Privacy Sovereignty

We adhere to the highest global standards. Whether you are a resident of the European Union (GDPR), California (CCPA), or Indonesia (OJK/PDP), your data is treated with the same military-grade protection.

We use Microsoft Clarity to better understand how you use our website. Clarity captures how you interact with our site using session replays and heatmaps. This information helps us improve your user experience and identify technical friction points. Data is processed in accordance with Microsoft's Privacy Statement.

We collect only what is necessary for a seamless expedition: identity verification for maritime manifest, dietary/medical requirements for onboard safety, and payment orchestration for secure charters.

Your data is encrypted at rest and in transit using industry-leading protocols. Our infrastructure is audited for 'Universal Hegemony' security standards, ensuring no unauthorized access.

You maintain absolute sovereignty over your data. You have the right to request access, rectification, or complete erasure ('Right to be Forgotten') from our global registries at any time.

To request deletion of the personal data we hold about you — including data collected through WhatsApp — please follow the instructions at https://www.komodoexplorer.com/data-deletion.html. You may also contact us directly using the details in the Privacy Contact section below.

With your consent, we share certain identifiers — your email and/or phone number, irreversibly hashed (SHA-256) — with Google and Meta solely to measure the effectiveness of our advertising (conversion measurement), alongside technical ad identifiers such as GCLID and fbclid. This is done only on the basis of your consent under Indonesia's Personal Data Protection Law (UU No. 27 of 2022) and applicable GDPR rules. You may withdraw your consent at any time via the privacy banner; withdrawal applies going forward and does not affect our service, availability, or pricing. If you decline, we do not share your email or phone number with Google or Meta.

Our internal business systems connect to Google API Services — Google Ads, Google Analytics, Google Search Console, and Google Drive/Google Sheets — through secure OAuth authorization granted by our own company Google accounts. Data accessed: advertising campaign statistics, aggregated website analytics reports, search performance data, and operational spreadsheets (such as vessel schedules) belonging to our company accounts. We do not access, collect, or store the Google account data of website visitors or customers. Data usage: this information is used solely to operate, measure, and improve our own services and advertising campaigns, and for no other purpose. Storage and protection: OAuth credentials are stored server-side in access-restricted configuration, transmitted only over encrypted connections (TLS), and are never exposed in client-side code; access is limited to authorized administrators. Sharing: we do not sell, rent, or transfer Google user data to third parties. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements (developers.google.com/terms/api-services-user-data-policy). You may revoke this access at any time in your Google Account permissions (myaccount.google.com/permissions) or by contacting info@komodoexplorer.com.

To operate our booking, communication, and payment services, we share limited personal data with the following third-party service providers, each for a specific purpose. Meta Platforms, Inc. operates the WhatsApp Business Cloud API channel you use when you message us on WhatsApp, and processes advertising identifiers (hashed email/phone, click identifiers) for ad conversion measurement described in Section 6. Cerebras Systems, Inc. (United States), an AI inference provider, may process WhatsApp message text to help our team draft or route a reply — see the Automated Processing and AI Assistance section below. Xendit (PT Xendit, Indonesia) and PayPal process your email address as part of creating and completing a payment for your booking. Brevo (formerly Sendinblue) sends transactional emails on our behalf, such as booking confirmations and account-related notices, using your name and email address. Google LLC, in addition to the Google API access described in Section 7, also maintains an off-site backup of our operational database — which may include your booking and message records — for disaster-recovery purposes; see the Backups section below. Cloudflare, Inc. provides content delivery, DNS, and security infrastructure in front of our website and WhatsApp integration, handling encrypted network traffic without independently storing your personal data for its own purposes. We do not sell your personal data to any third party. We enter into these relationships on the basis of performing our contract with you, our legitimate interest in operating and securing our services, or your consent for advertising measurement as described in Section 6 — consistent with Indonesia's Personal Data Protection Law (UU No. 27 of 2022) and, for EEA visitors, the GDPR. Some of these providers are located outside Indonesia, including in the United States. Where we transfer personal data internationally, we rely on each service provider's own data-protection commitments and contractual safeguards.

When you contact us through WhatsApp, we receive and store your phone number, profile name, and the content of your messages through the WhatsApp Business Cloud API, operated by Meta Platforms, Inc. We use this data to respond to your inquiry, manage your booking, and provide customer service; your conversation may be mirrored into our internal customer-relationship system so our team can see conversation history when assisting you. We do not currently apply a fixed maximum retention period to WhatsApp conversation history — it is retained as part of our customer-service and booking records unless you ask us to delete it. You can ask us to delete the data we hold about your WhatsApp conversations at any time (see Data Deletion Requests above); doing so does not delete your own copy of the conversation on your device, or Meta's own copy, which is governed by Meta's policies and managed separately through WhatsApp.

Some of your messages to us may be processed by an AI inference provider, Cerebras Systems, Inc. (United States), to help our team understand your request and draft or route a reply more quickly — for example, when a message does not match our standard automated responses, or to prepare a first-touch welcome message. This automated processing helps prepare a response; it does not make any decision that produces legal effects or similarly significantly affects you, such as accepting or rejecting a booking or setting a price, without a human being involved. Automated drafts are intended to support — not replace — our customer-service team, and a human is involved in your booking and in any decision that affects your reservation or its price.

We maintain regular backups of our operational database — which can include booking details and WhatsApp conversation records — for disaster-recovery purposes. These backups are stored in an access-restricted Google Drive folder used by our company, and we keep a limited number of recent backups, automatically removing older ones.

If you have questions about this policy or how we handle your personal data, or wish to exercise any of the rights described above, please contact PT Komodo Explorer Indonesia at info@komodoexplorer.com, or by mail at Jl. Kerta Dalem Sari IV No.2, Desa/Kelurahan Sidakarya, Kec. Denpasar Selatan, Kota Denpasar, Provinsi Bali, Kode Pos: 80224 (PT Komodo Explorer Indonesia, NIB 1805260128363).