Last updated: [DATE]
This policy explains what we do with your personal information when you visit nias.surf, send us an enquiry, book a stay with us, or deal with us in any other way. We have written it in plain language so that you can actually read it.
We take your privacy seriously. We do not sell your information to anyone, and we only collect what we need to answer your questions and look after you properly when you come and stay.
1. Who we are
The website nias.surf and the surf lodge it promotes are operated by:
- [UK COMPANY NAME] Ltd, a company registered in England and Wales under company number [NUMBER], with its registered office at [UK ADDRESS]; and
- [SA COMPANY NAME] (Pty) Ltd, a company registered in South Africa under registration number [NUMBER], with its registered address at [SA ADDRESS].
In this policy, "we", "us" and "our" refer to both companies together. We act as joint controllers of your personal information under UK data protection law, and as joint responsible parties under South African law. Whichever entity you deal with, this policy applies and you can use the contact details in section 14 to reach us.
Our lodge and day-to-day guest operations are based on Asu Island, in the Nias region of Indonesia.
2. The laws we follow
Because we operate across more than one country, we apply the standard that gives you the most protection. In practice we work to:
- the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018;
- the Privacy and Electronic Communications Regulations (PECR), which cover cookies and marketing email;
- the Protection of Personal Information Act 4 of 2013 (POPIA) in South Africa; and
- the Electronic Communications and Transactions Act 25 of 2002, where it applies to our website.
Where you are in the European Union, we will also honour the equivalent rights under the EU GDPR.
3. The information we collect
3.1 Information you give us
- Contact details — your name, email address, phone or WhatsApp number, and the country you are travelling from.
- Enquiry and booking details — the dates you want, how many people are in your group, room preference, surfing ability, and anything else you tell us in a message.
- Travel details — flight numbers, arrival and departure times, and transfer arrangements, so that we can meet you and get you to the island.
- Identity documents — passport details, where we need them for accommodation registration, boat manifests or local requirements in Indonesia.
- Health, dietary and emergency information — food allergies, dietary requirements, medical conditions we should know about, medication, and next-of-kin or emergency contact details.
- Insurance details — your travel and medical insurance provider and policy number.
- Payment information — proof of payment, bank reference and billing details. Card payments are handled by our payment provider. We do not see or store full card numbers.
- Correspondence — emails, WhatsApp messages, social media messages and any reviews or feedback you send us.
3.2 Information we collect automatically
- Your IP address, rough location (usually city or country level), browser and device type, and operating system.
- Which pages you looked at, how long you stayed, and which site or advert sent you to us.
- Cookie and similar identifiers. See section 6.
3.3 Information from other people
- Booking platforms, travel agents or surf tour operators who send us a booking on your behalf.
- The person who made the group booking, if someone else booked for you.
- Social media platforms and advertising networks, where you have allowed them to share information with businesses.
4. Why we use your information, and our legal grounds
UK and EU law requires us to have a lawful basis for using your information. South African law requires similar justification. Here is what we do and why.
| What we use it for | Information used | Our lawful basis |
|---|
| Answering enquiries and sending quotes |
Contact and enquiry details |
Steps taken at your request before entering a contract; our legitimate interest in responding to people who contact us |
| Taking and managing your booking, arranging transfers, meals and boat trips |
Booking, travel, dietary and payment details |
Performance of our contract with you |
| Keeping you safe on the island and at sea, and responding to a medical emergency |
Health, emergency contact and insurance details |
Your explicit consent, and protection of your vital interests where you are unable to give consent |
| Meeting Indonesian accommodation, immigration and maritime requirements |
Identity and passport details |
Compliance with a legal obligation; performance of our contract with you |
| Taking payment and preventing fraud |
Payment and billing details |
Performance of our contract; our legitimate interest in protecting the business |
| Keeping accounting, tax and company records |
Booking and payment records |
Compliance with a legal obligation |
| Sending newsletters, swell updates and special offers |
Name and email address |
Your consent, or our legitimate interest where you are an existing guest and we are telling you about similar stays |
| Running and improving the website, and measuring adverts |
Cookie and usage data |
Your consent for non-essential cookies; legitimate interest for cookies that keep the site working |
| Handling complaints, insurance claims and legal matters |
Whatever is relevant to the matter |
Our legitimate interest in defending our position; compliance with a legal obligation |
Where we rely on legitimate interests, we have weighed up our interest against your privacy and are satisfied that what we do is fair and expected. You can ask us to explain our reasoning at any time.
