Coconut Collective

Privacy policy

Last updated 2 November 2026

1. Who we are

Coconut Collective ("Coconut Collective", "we", "us"), Jalan Raya Kuta–Mawun, Kuta, Pujut, Lombok Tengah, NTB, Indonesia, decides how your personal data is used (the data controller). We follow Indonesia's Personal Data Protection Law (Law No. 27 of 2022) and, for guests and visitors in the European Union and the United Kingdom, the GDPR. Questions about your data: contact@coconutcollectivelombok.com.

2. What we collect

When you book: your name, email address, WhatsApp number, dates, number of guests, the villa or room, and any requests you share.
Payments: the amount, method, date and status. Card and bank details are entered on Xendit's secure page; we never see or store them.
When you stay: passport or ID details of each guest, which Indonesian law requires us to register; your arrival details for the airport pickup; and notes that help us look after you (for example a cot or a late arrival).
When you contact us or enquire: your name, email, phone and message, including enquiries about investing and registrations of interest in our projects.
When you use the website: technical data our hosting needs to run the site securely (IP address, browser, pages requested), and the currency you chose, stored on your own device.

3. Why we use it

To take, confirm and manage your booking, collect payment and prepare your stay (to perform our contract with you).
To contact you before and during your stay, by email and WhatsApp (contract).
To register guests with the authorities and keep tax and accounting records (legal obligation).
To answer your enquiry and, if you ask, send you information about our projects (your request and our legitimate interest).
To keep the website and payments secure and prevent fraud (legitimate interest).
To send occasional offers for return stays, only if you ticked the box. You can unsubscribe at any time (consent).

5. Data outside Indonesia

Some of these services store data in other countries, such as Singapore, the European Union or the United States. We only use providers that protect personal data to a standard comparable to Indonesian law and the GDPR.

6. How long we keep it

Booking, payment and guest registration records: as long as tax, accounting and registration rules require, generally up to 10 years.
Enquiries and messages: up to 2 years after our last contact, unless they lead to a booking or agreement.
Marketing consent: until you unsubscribe.

7. How we protect it

Access to guest data is limited to the team members who need it, and protected by logins. The website uses encrypted connections (HTTPS), and payments go through a licensed payment provider. If a data breach puts your rights at risk, we inform you and the authorities as the law requires.

8. Cookies and storage

The website only uses what it needs to work: your currency choice is remembered on your device, and team members who log in to manage the website get a login cookie. We don't use advertising cookies. If we add visitor statistics or advertising tools, we will update this policy and ask for consent where required.

9. Children

Bookings are made by adults. We only hold children's data where needed for the stay, such as their names and passports for guest registration, given by their parent or guardian.

10. Your rights

You can ask to see your data, correct it, delete it, receive a copy, object to or limit its use, and withdraw consent at any time. Email contact@coconutcollectivelombok.com or WhatsApp +62 813 5340 4277. We reply within 14 days. Some data we must keep by law (for example payment records). You can also complain to the data protection authority in Indonesia or in your own country.

11. Changes to this policy

We may update this policy, for example when we add a new service. The latest version is always on this page, with its date at the top. See also our terms and conditions.