Skip to main content

Policy

Privacy notice

Version 1.4 · Effective from 29 October 2026

This notice explains how Sanghyang Indah Spa Resort collects, uses, shares and protects your personal data when you visit this website, book rooms or services, or communicate with us. We process personal data in accordance with Indonesian Law No. 27 of 2022 on Personal Data Protection (PDP Law). Version 1.4 (29 October 2026) adds advertising measurement and remarketing with Google and TikTok; see sections 3, 4 and 6.

1. Data controller

The data controller is Sanghyang Indah Spa Resort, Jl. Raya Sirih KM 128, Cikoneng, Anyar District, Serang Regency, Banten 42166, Indonesia. Questions and requests about personal data can be sent to reservation@sanghyang.com or raised by phone at +62 254 600888.

2. Data we collect

  • Booking data: name, email address, phone number, stay dates, number of guests and rooms, children's ages (without children's names) to determine rates and room capacity, and any special requests you write.
  • Outlet reservation data: name, email address, phone number, date and time, number of guests, and form answers such as the occasion, allergies or dietary restrictions, and special requests when you book at our restaurants, bars, beach club or spa.
  • Outlet visit history and service notes: a summary of your visits to the same outlet (number of visits, no-shows, most recent visit) plus service tags (VIP, regular, group, special care) and short service-preference notes—such as a favourite table—written by authorised outlet staff. Staff must not write health or other sensitive data in these notes.
  • Health data for D'Spa treatments: your health screening answers (for example pregnancy, blood pressure or ingredient allergies), only with your explicit consent.
  • Dragon Beach Club age verification (21+): your date of birth is checked only when you book and is not stored; we record only the result.
  • Payment data: amount, method and transaction status. You enter card details directly on our payment partner's page; we never receive or store them.
  • Communication data: contact details and message content when you contact us by email, phone, WhatsApp or a form on the website.
  • Membership data: name, email address, membership tier (Sanghyang Platinum or Dragon VIP) and booking history if you become a member.
  • Technical data: IP address, device and browser type, pages visited, and cookie data as described in our Cookie Policy.

We do not ask for ID card, passport or other identity document numbers through the website. Guest identity is verified at check-in at the resort. Please do not write health information in the special requests field unless it is necessary for your stay.

3. Purposes and legal bases

  • Processing and managing bookings, payments, invoices, changes, cancellations and refunds — basis: performance of our contract with you.
  • Sending confirmations, invoices and QR e-tickets by email, and answering your questions by email, phone or WhatsApp — basis: performance of contract.
  • Processing outlet reservations and notifying the relevant outlet staff — basis: performance of a contract at your request.
  • Recognising returning guests and tailoring outlet service based on your reservation history at that outlet and staff service notes; history is not combined across outlets for outlet staff, and you may ask for the notes to be deleted at any time — basis: legitimate interests.
  • Keeping D'Spa treatments safe based on your health screening answers — basis: your explicit consent.
  • Enforcing the 21+ age limit at Dragon Beach Club — basis: compliance with legal obligations.
  • Preventing misuse of outlet capacity through no-show records kept in pseudonymised form; these records only require manual approval by staff, never automatic refusal — basis: legitimate interests.
  • Running the Sanghyang Platinum and Dragon VIP membership programme — basis: performance of contract under the membership terms.
  • Keeping financial and tax records — basis: compliance with legal obligations.
  • Keeping the website secure and preventing fraud and form abuse — basis: legitimate interests.
  • Measuring website performance and improving the visitor experience through analytics — basis: legitimate interests.
  • Measuring the results of our advertising on Google and TikTok and showing our ads to people who have visited this website (remarketing), using the Google tag (including Google Ads), Google Tag Manager and the TikTok Pixel; this includes using our Google Analytics data to count visits from our ads to key pages such as our booking and contact pages. We do not send the names, contact details or form answers you give us to Google or TikTok, and you can opt out at any time as described in section 7 of our Cookie Policy — basis: legitimate interests.
  • Sending offers and promotional information — basis: your consent, which you may withdraw at any time.