5. Health, dietary and other sensitive information
Some of the information we ask for is treated as special category data under UK law and special personal information under POPIA. This includes details about your health, allergies, medication and dietary needs.
We ask for this so that our kitchen can feed you safely and so that our guides and boat crew know what to do if something goes wrong. We only collect it with your explicit consent, we share it only with the staff who need it, and we delete it once your stay is finished and any related claim or complaint has been settled.
If you would rather not give us this information, you can say so. Please understand that we may not be able to cater for you safely or accept your booking in that case.
6. Cookies and tracking
Cookies are small files that a website stores on your device. We use them to keep the site working, remember your choices and understand how people use the site.
Types of cookies we use
- Strictly necessary — needed for the site to function, such as security, load balancing and remembering your cookie choice. These are always on.
- Performance and analytics — [GOOGLE ANALYTICS 4 / OTHER], which tells us which pages are popular and where visitors come from.
- Advertising and social media — [META PIXEL / GOOGLE ADS / DELETE IF NOT USED], which lets us measure our adverts and show relevant ones to people who have visited the site.
- Functional — embedded video, maps and booking tools, which may set their own cookies.
We only set analytics, advertising and functional cookies once you have agreed to them through our cookie banner. You can change or withdraw your choice at any time by clicking [COOKIE SETTINGS LINK / THE COOKIE ICON], or by clearing cookies in your browser settings. Blocking cookies may stop parts of the site from working properly.
7. Who we share your information with
We share your information only where there is a good reason to. The people and businesses we share it with are:
- Our lodge team on Asu Island — for your room, meals, transfers and guided trips.
- Boat operators, drivers and local transfer partners — so that you get from the airport to the island and back.
- Local authorities in Indonesia — where accommodation, immigration or maritime rules require guest details.
- Payment providers and our banks — [STRIPE / PAYPAL / PAYFAST / BANK NAME], to take deposits and balances.
- Technology suppliers — our website host, email provider, form and CRM tools, and backup services. [LIST THE MAIN ONES, e.g. hosting provider, Google Workspace, Mailchimp.]
- Analytics and advertising platforms — [GOOGLE / META], where you have accepted those cookies.
- Travel agents and tour operators — where they arranged your booking.
- Insurers, medical providers and emergency services — if you need help while you are with us.
- Professional advisers — our accountants, auditors and lawyers, where needed.
- Buyers — if the business is sold or restructured, your information may transfer with it.
- Regulators, courts and law enforcement — where the law requires it.
Where a supplier processes information on our behalf, we put a written agreement in place that requires them to keep it secure and to use it only for the purpose we have given them. We do not sell or rent your personal information, and we do not share it with third parties for their own marketing.
8. Sending information outside the UK and South Africa
Running a lodge in Indonesia means your information will be sent to a country outside the UK, the EU and South Africa. Indonesia has not been recognised by the UK Government as providing an adequate level of data protection.
Where we send your information abroad, we rely on one or more of the following:
- the transfer being necessary to perform our contract with you, or to take steps you have asked for before entering a contract, which covers most guest information;
- the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses, with the supplier concerned;
- the supplier being bound by rules or a binding agreement that give effect to a standard of protection similar to POPIA, as section 72 of POPIA requires; or
- your consent, where you have given it after we explained the risks.
