Privacy Policy

1. Data Controller Identity

The data controller of personal information collected through this site is:

• Business Name: Destinexia
• Line of Business: Landing page website services for travel, tour, car rental, and SME businesses
• Location: Bali, Indonesia
• Email: info.destinexia@gmail.com
• WhatsApp: +62 897-2350-111

2. Data We Collect

We collect several types of data — both information you provide directly and information collected automatically when you interact with our site or ads.

a. Data you provide directly:

• WhatsApp number and conversation content when you reach us via the WhatsApp button. Note: WhatsApp conversations are processed by WhatsApp/Meta and governed by their privacy policy; we only receive your messages in our WhatsApp Business inbox.
• Additional information you voluntarily share during consultation or ordering (e.g. business name, services of interest). This site has no contact form — all pre-sales communication happens via WhatsApp.

3. Data Collected Automatically

When you access this site, certain technical data is automatically collected for security, analytics, and ad measurement purposes:

• IP address, approximate geographic location (city/country), device type, operating system, and browser you use.
• Date and time of visit, pages viewed, time on page, and referring page — recorded in standard server access logs.
• Meta Pixel events such as PageView, ViewContent, Lead, and Contact, including parameters related to the page and button you interacted with.
• Meta cookies: _fbp, _fbc, and fr placed in your browser by Meta for advertising purposes.

4. How We Use Your Data

We use your data for the following purposes, on the legal basis of your consent and/or our legitimate interest as a service provider:

• Responding to enquiries, providing quotations, and following up on your WhatsApp conversations.
• Measuring the effectiveness of our ad campaigns on Meta (Facebook & Instagram) — including conversion reporting, ad delivery optimisation, and attribution.
• Building Custom Audiences and Lookalike Audiences to show more relevant ads to you and to prospective customers with similar profiles.
• Complying with legal obligations, performing internal audits, and responding to lawful requests from competent authorities.

5. Cookies and Tracking Technologies

Our site uses cookies and similar technologies to operate the site and measure advertising performance:

• Functional (first-party) cookies: required so that navigation (HTMX) works correctly.
• Meta Pixel (third-party): sets the _fbp cookie and, if you arrive from a Meta ad, _fbc. These cookies enable ad measurement and retargeting.
• Meta-domain cookies (fr, etc.): set directly by facebook.com when you are logged into Meta, outside our control.
• You can reject or delete cookies through your browser settings. Some site features may not work optimally if cookies are disabled.
• You can also manage your Meta ad preferences at Facebook Ad Preferences.

6. Sharing Data with Third Parties

We do not sell your personal data. We share data only with the third parties listed below, and only to the extent necessary to operate our service and ad campaigns:

• Meta Platforms, Inc. (Facebook, Instagram, WhatsApp) — through Meta Pixel, Conversions API, and WhatsApp for communication and ad measurement. See Meta's Privacy Policy.
• Our website hosting provider — which stores site files and server access logs.
• Competent authorities — where disclosure is required by law, court order, or a lawful government request.

7. Advertising via Meta (Facebook & Instagram)

We run paid advertising on Meta platforms. To measure results and optimise ads, we use a combination of the following tools:

• Meta Pixel — JavaScript code loaded in your browser that sends events (PageView, Lead, Contact, etc.) directly to Meta.
• Conversions API (CAPI) — server-side delivery of the same events from our server to Meta. Identity fields (email, phone, IP, user-agent) are hashed with SHA-256 before being sent, so they cannot be read in plain text.
• Custom Audiences — we may upload hashed email/phone lists to show ads to customers who have previously interacted with us.
• Lookalike Audiences — Meta finds other users whose profiles resemble our existing customers, based on hashed data.
• You may disable activity-based advertising at any time via Meta Ad Preferences.

8. Data Storage and Retention

We retain data only as long as necessary for the purposes set out in this policy, or as required by applicable law.

• Server access logs (IP, timestamp, URL, user-agent): recorded as standard by our hosting provider at the web-server (Apache) level. Retention follows the hosting provider's policy — we do not add any application-level logging.
• WhatsApp conversations: stored in our WhatsApp Business inbox and governed by Meta/WhatsApp retention policies. We can delete conversations on our side upon your request.
• Data held on Meta's side (Pixel events, Custom Audiences, etc.): governed by Meta's retention policies and outside our control.
• You may request earlier deletion of your data under "Your Rights" below.

9. International Data Transfers

Our service provider (Meta/WhatsApp) processes data on servers located outside Indonesia, including in the United States and the European Union. By using this site you acknowledge that your data may be transferred outside Indonesia, subject to equivalent protections through those providers' contracts and privacy policies.

10. Data Security

We apply reasonable technical and organisational measures to protect your data, including:

• Encrypted connections via HTTPS / TLS across the entire site.
• Access to server logs is restricted to authorised personnel only.
• However, no method of electronic transmission or storage is fully secure. We cannot guarantee absolute security.

11. Your Rights as a Data Subject

Under Indonesia's UU PDP No. 27/2022 (and the EU GDPR for visitors from the European Union), you have rights over your personal data. Please note that we do not store your data in any database and we do not run any application-level logging. The data we hold about you is limited to: (i) standard web-server access logs held by our hosting provider (Apache), (ii) your WhatsApp conversation history in our WhatsApp Business inbox, and (iii) — if ad campaigns are active — your hashed presence in Meta audience lists.

Within that scope, you have the right to:

• Right of access: request a copy of the personal data we hold about you within the scope above.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your WhatsApp conversation on our side and/or removal from Meta audience lists. Web-server access logs at the hosting layer are managed by the hosting provider according to their retention policy.
• Right to withdraw consent: revoke consent you previously gave.
• Right to object to processing: including for marketing and targeted advertising.
• Right to lodge a complaint with the competent data protection authority.
• To exercise these rights, contact us via email or WhatsApp using the "Contact Us" section below. We will respond within 30 working days at the latest.

12. Children's Data

Our services are intended for business operators and are not directed at children under the age of 18. We do not knowingly collect personal data from children. If you become aware that your child has provided personal data to us, please contact us so that we can delete it promptly.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, regulations, or best practice. The latest version is always available on this page, with the relevant "Last updated" date. Significant changes will be communicated via an on-site notice or email (if we have your contact details).