Privacy Policy

1. Who we are

This website is operated by Why Not Surf, a family-run surf school and homestay in Jl. Pantai Kuta, Lombok, Indonesia. We are the party responsible for the personal data described below.

We handle personal data in accordance with Indonesia’s Personal Data Protection Law (UU No. 27/2022, “UU PDP”). Most of our guests travel from Europe, so we also apply the standards of the EU General Data Protection Regulation (GDPR) to everyone, regardless of where you live.

2. What information we collect

This website has no booking form and no contact form. It does not ask you for your name, your email address, or your phone number, and it has no way to store them. The only data the website itself collects is anonymous usage statistics, and only if you agree to them (see section 4).

Personal data reaches us in exactly two ways:

• You message us. Our booking buttons open WhatsApp with a message drafted for you. Whatever you then choose to send — your name, your phone number, your surfing experience, dates you have in mind, and any health or dietary notes you decide to share — arrives in our WhatsApp inbox. Nothing is sent until you press send, and you decide what goes in it.
• You email us at hello@whynotsurf.com, which gives us your email address and whatever you write.

Analytics data, if you consent: pages visited and time spent on them, approximate location at city or region level, and device, browser and referrer information. Google Analytics handles your IP address only to derive that approximate location and does not report it to us.

3. How we use your information

• To answer your questions and confirm your booking.
• To run your lesson or stay safely — which is why swimming ability and relevant health conditions matter to us.
• To reach you about your booking, surf conditions, or a safety issue.
• To understand which parts of this website are useful, if you consented to analytics.

We do not use your data for advertising, we do not build profiles, and we never sell it.

4. Cookies, Google Analytics, and your consent

We use Google Analytics 4 to count visitors and see how people find us. It sets cookies in your browser, so under UU PDP and the GDPR we need your explicit, prior consent — and asking properly means you can say no just as easily as yes.

So on your first visit you get a banner with Accept and Decline. Google Analytics does not load at all until you press Accept. No analytics cookie is written, and no data reaches Google, while you are undecided or if you decline. Continuing to browse is not taken as agreement.

You can change your mind at any time using the Cookie settingslink in the footer of every page. Declining afterwards deletes the analytics cookies that were already set. You can also block or delete cookies in your browser, or install Google’s Analytics Opt-out Browser Add-on. The full list of cookies is on our Cookie Policy page.

For the record, our legal grounds are: your consent for analytics (UU PDP art. 20(2)(a); GDPR art. 6(1)(a)), and performing our agreement with you for anything needed to deliver a lesson or stay you asked for (GDPR art. 6(1)(b)). Safety information is also handled in our and your legitimate interest in you not getting hurt.

5. Who we share your data with

We do not sell your personal data and we do not share it for advertising. We use these service providers to run the site and the school:

• Google LLC — Google Analytics, only after you consent. Aggregated statistics; we cannot identify you from them.
• Vercel Inc. — hosts this website. It processes server logs, and provides the cookieless visitor counter that runs regardless of your cookie choice because it stores nothing on your device and cannot identify you.
• Railway Corp. — hosts the content system that stores the text and images on this site. No visitor data.
• Cloudflare, Inc. — stores and delivers the photos on this site. No visitor data.
• Meta Platforms, Inc.— if you contact us through WhatsApp, that conversation runs on Meta’s service under WhatsApp’s own privacy policy, which we do not control. If you would rather not use WhatsApp, email us instead.
• Accommodation partners — only when you specifically ask for a package that includes a room we do not run ourselves, and only the details needed to hold it.

We take no online payments, so no payment processor ever receives your data. Payment happens in person. We will also disclose data where Indonesian law requires it.

6. How long we keep your data

• Booking records and conversations: 2 years, for safety, insurance and tax reasons.
• Enquiries that did not lead to a booking: 1 year, then deleted.
• Analytics data:14 months, Google Analytics’ standard retention, after which it is deleted automatically.

7. Where your data goes

We are based in Indonesia, so data we hold directly is processed in Indonesia. Our service providers listed above are based in the United States and process data on servers outside Indonesia. Indonesian data protection standards are not identical to those in your home country. Where the GDPR applies to a transfer, we rely on the providers’ Standard Contractual Clauses.

8. Your rights

Under UU PDP (arts. 5–13) and, where it applies, the GDPR, you can ask us to:

• tell you what personal data we hold about you, and get a copy of it;
• correct anything inaccurate or incomplete;
• delete your data, where we have no obligation to keep it;
• stop or limit how we use it, or object to a particular use;
• send your data to you or someone else in a portable form;
• withdraw your consentat any time — for analytics, the footer’s Cookie settings link does this instantly, and withdrawing never affects a service you have already booked.

Message or email us to exercise any of these; the contact details are at the bottom of this page. We will respond within 30 days and will not charge you. We may ask a question or two to confirm it is really you. If you think we have got it wrong, you can complain to Indonesia’s data protection authority, or — if you are in the EU or UK — to your local supervisory authority.

9. Security

The site is served over HTTPS, our content system sits behind individual accounts with strong passwords, and only the people who need to see booking messages can see them. No transmission over the internet is ever completely secure, so please do not send us anything more sensitive than a booking actually needs — we never need your passport scan or your card details by message.

10. Children

We do not knowingly collect data from anyone under 18 through this website. Lessons for minors are booked by a parent or guardian, who provides the details and gives consent on their behalf, as UU PDP art. 25 requires. If you believe a child has sent us personal data, tell us and we will delete it.

11. Changes to this policy

If we change how we handle data, we will update this page and the date at the top of it. Where a change materially affects you, we will ask for fresh consent rather than assume the old one still covers it.

12. Contact us

Questions about this policy, or want to exercise one of the rights above? Our details are just below. You can also read our Booking Conditions, Cookie Policy and Legal Notice.