How Bali Zoo Elephants treats your data

Briefly

Each page of Bali Zoo Elephants opens without an account. We set no cookies and use no analytics, advertising or tracking scripts. What does reach us is the connection data that any web server sees when it sends a page, set out below.

You never book on this site. Choosing an experience sends you to GetYourGuide to book it, and their privacy rules govern that step.

Who stands behind the site

Bali Zoo Elephants
[email protected]

No law obliges us to appoint a data protection officer, so we have none. Questions about your data can go to [email protected].

What the web server records

Whenever a page or file is requested, our web server notes the IP address of the request, the date and time, the address asked for, the page that referred you and the text that your browser sends to describe itself and its operating system.

We need these records to deliver the site, keep it steady, spot attacks and abuse and count how often pages are opened. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a working, safe site. Raw logs are erased after at most 90 days; counts without IP addresses are kept longer. A hosting company runs the server and processes this data for us, strictly on our instructions.

The delivery service ahead of our server

Pages and email for this domain pass through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which speeds up delivery, blocks attacks and passes email on to our mailbox. To do so Cloudflare processes your IP address and technical connection data.

The legal basis is Article 6(1)(f) GDPR: we want a quick and protected website. Cloudflare holds a certification under the EU-US Data Privacy Framework, and the European Commission's standard contractual clauses apply as well. Cloudflare explains how it works at cloudflare.com/privacypolicy.

Photos of the experience

The photographs of the experiences are loaded straight from the image servers of GetYourGuide (GetYourGuide Deutschland GmbH, Sonnenburger Straße 73, 10437 Berlin, Germany). To display a picture, your browser contacts those servers and passes on your IP address, which we cannot control.

The legal basis is Article 6(1)(f) GDPR: we want each experience to appear with the provider's up-to-date photographs.

After pressing a booking link

Every booking link goes directly to GetYourGuide and includes our partner number, with which the platform can assign a booking to us.

Once you arrive at GetYourGuide, that platform places its own cookies and treats your data under its own privacy policy. All we get are commission statements with totals, never names, contact details or payment data.

Elephant clips from the zoo

Videos are embedded in YouTube's privacy-enhanced mode and show only a still frame until you press play; until then your browser has no contact with YouTube. Once you press play, the film loads from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which receives your IP address and may place cookies.

The press of the play button is your consent: Article 6(1)(a) GDPR and Section 25(1) TDDDG. Google's privacy details: policies.google.com/privacy.

What is kept in your browser

Your browser holds a handful of small entries so that the site remembers what you chose. They remain on your device and are unreadable to us:

• the points you ticked on a list, so they remain ticked on your next visit (local storage, kept until you delete it);
• the money unit picked in the menu, so each page shows prices in it (local storage, kept until you delete it);
• once you open a chat: its reference number, an access key, your email address and a copy of the conversation, so you can come back to it (local storage, kept until you delete it);
• a flag that the chat bubble has been displayed, so it does not pop up again (session storage, erased when the tab is closed);
• a flag that the leaving-the-page reminder has been displayed, so it is not repeated (session storage, erased when the tab is closed).

These entries are strictly needed for functions you ask for yourself (Section 25(2) No. 2 TDDDG). You can clear them at any moment in your browser settings.

The live chat

Starting a chat means giving us your name, your email address and your text. The chat service also records the country you connect from, a scrambled version of your IP address (a salted hash that cannot be turned back into the address) and the page and language you wrote from.

Conversations are stored by Cloudflare (named above), and each message you type is passed to our account with the Telegram messaging service, which handles it outside the European Union; our answers come back by the same path. Read telegram.org/privacy. We use your email address solely to answer you.

The legal basis is Article 6(1)(b) GDPR, since you ask and we answer, plus Article 6(1)(f) GDPR for the scrambled IP address, which only helps to keep out abuse and spam. Every conversation deletes itself 180 days after its last message.

Sending us mail

If you write to us by email, we use your message to reply. The legal basis is Article 6(1)(f) GDPR, or Article 6(1)(b) GDPR when your message concerns a contract. We erase the correspondence once the matter is closed, unless a legal obligation says we must keep it.

Typefaces, map images

The lettering is served from our own server, so no font company learns of your visit. The maps are pictures kept on our server and drawn from OpenStreetMap data, so viewing or enlarging them involves no map company. A "Google Maps" link reaches Google only after you press it.

Where our source links lead

Our pages cite official and specialist sources and link to them. Those sites learn nothing about you until you follow a link, and from then on their own privacy rules apply.

What the law gives you

You may ask which data we hold about you (Article 15 GDPR), have it corrected (Article 16) or erased (Article 17), limit its use (Article 18) and receive it in a portable form (Article 20). Where we rely on a legitimate interest you may object at any time (Article 21), and a consent you gave can be withdrawn for the future. A message to [email protected] is all it takes here.

You may also lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work or where the alleged breach took place (Article 77 GDPR).

We take no automated decisions about you and build no profiles. You are not required to give us data, although a page cannot reach your screen without technical connection data.