The data controller is Aligna Hospitality, the operator of Riloka Villas Ubud, Jalan Lanyahan, Petulu, Ubud, Bali. You can reach us about privacy at info@rilokavillasubud.com.

We only collect what we need to answer you and to prepare for your stay:

• Details you give us in the register-interest or contact form: name, email address, country, preferred dates, number of guests, villa preference and any message (including access needs you choose to share).
• Messages you send us by email or WhatsApp.
• Technical data needed to run the site securely, such as IP address, browser type and pages requested (server and security logs).
• With your consent only: analytics and marketing cookie data, as described in our Cookie Policy.

• To reply to your enquiry and share opening dates and rates — based on your consent and on steps taken at your request before a booking.
• To plan an accessible stay when you tell us about access needs — based on your explicit consent, which you may withdraw at any time.
• To keep the website secure and prevent abuse — based on our legitimate interests.
• To meet legal, tax and accounting obligations once you book — based on legal obligation.

We do not sell your personal data and we do not use it for automated decision-making.

We share personal data only with service providers that help us operate — website hosting (Vercel), email delivery, and, once bookings open, our reservation and payment providers — under contracts that require them to protect it. We may disclose data where required by Indonesian law or a competent authority.

Some providers store data outside Indonesia (for example in Singapore, the EU or the United States). Where we transfer data abroad we rely on providers with an equal or higher level of protection, or on contractual safeguards, as required by Law No. 27 of 2022.

Register-interest data is kept until you unsubscribe or for up to 24 months after our opening announcement, whichever is sooner. Booking records are kept for as long as tax and accounting law requires. Security logs are kept for up to 90 days.

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate data or complete incomplete data;
• delete your data, or restrict or object to its processing;
• withdraw consent at any time — including by clicking “unsubscribe” in any email;
• complain to a data protection authority.

To exercise any of these rights, email info@rilokavillasubud.com. We will respond within the period required by law (generally 3 × 24 hours to acknowledge under Indonesian law, and within one month for full requests).

The site is served over HTTPS, form submissions are validated and rate-limited on our server, and access to enquiry data is limited to the team who need it. No method of transmission is perfectly secure, and in the unlikely event of a breach affecting you we will notify you and the relevant authority as required by law.

This website is not directed at children under 17, and we do not knowingly collect their personal data. Guests under 17 travel under the responsibility of an adult who makes the enquiry.

We may update this policy as Riloka prepares to open. The date at the top shows the latest version; significant changes will be highlighted on this page.