2. What Personal Data We Collect
When you submit a quote request or travel enquiry through our website or contact us via email, WhatsApp, or phone, we may collect the following categories of personal data:

2.1  Identification & Contact Data

• Title, full name
• Email address
• Phone number (including WhatsApp number)
• Country of residence or nationality
  

2.2  Travel Preference & Trip Data

• Preferred travel dates and duration
• Number of travellers and group composition (e.g. families, couples, groups)
• Destination(s) of interest within Indonesia
• Trip style and interest areas (e.g. culture, adventure, wellness, culinary)
• Budget range and accommodation preferences
• Special requirements (dietary needs, accessibility, mobility considerations)

2.3  Communication Data

• Records of emails, WhatsApp messages, and phone conversations with our team
• Enquiry and feedback submissions through our website forms

2.4  Technical Data (Website)

• IP address and browser type
• Pages visited and time spent on our website (via cookies and analytics tools)
• Device type and operating system

We do not collect sensitive personal data as defined under Article 4 of the PDP Law (such as health data, biometric data, genetic data, financial records, or children's data) unless you voluntarily provide it for the purpose of accommodating a specific travel requirement — in which case you will be informed separately.

3. Why We Collect Your Data — Legal Bases for Processing

We process your personal data on one or more of the following lawful grounds under the PDP Law:

3.1  Consent

When you tick the "Data Use" checkbox on our enquiry form, you give us explicit consent to process your data to handle your travel enquiry. You may withdraw this consent at any time by writing to sales@kekayontravel.com — withdrawal will not affect the lawfulness of any processing carried out before withdrawal.

3.2  Performance of a Contract / Pre-Contractual Steps

Once you request a quote, we need your personal data to prepare a personalised itinerary proposal, communicate costs, confirm arrangements with local suppliers, and — if you proceed — to fulfil your booking. Processing at this stage is necessary to take steps prior to, and in performing, a contract with you.

3.3  Legitimate Interests

We may process certain data where we have a legitimate business interest to do so, provided your fundamental rights are not overridden. This includes improving our service quality, detecting and preventing fraud, and maintaining the security of our systems.

3.4  Legal Obligation

We may be required to retain or disclose certain data to comply with applicable Indonesian law, including tax, tourism regulation, or law enforcement obligations.

4. How We Use Your Data

Your personal data is used for the following specific purposes:

• Responding to your travel enquiry and preparing a personalised itinerary and quote
• Communicating with you via email, WhatsApp, or phone regarding your trip
• Coordinating with trusted local suppliers (guides, hotels, transport providers, and activity operators) to arrange your travel
• Sending follow-up communications about your enquiry status
• If you give optional consent ("Direct Contact"): contacting you proactively about promotions, new itineraries, or destination updates
• Analysing aggregate enquiry trends to improve our destination offerings (using anonymised data)
• Complying with legal and regulatory requirements

We will never use your personal data for automated profiling that produces legal or similarly significant effects without your knowledge.

5. Who We Share Your Data With

PT. Travelhood Group Wisata (Kekayon Journeys) does not sell, rent, or trade your personal data to third parties for commercial purposes. We may share your information only in the following limited circumstances:

5.1  Trusted Travel Suppliers

To organise your trip, we share relevant details (such as your name, group size, and specific requirements) with local suppliers including accommodation providers, transport companies, licensed tour guides, activity operators, and restaurants. These suppliers receive only the information necessary to deliver the specific service and are expected to treat your data with equivalent care.

5.2  Technology & Communication Platforms

We use standard business tools to manage enquiries and communications, which may include cloud-based email platforms, WhatsApp Business, CRM software, and Google Workspace. These platforms are subject to their own privacy and security standards.

5.3  Legal or Regulatory Requirements

We may disclose your data where required by Indonesian law, court order, or a request from a competent government authority. We will, where possible and permitted, inform you of such disclosures.

5.4  Business Transfers
In the event PT. Travelhood Group Wisata (Kekayon Journeys) undergoes a merger, acquisition, or restructuring, personal data may be transferred as part of that transaction. You will be notified of any such change and your rights will be preserved.

