Your data, plainly

The gist for riders

You can read every page of Ubud ATV Ride without an account. The site sets no cookies and runs no analytics, advertising or tracking scripts. What does reach us is the connection data that any web server sees when it sends you a page, and it is described below.

Nothing is booked on this site. You book a ride on GetYourGuide or Viator, and their privacy rules apply there.

The responsible party

Ubud ATV Ride
[email protected]

No law obliges us to name a data protection officer, so Ubud ATV Ride has none. Questions about your data go to [email protected].

Log entries on our server

Whenever your browser asks for a page or a file, our web server notes the IP address it came from, the date and time, the address requested, the page that referred you and the text your browser sends to describe itself and your operating system.

We need these records to deliver the site, keep it stable, recognise attacks and abuse, and count how often each page is read. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a site that works and stays safe. Raw records are deleted after 90 days at the latest; counts without an IP address are kept longer. A hosting company runs the server and handles the data for us, on our instructions only.

The service in front of our site

Pages and email for this domain run through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which serves the site fast, filters attacks and forwards email to our mailbox. For this Cloudflare processes your IP address and technical connection data.

The legal basis is Article 6(1)(f) GDPR, our interest in a fast, protected site. Cloudflare is certified under the EU-US Data Privacy Framework and the European Commission's standard contractual clauses apply as well. Cloudflare describes its own handling at cloudflare.com/privacypolicy.

Ride photographs

Photographs of the rides load straight from the image servers of GetYourGuide (GetYourGuide Deutschland GmbH, Sonnenburger Straße 73, 10437 Berlin, Germany) and, where a card shows the ride of this site's own listing, from the image servers of Viator. To show a photograph your browser contacts those servers and passes on your IP address, and we cannot influence that exchange.

The legal basis is Article 6(1)(f) GDPR: we want to show each ride with the provider's up-to-date pictures.

Once you click to book

Each booking link goes directly to GetYourGuide or Viator and carries our partner number, which lets the platform credit us when you book through it.

On GetYourGuide or Viator the platform sets its own cookies and handles your data under its own privacy policy. We get back commission reports with totals only, with no names, no contact details and no payment data.

Video clips on pages

Videos load in YouTube's privacy-enhanced mode and stay a still picture until you press play, so your browser does not contact YouTube before that. After you press play the video streams from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which receives your IP address and may set cookies.

Your press on play is the consent: Article 6(1)(a) GDPR and Section 25(1) TDDDG. Google's policy is at policies.google.com/privacy.

Notes kept in your browser

Your own browser keeps a few small notes so the site remembers what you chose. They stay on your device and we have no way to read them:

• the checklist boxes you ticked, so they are still ticked on your next visit (local storage, until you clear it);
• the currency you choose in the menu, so prices keep that currency on every page (local storage, until you clear it);
• if you open a chat: its reference number, an access key, your email address and a copy of the conversation, so the thread is there when you return (local storage, until you clear it);
• that the chat bubble was already shown, so it stays quiet afterwards (session storage, gone when you close the tab);
• that the window offered as you leave was already shown, so it does not come back (session storage, gone when you close the tab).

Each of these notes is needed for a feature you switch on yourself (Section 25(2) No. 2 TDDDG). Clear them in your browser settings whenever you please.

Ride chat

Opening a chat means giving us your name, email address and messages. The chat service also notes the country your connection comes from, a scrambled version of your IP address (a salted hash that cannot be turned back into the address), and the page and language you wrote from.

Cloudflare holds the chat records (named earlier); each message you type is relayed to our account on the Telegram messenger, which handles it outside the European Union, and our answers travel back by the same route. More: telegram.org/privacy. We only use your email address to reply to you.

The legal basis is Article 6(1)(b) GDPR, since you ask and we answer, and Article 6(1)(f) GDPR for the scrambled IP address, which we use only against abuse and spam. A conversation is deleted automatically 180 days after its last message.

Emailing us

An email to us is used to answer you. The legal basis is Article 6(1)(f) GDPR, and Article 6(1)(b) GDPR where the message concerns a contract. We delete the exchange when it is over, unless a legal duty makes us keep it.

Type and map files

The fonts come from our own server, so no font service hears about your visit. The maps are images stored on our own server and drawn from OpenStreetMap data; viewing or zooming them contacts no map service. A "Google Maps" link opens Google only when you press it.

Pointers to our sources

Our pages cite official and expert sources and link to them. Those sites receive nothing from you until you open a link, and after that their own privacy rules apply.

Your requests to us

Ask what we store about you (Article 15 GDPR), request corrections (Article 16) or deletion (Article 17), limit how the data is used (Article 18) or take a portable copy (Article 20). Where our legitimate interest is the basis you can object whenever you wish (Article 21), and any consent can be withdrawn going forward. Send a message to [email protected] and that will do.

A complaint can also go to a data protection supervisory authority, most of all in the EU country where you live, work or think a violation took place (Article 77 GDPR).

We take no automated decisions about you and build no profiles. You do not have to give us data, but without the technical connection data no page could reach your screen.