Privacy Policy

This policy explains what personal data Guide and Drive collects when you use guideanddrive.com and book with us, why we collect it, who we share it with, how long we keep it, and the rights you have over it.

1. Who we are

Guide and Drive is operated by PT Gemilang Anugerah Dewata, Jalan Pulau Moyo I No. 45, Kelurahan Pedungan, Kecamatan Denpasar Selatan, Kota Denpasar, Bali 80222, Indonesia ("we", "us").

We are the controller of your personal data under Indonesia's Personal Data Protection Law (Law No. 27 of 2022) and, where it applies to you, the EU and UK General Data Protection Regulation (GDPR).

Privacy contact: privacy@guideanddrive.com

2. What we collect

When you create an account

• Email address and password (we store only a secure hash of your password), or your name and email address from Google if you sign in with Google.

• Profile details you add: title, first and last name, phone number and its country code.

When you book (with or without an account)

• Your title, first and last name, email address and phone number.

• Trip details: dates and times, pick-up and drop-off addresses and their map location, number of people, selected options and add-ons, your flight number if you give one, and any notes you write.

• Payment details: the amount, payment method type, payment status and transaction reference. When you pay online, your card or bank details are entered on our payment provider's page and never reach our servers. When you pay us by bank or money transfer, we receive the sender's name and the account and transfer details shown on the transfer or on a receipt you send us.

When you choose to

• Use your current location to fill in an address: your device's location is sent to our maps provider to find the address. We only do this when you tap the button.

• Write a review: your rating, text, and any photos or video you upload. Reviews are public and show your first name and the initial of your last name.

• Contact us by email or WhatsApp: your messages and contact details.

Automatically

• Technical data such as your IP address, browser type and the pages you request, which our servers and security providers process to deliver the site, stop abuse (for example, limiting repeated login attempts) and fix errors.

• Your approximate country, derived from your IP address, to pick a default display currency.

• Cookies and similar storage — see section 9.

We do not collect your date of birth, nationality, passport or ID numbers.

3. Why we use it, and our legal basis

We do not make decisions about you based solely on automated processing.

4. Who we share it with

We do not sell your personal data to advertisers or data brokers.

• Partners who carry out your booking. Every service booked on our site is carried out by an independent local business, the "Partner" (as defined in our Terms & Conditions). We send the Partner the details it needs to check availability and deliver your trip, which can include your name, phone number, pick-up and drop-off locations, dates, number of people, flight number and notes. The Partner may pass them to the drivers, guides and activity venues who carry out the service. These hand-offs usually happen over WhatsApp. Partners handle your data as separate controllers, under their own responsibility and privacy practices, and may ask you for further details — for example, a rental provider checks your passport and driving licence when you pick up a vehicle, and some activities ask you to sign a waiver. We do not receive or store those documents.

• Service providers who work for us:

  • payment processing, banking and money transfer (Indonesia and other countries)

  • cloud hosting, databases, file storage, email delivery and backups (Singapore)

  • sign-in with Google, maps, address search and location lookup (United States)

  • error monitoring (European Union)

  • website delivery and security (global network)

  • messaging with you and with Partners (WhatsApp)

• Insurers, if an incident happens during your trip and a claim needs to be handled.

• Our professional advisers — accountants, tax consultants, lawyers and auditors — under a duty of confidentiality.

• Authorities — police, immigration, tax or other government bodies — when Indonesian law requires us to disclose data.

Our own staff can see booking and account data only as needed to run the service.

5. International transfers

Our servers and databases are hosted in Singapore. Some of the other providers above process data in other countries, including the European Union and the United States. When data leaves Indonesia, we rely on the data-protection terms these providers offer, including standard contractual clauses where available, to meet the requirements of Indonesian law.

6. Public reviews

Reviews you submit, including photos and video, are visible to anyone on the site, shown with your first name and last initial. If you delete your account, your reviews stay published under a non-identifying name such as "Verified traveller". You can ask us to remove a review at any time.

7. Your rights

You have the right to:

• access the personal data we hold about you and get a copy;

• correct data that is wrong or incomplete;

• delete your data, or have us stop processing it;

• withdraw consent where we rely on it (for example, for a published review);

• object to processing based on our legitimate interests, including review requests;

• restrict processing while a complaint is being resolved;

• receive your data in a portable format.

Email privacy@guideanddrive.com with your request. If you booked without an account, include your booking reference. We may ask you to confirm your identity before acting.

We respond to requests within the time the law requires. Some data cannot be deleted while we are legally required to keep it — see section 8 — and we will tell you when that applies.

If you are unhappy with how we handle your data, please contact us first. You may also complain to the Indonesian personal data protection authority, or to the data protection authority in your own country.

8. How long we keep it

An anonymised booking keeps only what no longer identifies you — the service, number of people, amounts and the month it took place — and your name, contact details, addresses and notes are removed. A review you left stays published under "Verified traveller".

When data you asked us to delete still exists in a backup, it stays there, unused, until that backup expires on the schedule above, and is never restored into use.

9. Cookies and similar storage

We use only cookies and browser storage needed to run the site. We do not use advertising or analytics cookies.

Our maps and address-search provider receives your IP address when those features load.

10. Security

We use reasonable technical and organisational measures to protect your data, but no system is completely secure. If a breach affects your personal data, we will notify you as the law requires.

11. Age

You must be 18 or older to make a booking. Children may travel on a booking made by an adult, who is responsible for the details they give about them. We do not knowingly collect personal data directly from children.

12. Information about other people

If you give us details about someone else — for example in your booking notes — you confirm that you have their permission to share them with us.

13. Links to other websites

Sites we link to, and Partners' own sites, have their own privacy policies. We are not responsible for how they handle your data.

14. Changes to this policy

When our practices change, we update this policy and the "Last updated" date above. If a change significantly affects how we use your data, we will tell you by email or on the site before it takes effect.

15. Language

This policy is written in English. Any translation is provided for convenience only, and the English version prevails.

16. Contact

PT Gemilang Anugerah Dewata Jalan Pulau Moyo I No. 45, Pedungan, Denpasar Selatan, Denpasar, Bali 80222, Indonesia privacy@guideanddrive.com