Privacy Policy
Renting a motorbike in Bali means handing a stranger a photograph of your passport. This page says exactly what happens to it: how it is protected, who can see it, and the date it is destroyed.
Version 2.0 · effective 4 September 2026
1. Who is responsible for your data
Bali Easy Ride, a motorbike rental business operated by I Wayan Yogi Pramana Putra from Dalung, Kuta Utara, Badung, Bali, Indonesia. We decide what personal data is collected and why, which under Indonesian law (UU No. 27/2022) makes us the Data Controller. Reach us at hello@balieasyride.com or on WhatsApp.
2. What we collect, and only what we need
To make a booking: your name, email, phone or WhatsApp number, and whether you are an Indonesian citizen or a foreign national. To meet the legal requirement that we verify a rider may ride: your identity document type and number, and a photograph of that document — KTP and SIM C for Indonesian citizens, passport and International Driving Permit for visitors. To deliver the bike: the address, an optional map pin, and any landmark you give us. To take payment: the method you choose, and — if you pay by transfer — the receipt you upload. We also record how you found the site (referring page, campaign, device type) and, through Google Analytics, anonymised usage statistics. We ask for nothing else, and no field beyond these is required to rent from us.
3. Why we are allowed to hold it
Your name, contact details, booking and payment data are processed because they are necessary to perform the rental contract you entered into. Your identity documents are processed to comply with a legal obligation: Indonesian law requires a rental operator to verify that a rider holds a valid licence. Analytics and marketing attribution rest on your consent, which you may withdraw at any time. We do not rely on 'legitimate interest' to hold anything you would not expect us to hold.
4. How your identity documents are protected
Document photographs are encrypted with AES-256-GCM before they are written to storage, so what our storage provider holds is unreadable ciphertext rather than an image. The decryption key is kept separately from the files. They are readable only through an authenticated administrator session and never by any link, and they are never sent by email or WhatsApp. Our website is served only over HTTPS.
5. How long we keep it
Photographs of identity documents and payment receipts are destroyed 90 days after your rental ends. That window exists for two specific reasons — damage disputes, and Indonesian electronic traffic citations, which can reach a vehicle's owner weeks after the event. The rental record itself (who rented what, when, and for how much) and the signed agreement are kept for 10 years, because Indonesian bookkeeping law requires commercial records to be retained. Marketing attribution is deleted after 24 months and enquiries after 24 months. Deletion runs automatically every day; it is not something anyone has to remember to do.
6. Who else sees it
Three companies process data on our behalf, and no others: Vercel Inc. (website hosting and encrypted file storage), Neon Inc. (the database), and Google LLC (Analytics). We do not sell your data, we do not share it for advertising, and we do not pass it to other rental operators. We disclose data to Indonesian police or courts only where the law requires it — for example when identifying the rider of a bike involved in an incident.
7. Data leaving Indonesia
Our hosting and database run on servers outside Indonesia, which means your data is transferred abroad. Under UU No. 27/2022 that is permitted where the receiving party provides an adequate level of protection; our processors are bound by contract to protect it to at least the standard described here. If you are in the European Economic Area, these transfers rely on the European Commission's Standard Contractual Clauses.
8. Cookies
Four, and none of them advertise to you. One remembers the language you chose. One keeps you signed in if you are an administrator. One proves your browser is the one that made a booking, so nobody else can open your booking page by guessing its reference. The last is Google Analytics, which measures how the site is used. Blocking the analytics cookie in your browser does not stop you booking.
9. Your rights
You may ask us for a copy of everything we hold about you, correct anything wrong, ask us to delete it, object to how we use it, or withdraw consent for analytics. Under UU No. 27/2022 we answer within 3 working days; under the GDPR, within one month. Email hello@balieasyride.com and we will confirm your identity before acting, so that nobody else can use these rights against you. Deleting data we are legally required to keep — the rental record and the signed agreement — is the one request we cannot fully grant, and we will say so plainly rather than quietly not doing it.
10. If something goes wrong
If personal data is exposed, we will notify every affected person and the Indonesian authority within 3 × 24 hours as UU No. 27/2022 requires, and tell you what was exposed and what to do about it. We would rather tell you about a problem we caught than have you find out from someone else.
11. Children
The minimum age to rent from us is 18, so this site is not directed at children and we do not knowingly collect their data. If you believe we hold data about a child, tell us and we will delete it.
12. Changes, and how to complain
This policy is version 2.0, effective 4 September 2026. If we change it materially we will change the date here and, for anything that affects a live rental, tell you directly. If we have not resolved a concern to your satisfaction, you may complain to the Indonesian personal data protection authority, or — if you are in the EEA — to your national supervisory authority.
Our other policies