6. International Data Transfers

As an Indonesian DMC serving international travellers, your personal data may be stored or processed outside Indonesia — for example, when you send us an enquiry from overseas or when we use cloud-based services hosted abroad.
In accordance with the PDP Law, we take reasonable steps to ensure that any cross-border transfer of personal data is protected to a standard at least equivalent to the protections afforded in Indonesia. Where required, we will put in place appropriate safeguards before transferring data internationally.

7. How Long We Keep Your Data

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our general retention practices are:

• Enquiry data (no booking confirmed): retained for up to 24 months from last contact to enable follow-up
• Booking and trip data: retained for up to 5 years following trip completion, in line with Indonesian commercial record-keeping obligations
• Financial and invoicing records: retained as required under Indonesian tax law
• Marketing communication preferences: retained until you withdraw consent or opt out

After the applicable retention period, your data is securely deleted or anonymised.

8. How We Protect Your Data

PT. Travelhood Group Wisata (Kekayon Journeys) implements reasonable technical and organisational security measures to protect your personal data from unauthorised access, loss, alteration, or disclosure. These include:

• SSL encryption on our website contact forms
• Password-protected and access-controlled internal systems
• Limiting data access to staff members who require it to handle your enquiry
• Regular review of our data handling practices

While we strive to protect your personal data, no transmission over the internet or electronic storage system is completely secure. In the event of a data breach that is likely to harm your interests, we will notify you and the relevant authority without undue delay, as required by the PDP Law.

9. Your Rights Under Indonesian Law (PDP Law)

As a data subject under Indonesia's Law No. 27 of 2022, you have the following rights with respect to your personal data:

• Right to Information: to be informed about how your personal data is collected and used
• Right to Access: to request a copy of the personal data we hold about you
• Right to Rectification: to request correction of inaccurate or incomplete data
• Right to Erasure ("Right to be Forgotten"): to request deletion of your data, subject to legal retention obligations
• Right to Withdrawal of Consent: to withdraw consent for processing at any time without affecting prior lawful processing
• Right to Object: to object to processing based on legitimate interests
• Right to Data Portability: to receive your data in a structured, commonly used format
• Right not to be subject to automated decision-making: we do not use automated profiling for decisions with significant effects

To exercise any of these rights, please contact us at sales@kekayontravel.com. We will respond within 72 hours as required by the PDP Law, and aim to resolve your request promptly.

10. Cookies and Website Analytics

Our website uses cookies — small text files stored on your device — to improve your browsing experience and to analyse how visitors use our site. Cookies we may use include:

• Essential cookies: required for the website to function correctly (e.g. form submission)
• Analytics cookies: to understand aggregate website usage (e.g. Google Analytics, with anonymised IP addresses)
• Preference cookies: to remember your language or region preferences

You can control or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our website. We do not use cookies to serve third-party advertising.

11. Children's Privacy

Our services are not directed at children under the age of 18. We do not knowingly collect personal data from children without the verifiable consent of a parent or legal guardian. If you believe a child has submitted data to us without such consent, please contact us immediately at sales@kekayontravel.com and we will delete the relevant information promptly.

12. Direct Marketing & Communication Preferences

We will only contact you for direct marketing purposes (such as travel inspiration, seasonal promotions, or new itinerary announcements) if you have ticked the optional "Direct Contact" consent box on our enquiry form, or if you have otherwise opted in.

You may unsubscribe from marketing communications at any time by:

• Replying "STOP" or "UNSUBSCRIBE" to any of our messages
• Emailing sales@kekayontravel.com with a request to be removed from our marketing list

Opting out of marketing will not affect our ability to contact you about an active travel enquiry or confirmed booking.

13. Links to Third-Party Websites

Our website may contain links to external websites (such as accommodation partners, tourism boards, or review platforms). PT. Travelhood Group Wisata (Kekayon Journeys) is not responsible for the privacy practices or content of those external sites. We encourage you to review their individual privacy policies before submitting personal data.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. When we make material changes, we will post the updated policy on our website with a revised effective date. Where required, we will notify you directly. Continued use of our services following any changes constitutes your acceptance of the updated policy.

15. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please contact us:

We are committed to addressing your concerns promptly and fairly.

This Privacy Policy is governed by Indonesian Law No. 27 of 2022 on Personal Data Protection (UU Perlindungan Data Pribadi / PDP Law).

Kekayon Journeys takes the security and privacy of your data very seriously.