🔒 Privacy Policy

PT. Diwira Wisata Indonesia ("Diwira", "we") is committed to protecting your privacy. This policy explains what data we collect, how we use it, and your rights over that data.

1. Data We Collect

a. Data you provide directly

• Full name — to confirm your booking
• Email address — to send confirmations and vouchers
• WhatsApp / phone number — to coordinate your tour
• Number of travelers, tour date, special requests — to prepare our service

b. Data collected automatically

• IP address — for security and fraud prevention
• User Agent (browser/device) — for compatibility
• Visit time — for website traffic analysis

c. Data we do NOT collect

2. How We Use Your Data

• Process and confirm your tour booking
• Send vouchers, itineraries, and payment confirmations by email
• Coordinate tour operations (drivers, guides, partners)
• Send relevant information about schedule changes or weather conditions
• Improve our service quality based on feedback
• Comply with legal and tax obligations (Corporate Income Tax)

3. Cookies & Tracking

This website uses a minimal amount of cookies and browser storage. For full details, see our Cookie Policy.

Third-party services that may set cookies (live chat, maps and reviews) are only loaded after you allow Functional cookies in our cookie banner. You can change or withdraw your choice at any time via Cookie Settings; see section 5 of the Cookie Policy.

a. Our own storage

• Local Storage (visitors) — saves your wishlist on your own device only.
• Local Storage (admin only) — stores the admin authentication token and sound preference. This does not apply to guests/customers.

b. Third-party services

To provide chat, reviews, maps, and fonts, this website loads services from the following third parties. These providers may set their own cookies or similar technologies, and may receive your IP address and browser information when your browser connects to their servers:

• Mekari Qontak (qontak.com) — live chat so you can contact our team.
• Elfsight (elfsight.com) — displays Google Reviews on our website.
• Google Maps (maps.googleapis.com, google.com/maps) — location search, distance calculation for Airport Transfer, and embedded maps.
• Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — delivers the typefaces used on our pages.
• Cloudinary (res.cloudinary.com) — delivers images; your IP address is received when images load.
• Google tag / Google Ads (googletagmanager.com, google.com) — website statistics and ad conversion measurement. Only after you allow "Analytics" / "Marketing" in Cookie Settings.
• Meta Pixel (facebook.com, connect.facebook.net) — measures visits and bookings that come from our Facebook/Instagram ads. Only after you allow "Marketing" in Cookie Settings.

These third parties process data under their own privacy policies. Please review them for details.

4. Sharing Data with Third Parties

We share personal data only where necessary to deliver our services, fulfill legal obligations, or operate the website:

a. Operational and legal partners

• Drivers / tour partners — name and phone number for pickup coordination
• Payment gateway (Faspay) — transaction data for payment processing
• Tax authority (DJP) — in accordance with Corporate Income Tax reporting obligations

b. Technology and infrastructure service providers

As described in Section 3 and our Cookie Policy, certain technical data (such as IP address and device information) may be processed by our technology providers:

• Mekari Qontak communication and customer support
• Elfsight — customer reviews widget display
• Google (Maps API & Fonts) — location search, route distance calculations, and typography
• Cloudinary — content delivery network (CDN) for website imagery

All third parties are required to keep data confidential under their cooperation agreements.

Payment Data

When you make a payment, your transaction data (name, booking amount, payment method) is shared with our payment gateway provider, Faspay, for processing. All payments are processed in Indonesian Rupiah (IDR) based on the Bank Indonesia JISDOR exchange rate. We do not store your credit card details on our servers.

5. Refund Policy

Refunds take 3-7 business days depending on the payment method.

6. Data Security

• Data is stored on Hostinger servers with SSL/TLS encryption
• The database is backed up automatically every day
• Admin passwords are encrypted with bcrypt (one-way hash)
• Admin access is protected by JWT tokens with a 24-hour expiry
• Rate limiting is active to prevent brute-force attacks

7. Data Retention

Booking data is kept for 5 years for tax reporting purposes in accordance with Indonesian tax law. After that, the data is anonymized or deleted.

8. Your Rights

• Access — you have the right to request a copy of your personal data
• Correction — you have the right to request correction of inaccurate data
• Deletion — you have the right to request deletion of your data (except where required by law)

To exercise these rights, contact us using the details below.

9. Policy Changes

We may update this policy from time to time. Material changes will be communicated by email or a notice on the website. The effective date is always shown at the top.

10. Contact Us