01
Information We Collect
We collect information that is necessary to provide our transportation and tour services. The types of information we collect include:
Personal Information
- Full name — to identify you for pickup and booking records.
- Phone number — for booking confirmations, driver coordination, and WhatsApp notifications.
- Email address — for booking confirmations, receipts, and important service updates.
- Pickup and drop-off locations — to plan your route and coordinate with drivers.
Technical Information
- Device type, browser, and operating system — to optimize our website experience.
- IP address — for security, rate limiting, and approximate geographic location.
- Pages visited and interactions — to understand how users navigate our website and improve our services.
- Session and visitor identifiers — hashed, privacy-safe IDs for analytics (not linked to your identity).
Location Data
- Real-time GPS coordinates — shared only during active trips for live tracking, with your driver's consent.
- Location data is used solely for trip tracking and is not retained indefinitely after the trip is completed.
02
How We Use Your Information
We use the information we collect for the following purposes:
- Processing and managing your bookings — confirming reservations, assigning drivers, and coordinating pickup logistics.
- Communication — sending booking confirmations, driver details, trip reminders, and receipts via WhatsApp and email.
- Payment processing — facilitating secure payments through our payment gateway (Xendit). We do not store your credit card details.
- Service improvement — analyzing usage patterns to improve our website, booking flow, and overall customer experience.
- Safety and security — preventing fraud, detecting suspicious activity, and ensuring the safety of passengers and drivers.
- Legal compliance — fulfilling our obligations under applicable Indonesian laws and regulations.
05
Data Security
We implement industry-standard security measures to protect your personal information:
- All data transmitted between your browser and our servers is encrypted using HTTPS/TLS.
- Passwords are hashed and never stored in plain text.
- Access to personal data is restricted to authorized personnel only.
- Our payment processing is handled by Xendit, a PCI-DSS compliant payment gateway.
- We apply rate limiting and request validation to prevent abuse and unauthorized access.
While we take every reasonable precaution, no method of electronic transmission or storage is 100% secure. We encourage you to use strong passwords and keep your account credentials confidential.
06
Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes described in this policy:
| Data Type | Retention Period |
|---|---|
| Booking records | retained for 3 years for business records and potential dispute resolution. |
| Payment records | retained as required by Indonesian tax and financial regulations. |
| Analytics data | aggregated and anonymized after 12 months; individual session data is periodically purged. |
| Trip tracking data (GPS) | retained only for the duration of the trip and a short period after for quality assurance. |
| Account data | retained until you request deletion or your account is inactive for an extended period. |
07
Your Rights
You have the following rights regarding your personal data:
- Access — you can request a copy of the personal data we hold about you.
- Correction — you can request corrections to inaccurate or incomplete data.
- Deletion — you can request that we delete your personal data, subject to legal retention obligations.
- Objection — you can object to certain types of data processing.
- Portability — you can request your data in a structured, machine-readable format.
To exercise any of these rights, please contact us via WhatsApp or email. We will respond to your request within 30 days.
08
Children's Privacy
Our services are not directed at children under the age of 18. We do not knowingly collect personal information from minors. If you are under 18, a parent or guardian must book on your behalf. If we become aware that we have collected data from a child without parental consent, we will take steps to delete it promptly.
09
Third-Party Services
Our website may contain links to third-party services. We are not responsible for the privacy practices of these external sites. We recommend reviewing their privacy policies before providing any personal information.
Third-party services we use:
- Xendit — payment processing (PCI-DSS compliant)
- Google Maps — location search, route display, and distance calculation
- WhatsApp (Meta) — booking notifications and customer communication
- Resend — email delivery for confirmations and receipts
- Supabase — secure database hosting and file storage
- Vercel — website hosting and content delivery
10
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make significant changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.
11
Data Controller
The legal entity responsible for your personal data.
- Legal name
- PT Mora Jelajah Wisata
- NIB
- 1710230042693
- Registered office
- Gg Persada No 6, Jimbaran
Kabupaten Badung, Bali 80361
Indonesia - Privacy contact
- booking@morabali.com
- +62 822-3086-1107
Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please reach out to our team.
By using Mora Bali's website and services, you consent to the collection and use of your information as described in this Privacy Policy.