Who holds your details, and for how long

The company that holds the details you give for Raffles Cruise is PT Komodo Explorer Indonesia, NIB 1805260128363, of Labuan Bajo. The boat has its own crew, but the crew does not take bookings, and your details go to us.

We handle them under Indonesia's Personal Data Protection Law, Law No. 27 of 2022. We also follow the GDPR for visitors who live in the European Economic Area. Indonesian law governs this statement.

Questions about it go to info@komodoexplorer.com. Use the same address to ask what we hold about you.

This statement covers the details you give us as a guest. It does not cover the sites you reach through a link, such as the park's ticket system or a review platform, each of which keeps its own rules.

On WhatsApp we receive your number, the name on your profile and the text you send, delivered by Meta's WhatsApp Business service. The conversation can be copied into our booking system, so that whoever helps you next can read the thread.

For the booking itself we keep names, dates, the cabin plan, the head count and the notes you give us about diet or health, which the crew needs for safety. We keep the payment reference and the amount, and the card number never needs to enter a chat. Pay through the payment link instead.

Some messages are read by an AI service that helps our team draft a reply. A person decides everything that touches your booking or its price. With your consent only, a hashed email or phone number goes to Google and Meta so that we can measure our advertising. Declining changes nothing about your service or your fare.

Passport details are requested at least 7 days ahead of sailing, and only once the booking is confirmed. Each guest sends the name as the passport shows it, the passport number and the nationality.

Two registrations need them. The park sells tickets online, one per visitor, in that visitor's own name and passport number. The harbour supplies an electronic boarding pass, and the names on it must agree with the passenger list. We make both registrations from what you send.

Send passport details in your booking thread only, and never post them on a public page or a social profile. A child's details are handled the same way, and the parent or guardian sends them.

Xendit and PayPal receive your email address when a payment is created and completed for your booking. A card payment is finished on the payment company's own page, not in our chat, and the invoice shows any surcharge before you pay.

Alternatives are a rupiah bank transfer, Wise, Revolut, QRIS, Alipay, and WeChat Pay, the last three via a payment partner. Each of those services handles your data under its own terms, and the invoice lists the ones open to you.

Brevo sends our booking confirmations by email, using your name and address. Your personal data is not for sale, and we sell it to no one.

Ask us which method suits your country before you pay. A transfer from abroad and a card payment cost different amounts in fees, and the invoice shows the figure first.

We apply no fixed maximum period to WhatsApp history. It stays in our booking and customer-service records, and remains there until you request deletion. We publish no separate period for passport copies either, and you can ask for them to be removed after your trip.

A limited number of recent backups of our booking records sit in an access-restricted Google Drive folder, and older backups are removed automatically. Cloudflare carries the traffic to this site and does not keep your details for its own purposes.

Invoices, payment records and accounting entries must be kept for a period the law sets, and we cannot delete them earlier. Where your data forms part of such a record, we keep the minimum and anonymise the rest. Your own copy of a WhatsApp conversation, and Meta's copy, stay outside our reach.

To ask for a copy, a correction or an erasure, email info@komodoexplorer.com with Data deletion request as the subject, or send a WhatsApp message asking for deletion. Quote the phone number, email or booking reference linked to your data, which lets us find the record.

We first ask you to prove your identity, which stops anyone else erasing your data in your name. Receipt is confirmed within a few business days. The work ends within 30 days of verification, or we tell you which part cannot be completed, with the reason.

These are deleted: contact details, conversation history held in our systems, consent records, and any free-text notes on your profile. What is kept: the statutory financial records above, and records needed to answer a legal claim.