Information We Collect
We collect the following categories of information:
- a) Information you provide directly
- Name, email address, phone number, and postal address
- Booking details (dates, number of guests, room preferences, special requests)
- Payment information (processed via Cloudbeds and our payment processors — we do not store full card numbers)
- Communications with us (email, WhatsApp, contact forms, live chat)
- Marketing preferences (e.g., when you subscribe to our newsletter or opt into promotional offers)
- b) Information collected automatically
- IP address, browser type, device information
- Pages visited, time spent on site, referral source
- Cookies and similar tracking technologies (see Section 6)
- c) Information from third parties
- Booking details from third-party platforms (e.g., Airbnb, Booking.com) when you book through those channels
- Data from advertising platforms (Meta, Google) used to measure and optimize campaigns
How We Use Your Information
We use your information to:
- Process and manage your booking, payments, and stay at Villa Onu
- Communicate with you about your reservation, transfers, and guest services
- Send you marketing communications, including newsletters, promotional offers, discount codes, and updates about Villa Onu and the Mentawai Villas group — where you have given consent or where otherwise legally permitted
- Add your email address to our mailing list (hosted on ActiveCampaign) for the above purposes
- Run advertising and remarketing campaigns on platforms such as Meta (Facebook/Instagram) and Google, including showing you or similar audiences relevant ads based on your interaction with our website or past bookings, where legally permitted
- Improve our website, services, and guest experience through analytics
- Comply with legal, tax, and regulatory obligations
- Prevent fraud and maintain the security of our systems
Legal Basis for Processing (GDPR)
If you are located in the European Economic Area or UK, we rely on the following legal bases:
- Contractual necessity — processing needed to fulfill your booking
- Consent — for marketing emails, newsletters, and non-essential cookies/advertising trackers; you may withdraw consent at any time
- Legitimate interest — for basic analytics, fraud prevention, and improving our services, balanced against your rights
- Legal obligation — for tax, accounting, and regulatory recordkeeping
Marketing Communications & Consent Management
How consent is captured
- When you make a booking, sign up via our website popup, or otherwise provide your email, we ask for your explicit opt-in before adding you to our marketing list, unless you are an existing guest and local law permits soft opt-in marketing about similar services.
- Consent is recorded with a timestamp and source (e.g., booking form, website popup, in-person) in our email marketing platform, ActiveCampaign.
What you’re consenting to
- Newsletters (property updates, surf conditions, local events)
- Promotional offers and discount codes
- Being included as a custom or lookalike audience for remarketing ads on Meta and Google, where legally permitted and where you have not opted out
Unsubscribing / withdrawing consent
- Every marketing email includes an unsubscribe link. Clicking it removes you from future newsletters and promotional emails immediately.
- You may also email us at hello@villaonumentawai.com or WhatsApp +62 812 3777 9407 to request removal from our mailing list or to object to advertising use of your data.
- Unsubscribing from marketing emails does not affect transactional emails related to an active or upcoming booking (e.g., confirmations, check-in instructions).
- We will action unsubscribe/opt-out requests within [30 days] as required by applicable law.
How We Share Your Information
We share personal data with the following categories of third parties, only as needed to operate our business:
| Recipient | Purpose |
| Cloudbeds (property management system) | Booking, reservation, and payment processing |
| ActiveCampaign | Email marketing, newsletters, automation |
| Meta (Facebook/Instagram) and Google Ads | Advertising, remarketing, audience matching |
| Payment processors | Secure payment handling |
| Third-party booking platforms (Airbnb, Booking.com, etc.) | Booking fulfillment when reserved through those channels |
| Local service providers (transfers, tours) | Coordinating your stay, where relevant to your booking |
| Legal/regulatory authorities | Where required by law |
We do not sell your personal information to third parties. Where we share data with advertising platforms for remarketing (e.g., uploading a hashed email list to build a custom audience), this is done only for guests/subscribers who have consented to marketing, and you can opt out at any time.
Cookies & Tracking Technologies
Our website uses cookies and similar technologies to:
- Enable core site functionality
- Analyze site traffic and guest behavior (analytics cookies)
- Support advertising and remarketing (e.g., Meta Pixel, Google Ads tags)
You can control cookies through your browser settings and, where required, through a cookie consent banner on our website that lets you accept or decline non-essential cookies (analytics and advertising). Declining advertising cookies will not prevent you from browsing or booking, but may result in less relevant ads.
Data Storage & Retention
- Your data is stored securely using industry-standard measures (encryption in transit, access controls) across our systems (Cloudbeds, ActiveCampaign, and internal records).
- Booking and payment records are retained as long as necessary to fulfill the booking and to meet Indonesian tax/accounting record-keeping requirements.
- Marketing data (email list) is retained until you unsubscribe or request deletion, or until it becomes inactive per our list hygiene practices.
- Where your data is transferred outside Indonesia (e.g., to servers used by Cloudbeds or ActiveCampaign), we rely on the safeguards those providers offer (such as standard contractual clauses, where applicable) to protect it.
Your Rights
Depending on your location, you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data (“right to be forgotten”)
- Object to or restrict certain processing (including marketing and advertising use)
- Withdraw consent at any time
- Request a copy of your data in a portable format
- Lodge a complaint with your local data protection authority (e.g., an EU/UK supervisory authority, or Indonesia’s Kementerian Komunikasi dan Digital under the PDP Law)
To exercise any of these rights, contact us at hello@villaonumentawai.com or +62 812 3777 9407. We will respond within a reasonable timeframe as required by applicable law.
Children’s Privacy
Our website and services are not directed at children under 16, and we do not knowingly collect personal data from children without parental consent. If you believe a child has provided us data without appropriate consent, contact us and we will delete it.
Data Security
We take reasonable technical and organizational measures to protect your data against unauthorized access, loss, or misuse. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
International Data Transfers
As an Indonesia-based business serving international guests, your data may be processed in Indonesia and in the countries where our service providers (Cloudbeds, ActiveCampaign, Meta, Google) operate their servers, which may include the United States and EU. We take steps to ensure such transfers are protected in line with applicable law.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The “Last updated” date at the top will reflect the most recent revision. Material changes affecting how we use marketing data will be communicated via email or a notice on our website where required.
Contact Us
If you have questions about this Privacy Policy or how we handle your data:
Villa Onu Mentawai
Email: hello@villaonumentawai.com
Phone/WhatsApp: +62 812 3777 9407
Address: Katiet, South Sipora, Mentawai Islands, Indonesia
