Hotels.id Privacy Policy

1. Data Controller

The personal data controller for the processing described in this Policy is Otoyo, LLC, a company organized in the State of Arizona, United States (Arizona Registration Number: L19131026), registered as a Foreign Private Scope Electronic System Operator with the Ministry of Communication and Digital Affairs of the Republic of Indonesia. You can contact us at halo@hotels.id.

2. Scope

2.1 This Policy applies to the hotels.id website, the Partner Center (partners.hotels.id), the Hotels.id mobile applications, and the parts of booking.hotels.id and flights.hotels.id controlled by Hotels.id, such as Hotels.id's analytics.

2.2 Bookings on booking.hotels.id. The data you provide when booking a hotel, including guest names, contact details, and payment data, is collected and processed by Nuitée Travel Limited as a separate personal data controller, under Nuitée's Privacy Policy and Cookie Policy displayed on booking.hotels.id. Nuitée shares the data needed to fulfill your booking with hotels and suppliers.

2.3 Flights and partner services. Searches on flights.hotels.id are processed using Travelpayouts technology. When you go to the website of an airline, travel agency, or other Third-Party Partner, your data is processed by that party under its own privacy policy.

2.4 We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies.

3. Personal Data We Process

3.1 Data you give us directly:

(a) Questions and communications — your name, email address, and the content of messages you send us;

(b) Partner Center accounts — name, email address, account identifier, role, organization membership, and property access records;

(c) Property claims and verification — documents and evidence of authority, review history, and related communications. Verification evidence is confidential and is not shown publicly;

(d) Property Content — photos, descriptions, promotions, and other materials you submit, including any personal data they contain;

(e) Subscription billing — billing data needed to manage Hotels.id Partner subscriptions. Card data is processed by Stripe; we store only information such as customer identifiers, subscription status, invoices, and payment status.

3.2 Data collected automatically:

(a) Technical and device data — IP address, browser and device type, operating system, language settings, and session and security identifiers;

(b) Usage data — pages you visit, searches you make on our sites, access times, referring pages, and your interactions with the Services;

(c) Link-click data — records that you clicked a link to booking.hotels.id, flights.hotels.id, or a Third-Party Partner;

(d) Mobile app data — technical device data needed for the app to work, such as app version, device model, and, where that feature is enabled, error reports.

3.3 Data we receive from third parties:

(a) From Nuitée — limited information about bookings made through booking.hotels.id, such as booking number, hotel, stay dates, transaction value, commission, booking status, and, where available, the booker's name and email address, for commission reporting, customer support, and fraud prevention;

(b) From affiliate networks and Third-Party Partners — transaction reports for commission calculation, generally consisting of the date, value, and status of a transaction without full identity data;

(c) From our service providers — authentication information from Clerk and payment information from Stripe as needed to manage accounts and subscriptions.

3.4 We do not knowingly request specific personal data as defined in the PDP Law, such as health, biometric, or criminal record data. Please do not send such data to us.

4. Purposes and Legal Bases

We process your personal data for the following purposes, on the legal bases set out in the PDP Law:

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

5. Cookies and Similar Technologies

5.1 We use cookies and similar technologies that are needed to run the Services, such as keeping Partner Center sessions signed in, as well as analytics cookies.

5.2 We use Google Analytics on hotels.id and booking.hotels.id to understand how visitors use the Services, such as page views and interactions. Google may process this data in the United States and other countries.

5.3 Third-Party Partners and affiliate networks may place cookies or tracking codes on your device after you click a partner link, to record that your visit came from Hotels.id.

5.4 On booking.hotels.id, cookies are also used by Nuitée and can be managed through the "Cookie preferences" menu on that site.

5.5 You can manage or delete cookies through your browser settings. Blocking certain cookies may affect how the Services work, such as signing in.

