Handling of your data

Falls essentials in brief

Every page of Ubud Waterfalls can be read without an account. The site sets no cookies and runs no analytics, advertising or tracking scripts. The only thing that reaches us is the connection data any web server sees when it delivers a page, set out below.

Nothing is booked here. Picking a tour takes you to GetYourGuide, where you book it, and their privacy rules apply from then on.

The team behind this site

Ubud Waterfalls
[email protected]

We are under no legal obligation to name a data protection officer and have not done so. Questions about your data can go to [email protected].

Log entries our server keeps

When your browser asks for a page or a file, our web server notes the IP address of the request, the date and time, the address asked for, the page you arrived from and the identification text your browser sends about itself and your operating system.

We need these records to deliver the site, keep it stable, spot attacks and abuse, and count how often each page is read. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a site that works and stays secure. Raw records are erased after 90 days at most; counts without IP addresses are kept longer. A hosting company runs the server and handles this data for us, on our instructions only.

The service sitting in front of the server

This domain's pages and email are routed through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which delivers the site fast, blocks attacks and forwards email to our mailbox. To do so, Cloudflare processes your IP address and technical connection data.

The legal basis is Article 6(1)(f) GDPR, our interest in a site that is fast and protected. Cloudflare is certified under the EU-US Data Privacy Framework, and the European Commission's standard contractual clauses apply as well. Cloudflare explains its own practice at cloudflare.com/privacypolicy.

Photos of the falls

Photographs of the tours are loaded straight from the image servers of GetYourGuide (GetYourGuide Deutschland GmbH, Sonnenburger Straße 73, 10437 Berlin, Germany). To display one, your browser contacts those servers and passes on your IP address, an exchange we cannot influence.

The legal basis is Article 6(1)(f) GDPR: we want to show each day with the provider's up-to-date pictures.

After you click to book

Each booking link leads straight to GetYourGuide and includes our partner number, which allows the platform to credit a booking to Ubud Waterfalls.

Once you reach GetYourGuide, that platform sets its own cookies and handles your data under its own privacy policy. We get only commission reports with totals back: no names, no contact details, no payment data.

Waterfall videos here

Videos are embedded in YouTube's privacy-enhanced mode and remain a still image until you press play; until then your browser makes no contact with YouTube. Once you press play, the video streams from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which receives your IP address and may set cookies.

You consent by pressing play: Article 6(1)(a) GDPR and Section 25(1) TDDDG. Google's privacy policy: policies.google.com/privacy.

What the browser stores for Ubud Waterfalls

Your browser keeps a few small notes so the site can follow your choices. They stay on your device and we cannot see them:

• the checklist boxes you ticked, kept so they are still ticked when you come back (local storage, until you clear it);
• the currency chosen in the menu, so each page shows prices in it (local storage, until you clear it);
• after you open a chat: its reference number, an access key, your email address and a copy of the thread, so you can pick it up again (local storage, until you clear it);
• that the chat bubble has appeared once, so it stays away afterwards (session storage, cleared when the tab is closed);
• that the pop-up shown as you leave has appeared once, so it does not return (session storage, cleared when the tab is closed).

These notes are strictly necessary for features you use yourself (Section 25(2) No. 2 TDDDG). You can delete them at any time in your browser settings.

What the chat keeps

Starting a chat means giving us your name, your email address and your messages. The chat service also notes the country your connection comes from, a scrambled version of your IP address (a salted hash that cannot be turned back into the address) and the page and language you wrote from.

The conversation is stored with Cloudflare (named above), and each message you write is passed on to our account with the messaging service Telegram, which processes it outside the European Union; our replies travel back the same way. More at telegram.org/privacy. We use your email address for one thing: answering you.

The legal basis is Article 6(1)(b) GDPR, since you ask and we respond, and Article 6(1)(f) GDPR for the scrambled IP address, which we use only against abuse and spam. A conversation is deleted automatically 180 days after its last message.

Email to the falls desk

If you write to us by email, we use your message to answer you. The legal basis is Article 6(1)(f) GDPR, or Article 6(1)(b) GDPR when your message is about a contract. We erase the exchange once it is finished, unless the law obliges us to keep it.

Type and map images

Typefaces come from our own server, so no font provider hears about your visit. The maps are images kept on our own server and drawn from OpenStreetMap data, so viewing or zooming them contacts no map service. A "Google Maps" link reaches Google only when you press it.

Sources behind our facts

Our pages quote official and expert sources and link to them. Nothing goes to those sites unless you open a link; after that, their own privacy rules apply.

Your options as a visitor

You may ask what data we hold about you (Article 15 GDPR), have it corrected (Article 16) or deleted (Article 17), have its processing limited (Article 18) and receive it in a portable format (Article 20). Where we rely on legitimate interest you can object at any time (Article 21), and a consent you gave can be withdrawn for the future. To use any of these rights, email [email protected].

You may also lodge a complaint with a data protection supervisory authority, especially in the EU country where you live or work or where you think the infringement happened (Article 77 GDPR).

We take no automated decisions about you and build no profiles. You owe us no data, but a page cannot reach your screen without the technical connection data that every web server sees.