You can ask us for details of the safeguards we use for any specific transfer.
9. How long we keep your information
| Type of record | How long we keep it |
|---|
| Enquiries that do not become bookings | 24 months from your last contact with us |
| Booking and guest records | 5 years after your stay, for insurance and complaint purposes |
| Health and dietary information | Deleted within 3 months of your departure, unless a claim or complaint is open |
| Accounting and tax records | 6 years in the UK and 5 years in South Africa, from the end of the relevant financial year |
| Marketing subscriber records | Until you unsubscribe, plus a suppression record so that we do not email you again |
| Website and cookie data | Up to 26 months, depending on the tool |
When a retention period ends, we delete the information or make it anonymous so that it can no longer be linked to you.
10. How we keep your information safe
We use reasonable technical and organisational measures to protect your information, including encrypted connections on our website, access controls and passwords, limited access on a need-to-know basis, regular software updates and backups, and agreements with our suppliers.
No system is completely secure and information sent over the internet always carries some risk. If a breach happens that is likely to cause you harm, we will notify you and the relevant regulator as the law requires.
11. Your rights
You have the following rights over your personal information. They apply whether you deal with our UK or South African entity.
- Access — ask for a copy of the information we hold about you.
- Correction — ask us to fix information that is wrong or incomplete.
- Deletion — ask us to delete information we no longer need.
- Restriction — ask us to pause our use of your information while a query is sorted out.
- Objection — object to us using your information where we rely on legitimate interests, and object to direct marketing at any time.
- Portability — ask for the information you gave us in a common electronic format, or ask us to send it to someone else.
- Withdraw consent — where we rely on consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it.
- Automated decisions — we do not make decisions about you by automated means alone, but you have the right to object if we ever do.
To exercise a right, email us at hello@nias.surf. We may ask you to confirm who you are before we act, so that we do not hand your information to the wrong person. We will respond within one month under UK law, and within a reasonable time under POPIA. If your request is complicated, we will tell you and may take up to two extra months.
South African data subjects may also use the forms prescribed under POPIA and the Promotion of Access to Information Act. Form 2 is used to request access to a record, and Form 1 to object to processing or to ask for correction or deletion. We will send you the correct form on request, and there is no charge for objecting or asking for a correction.
12. Marketing
We only send marketing emails if you have asked for them, or if you have stayed with us or enquired about a stay and we are telling you about similar trips. Every email has an unsubscribe link, and you can also email hello@nias.surf to be taken off the list. We will act on it at no cost to you.
Stopping marketing does not stop the practical messages we need to send about a booking you have made, such as transfer times or payment reminders.
13. Children
Our website and services are aimed at adults. We do not knowingly collect information from children under 18 without the consent of a parent or guardian, or another lawful basis under section 35 of POPIA. Where a child is travelling as part of a family booking, we collect their details from the adult making the booking. If you believe we hold a child's information without proper permission, please contact us and we will sort it out.
14. Other websites
Our site may link to other websites, such as social media pages, booking platforms or surf forecasts. We are not responsible for how those sites handle your information. Please read their own privacy policies before you use them.
15. Changes to this policy
We may update this policy from time to time. The version and date at the top will tell you when it last changed. If we make a significant change, we will let you know by email or with a notice on the site. Please check back now and then.
16. How to contact us
For anything to do with your privacy or this policy, contact our Information Officer and privacy contact:
- Email: hello@nias.surf
- Information Officer: [NAME]
- Postal address: [ADDRESS FOR CORRESPONDENCE]
17. How to complain
If you are not happy with how we have handled your information, please tell us first so that we can put it right. If you are still not satisfied, you can complain to a regulator.
United Kingdom
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk
South Africa
Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Telephone: 010 023 5200 or toll free 0800 017 160
Complaints: POPIAComplaints@inforegulator.org.za (using POPIA Form 5)
General enquiries: enquiries@inforegulator.org.za
Website: inforegulator.org.za
