the EU country of your home, your workplace or the place of the alleged infringement (Article 77 GDPR).

Without an account or a login you owe us no data, and we make no automated decisions or profiles about riders. A page still cannot reach your screen without technical connection data, which any server sees.