6. Disclosure of Personal Data

6.1 We do not sell your personal data.

6.2 We may disclose personal data to:

(a) Data processors that process data on our behalf under contract, including Clerk (authentication), Stripe (subscription payments), Google (analytics), and hosting, infrastructure, data storage, and email providers;

(b) Nuitée, to the extent needed to support customer service, handle complaints, or prevent fraud relating to bookings on booking.hotels.id;

(c) The public, for Property Content and property information approved for publication;

(d) Competent authorities, where required by law, court order, or a valid official request;

(e) Professional advisers, such as lawyers, accountants, and auditors, who are bound by confidentiality obligations;

(f) Prospective acquirers or successors, in connection with a merger, acquisition, or transfer of business, provided personal data remains protected under this Policy and with notice to you as required by the PDP Law.

7. Transfers Outside Indonesia

Hotels.id is operated from outside Indonesia, and we and our service providers may process your personal data in the United States, the European Union, and other countries. We transfer personal data outside Indonesia in accordance with the PDP Law, by ensuring an equal or higher level of protection, adequate and binding data protection safeguards, or your consent. By using the Services, you understand that your data may be transferred as described in this Section.

8. Retention

8.1 We keep personal data for as long as needed to achieve the purposes for which it is processed, including providing the Services, managing accounts and subscriptions, handling requests and disputes, maintaining security, and meeting legal, tax, and accounting obligations.

8.2 Retention periods:

8.3 When the retention period ends, personal data is deleted, destroyed, or anonymized. Data is kept longer only where the law requires it or where it is needed to handle an ongoing dispute or legal claim.

9. Security

9.1 We apply reasonable technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, and destruction, including encryption in transit, access controls, and need-to-know access restrictions. However, no system can be guaranteed to be completely secure.

9.2 If a personal data protection failure occurs, we will give written notice to you and to the competent authority in accordance with the PDP Law, no later than 3 x 24 (three times twenty-four) hours after we become aware of it.

10. Your Rights as a Data Subject

Under the PDP Law, you have the right to:

(a) obtain information about the identity, legal basis, purpose of the request and use of your personal data, and the accountability of the party requesting your personal data;

(b) complete, update, and/or correct errors and/or inaccuracies in your personal data;

(c) access and obtain a copy of your personal data;

(d) end the processing of, delete, and/or destroy your personal data;

(e) withdraw consent you have given for the processing of your personal data;

(f) object to decisions based solely on automated processing, including profiling, that have legal effects or significantly affect you;

(g) delay or restrict the processing of your personal data in proportion to the purpose of processing;

(h) sue and receive compensation for violations in the processing of your personal data in accordance with applicable law; and

(i) obtain and/or use your personal data in a structured and/or commonly used or machine-readable format, and transmit it to another personal data controller.

To exercise these rights, send a request to halo@hotels.id with the subject "Personal Data Request". We may ask you to verify your identity before processing the request and will respond within the time limits set by the PDP Law. Some rights may be limited as provided in the PDP Law, for example for law enforcement or to meet legal obligations. For booking data controlled by Nuitée, please send your request directly to Nuitée in accordance with Nuitée's Privacy Policy.

11. Children's Personal Data

The Services are not intended for children under 18. We do not knowingly collect personal data from children without the consent of a parent or guardian. If you become aware that a child has given us personal data without such consent, please contact us so we can delete it.

12. Marketing Communications

We send marketing communications only if you have agreed to receive them. You may unsubscribe at any time through the link in those emails or by contacting us. We may still send service-related notices, such as billing notices and policy changes.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The latest version will be published on this page with an updated effective date. For material changes, we will give reasonable notice through the Services or by email before the changes take effect.

14. Language

This Privacy Policy is made in Indonesian and English. If there is any difference in interpretation, the Indonesian version prevails.

15. Contact

Privacy requests and questions: halo@hotels.id (subject: "Personal Data Request")
For hotel booking data on booking.hotels.id: contact Nuitée as set out in Nuitée's Privacy Policy on booking.hotels.id