Privacy Policy
Last updated: 19 September 2026
This Privacy Policy explains how Villasa ("we", "us", "our") collects, uses, and protects personal data when you visit villasa.co or book.villasa.co (the "Site") or make a booking with us.
1. Who We Are
Villasa arranges short-term villa accommodation in Bali, Indonesia, and is the controller of the personal data described in this policy.
Contact: info@prefahb.com Address: Jl. Raya Kengetan, Singapadu Kaler, Kec. Sukawati, Kabupaten Ubud, Gianyar, Bali 80571, Indonesia
2. Data We Collect
2.1 Information you give us
- Name, email address, and phone number
- Booking details: property, dates, number of guests, special requests
- Guest names for others in your party, where you provide them
- Correspondence with us, including messages sent through the Site's chat
2.2 Payment information
Payments are processed by our third-party payment provider. We receive confirmation of payment, the amount, currency, and transaction reference. We do not receive or store your full card number, CVV, or bank credentials.
2.3 Information collected automatically
- IP address, browser type, device type, and operating system
- Pages viewed, referring page, and time spent on the Site
- Cookie and similar identifiers (see section 8)
2.4 Information from third parties
Where you book through a listing platform such as Airbnb or Booking.com, we receive the booking and contact details that platform shares with us, in accordance with their own privacy terms.
3. How We Use Your Data
| Purpose | Legal basis |
|---|---|
| Processing and confirming your booking | Performance of a contract |
| Taking payment and issuing receipts | Performance of a contract |
| Communicating with you before, during, and after your stay | Performance of a contract |
| Complying with accommodation guest-reporting obligations under Indonesian law | Legal obligation |
| Recovering costs for damage outside the waiver | Legitimate interests |
| Preventing fraud and securing the Site | Legitimate interests |
| Improving the Site and our services | Legitimate interests |
| Sending marketing communications | Consent |
You can withdraw consent to marketing at any time using the unsubscribe link in any message, or by contacting us.
4. Who We Share Data With
We share personal data only where necessary:
- Property owners and on-site staff — guest name, dates, party size, and relevant requests, so your stay can be prepared and hosted.
- Our property management system provider — used to manage reservations, calendars, and guest communication.
- Our payment provider — to process your payment.
- Listing platforms — where your booking originated with them.
- Professional advisers — accountants and legal advisers, where required.
- Authorities — where we are required to do so by law, including guest reporting obligations.
We do not sell your personal data.
5. International Transfers
Our service providers may process data outside Indonesia, including in the United States and the European Union. Where data is transferred internationally, we take reasonable steps to ensure it remains protected by appropriate safeguards, such as standard contractual clauses or an equivalent mechanism.
6. How Long We Keep Data
- Booking and guest records: for the duration of your stay and afterwards as required for accounting, tax, and legal purposes.
- Payment and transaction records: as required by applicable tax and accounting law.
- Marketing contacts: until you unsubscribe.
- Website analytics: typically no longer than 26 months.
Where data is no longer needed, it is deleted or anonymised.
7. Your Rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- request deletion of your data;
- object to or restrict certain processing;
- receive your data in a portable format;
- withdraw consent at any time;
- lodge a complaint with your local data protection authority.
To exercise any of these rights, contact us at info@prefahb.com. We may need to verify your identity before responding, and we aim to respond within 30 days.
Please note that we may be unable to delete data we are required to retain for legal, tax, or guest-reporting purposes.
8. Cookies
We use cookies and similar technologies to:
- keep the Site functioning, including remembering your booking selection;
- understand how the Site is used, so we can improve it;
- measure the performance of our marketing, where applicable.
You can control cookies through your browser settings. Blocking essential cookies may prevent parts of the booking process from working.
9. Security
We use technical and organisational measures to protect personal data, including encrypted connections (HTTPS), access controls, and restricted staff access on a need-to-know basis. No system is completely secure, and we cannot guarantee absolute security of data transmitted over the internet.
10. Children
The Site is not directed at children, and we do not knowingly collect personal data from children other than the names and ages of minors travelling as part of a booking, provided by the lead guest.
11. Third-Party Links
The Site may link to third-party websites, including listing platforms and payment pages. We are not responsible for their privacy practices, and we encourage you to read their policies.
12. Changes to This Policy
We may update this policy from time to time. Material changes will be indicated by updating the date at the top of this page.
13. Contact
Questions or concerns about this policy or how we handle your data:
Email: info@prefahb.com Address: Jl. Raya Kengetan, Singapadu Kaler, Kec. Sukawati, Kabupaten Ubud, Gianyar, Bali 80571, Indonesia