4. Who receives your data

We do not sell your personal data. We share it only to the extent necessary with the providers below. Most of them process it on our behalf under contract; Google, Microsoft and TikTok also use the data they receive through the analytics and advertising tags on this website for their own purposes, under their own privacy policies:

  • Exely — hotel reservation system and booking engine.
  • Xendit — payment and refund processing (Indonesia).
  • Vercel and Supabase — website hosting and database (Singapore).
  • Resend and Hostinger — transactional email delivery and our email services.
  • Telegram — operational notifications to outlet staff containing the reservation code, date, time and number of guests, without your name or contact details.
  • Cloudflare — anti-bot verification (Turnstile) on forms.
  • Google (Google Analytics 4) and Microsoft (Clarity) — website analytics.
  • Google (Google Ads, the Google tag and Google Tag Manager) — measuring our advertising and showing our ads to people who have visited this website (remarketing).
  • TikTok (TikTok Pixel) — measuring our advertising and showing our ads to people who have visited this website. Our marketing agency manages the pixel and our TikTok advertising account on our behalf and receives campaign reports.
  • GitHub — storage of encrypted database backups.

We may also disclose personal data when required by law or upon an official request from law enforcement authorities.

5. Transfers outside Indonesia

Some of the providers above process data in Singapore, the United States or other locations. These transfers are made in accordance with Article 56 of the PDP Law through binding processing agreements, data minimisation and additional safeguards such as encryption.

6. Retention

  • Booking, payment and invoice data: 10 years to meet corporate record-keeping and tax obligations.
  • Contact data of non-member guests: 24 months after check-out, then anonymised.
  • Member data: for as long as the membership is active plus 24 months.
  • Incomplete bookings: 30 days.
  • Bank account details for refunds: deleted 90 days after the transfer is completed.
  • Outlet reservation contact details and answers: 12 months after the service date, then anonymised.
  • Outlet service notes and tags: deleted together with the outlet reservation contact details, 12 months after your most recent service at that outlet.
  • D'Spa health screening answers: deleted 30 days after the service date.
  • Pseudonymised no-show records: 12 months after the most recent no-show.
  • Email and notification delivery status logs: 12 months.
  • Google Analytics 4 data: 14 months.
  • Advertising cookies: kept in your browser for the periods listed in our Cookie Policy; data that Google and TikTok receive is kept according to their own policies and our advertising-account settings.
  • Encrypted database backups: 7 days. Deleted data may remain in backups until they expire.

7. Security

We use TLS encryption on all connections, additional encryption for contact and bank account data in our database, role-based access control, logging of staff access and encrypted backups. If a personal data breach occurs, we will notify you and the competent authority in writing within 3 × 24 hours in accordance with Article 46 of the PDP Law.

8. Your rights

Under Articles 5 to 13 of the PDP Law, you have the right to:

  • obtain information about the processing of your personal data;
  • complete, update or correct inaccurate data;
  • access and obtain a copy of your personal data;
  • end the processing of, delete or destroy your personal data, except data we must keep by law;
  • withdraw any consent you have given;
  • object to decisions based solely on automated processing (this website makes no such decisions);
  • postpone or restrict processing;
  • sue and receive compensation for violations in the processing of your personal data; and
  • obtain and use your personal data in a structured format.

Send your request to reservation@sanghyang.com with the subject "Personal Data Request". Once your identity has been verified, we respond within 3 × 24 hours as required by the PDP Law.

9. Children's data

This website is not directed at children. Bookings are made by adults, and for child guests we only process their age to determine rates and room capacity.

10. Third-party links and services

This website contains links to and services from third parties, such as the Exely booking engine, Xendit payment pages, Google Maps, WhatsApp and social media. Data processing on those services is governed by each provider's own privacy policy.

11. Changes to this notice

We may update this notice from time to time. The version and effective date are shown at the top of this page, and we announce material changes on this website. If the English and Indonesian versions differ, the Indonesian version prevails.