Your data at Bali Zoo Breakfast

Briefly

Every page of Bali Zoo Breakfast opens without an account. We set no cookies and run no analytics, advertising or tracking scripts. What does reach us is the connection data any web server sees when it sends a page, described below.

Nothing is booked on this site. Choosing an outing sends you to GetYourGuide to book it, and their privacy rules govern from that point.

Who stands behind the pages

Bali Zoo Breakfast
[email protected]

No law obliges us to appoint a data protection officer, so we have none. Direct any question about your data to [email protected].

Records on the server

With every request for a page or file, the web server notes the IP address that asked, the date and time, the address requested, the page you came from and the text string your browser sends to describe itself and its system.

We need these logs to deliver the site, keep it steady, spot attacks and misuse, and count how often each page is read. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a site that runs and stays safe. Raw logs are deleted within 90 days; counts without IP addresses last longer. A hosting company runs the server and handles the data for us, on our instructions only.

The delivery network in front

Pages and email for this domain run through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which delivers the site fast, screens out attacks and passes email on to our mailbox. To do so Cloudflare handles your IP address and technical connection data.

The legal basis is Article 6(1)(f) GDPR, our interest in a quick, guarded website. Cloudflare holds a certification under the EU-US Data Privacy Framework, and the European Commission's standard contractual clauses add to it. Cloudflare sets out its handling at cloudflare.com/privacypolicy.

Zoo pictures

Pictures of the outings are loaded straight from the image servers of GetYourGuide (GetYourGuide Deutschland GmbH, Sonnenburger Straße 73, 10437 Berlin, Germany). To show one, your browser contacts those servers and gives them your IP address, which we cannot influence.

The legal basis is Article 6(1)(f) GDPR: our interest in showing every outing with the provider's own current pictures.

Once a booking link is clicked

Each booking link goes straight to GetYourGuide and holds our partner number, so the platform can credit the reservation to Bali Zoo Breakfast.

After you reach GetYourGuide, that platform sets its own cookies and treats your data under its own privacy policy. We only get commission reports with totals back, never names, contact details or payment data.

Clips from YouTube

Videos use YouTube's privacy-enhanced mode and remain a still image until you press play, so your browser does not touch YouTube before that. After you press play the video loads from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which receives your IP address and may set cookies.

Pressing play is how you consent: Article 6(1)(a) GDPR and Section 25(1) TDDDG. Google explains its handling at policies.google.com/privacy.

What your browser remembers here

The browser keeps a handful of small notes so the site can follow your choices. They never leave your device, and we cannot read them:

• the list items you ticked, so they are still marked when you return (local storage, until you empty it);
• the currency chosen in the menu, so each page keeps showing fares in it (local storage, until you empty it);
• once a chat is open: its reference number, an access key, your email address and a copy of the thread, so you can pick it up again (local storage, until you empty it);
• a flag that the chat bubble was shown, so it stays quiet afterwards (session storage, cleared when the tab closes);
• a flag that the leaving-the-page offer was shown, so it is not repeated (session storage, cleared when the tab closes).

These notes are strictly necessary for functions you ask for yourself (Section 25(2) No. 2 TDDDG). Your browser settings let you delete them whenever you wish.

Messages sent through the chat box

Starting a chat gives us your name, your email address and the messages you type. The chat service also logs your connection's country, a scrambled version of the IP address (a salted hash that cannot be turned back into the address) and the page and language you wrote from.

Cloudflare stores each conversation (named above), and every line you write is passed to our account on the Telegram messaging service, which handles it outside the European Union; our replies come back the same way. Details: telegram.org/privacy. We use your email address to write back, nothing more.

The legal basis is Article 6(1)(b) GDPR, since you ask and we answer, and Article 6(1)(f) GDPR for the scrambled IP address, which only helps us stop abuse and spam. Each conversation is erased automatically 180 days after its last message.

Contacting us by email

An email to us is used only to reply to you. The legal basis is Article 6(1)(f) GDPR, plus Article 6(1)(b) GDPR when the message concerns a contract. The exchange is deleted when it ends unless a legal duty requires us to keep it.

Letterforms and map images

Our own server delivers the letterforms, so no font provider learns of your visit. Maps are pictures kept on our server and drawn from OpenStreetMap data; viewing or enlarging them contacts no map provider. A "Google Maps" link reaches Google only after you press it.

Where we point you

We quote official and expert sources and link to them. Nothing goes to those sites until you open a link, and from then on their own privacy rules apply.

What you may demand

You can ask what data we hold about you (Article 15 GDPR), have it corrected (Article 16) or erased (Article 17), have processing restricted (Article 18) and receive it in a portable form (Article 20). Where we rely on a legitimate interest you may object at any moment (Article 21), and a consent you gave can be withdrawn for the future. A message to [email protected] reaches us.

You may also complain to a data protection supervisory authority, especially in the EU country where you live, work or believe an infringement happened (Article 77 GDPR).

You owe us no data, and we take no automated decisions and build no profiles. A page still cannot reach your screen without technical connection data, which every server sees.