Privacy policy

Personal data processing policy

Version of 27 August 2026

1. General provisions

This personal data processing policy has been drawn up in accordance with applicable law and sets out the procedure for processing personal data and the measures taken to ensure their security by PT. PREDMET.CONSTRUCTION (the “Operator”).

1.1. The Operator regards respect for human and civil rights and freedoms in the processing of personal data — including the right to privacy and to personal and family confidentiality — as a principal objective and a condition of its activity.

1.2. This Policy applies to all information that the Operator may obtain about visitors to the website https://predmetresort.com/.

2. Key definitions

2.1. Automated processing of personal data — processing by means of computing equipment.

2.2. Blocking of personal data — temporary suspension of processing, except where processing is necessary to correct the data.

2.3. Website — the body of graphic and informational materials, together with the programs and databases that make them available on the Internet at https://predmetresort.com/.

2.4. Anonymisation of personal data — actions after which it is impossible to attribute the data to a particular User without additional information.

2.5. Processing of personal data — any action or set of actions performed on personal data: collection, recording, organisation, accumulation, storage, correction, retrieval, use, transfer, anonymisation, blocking, erasure and destruction.

2.6. Operator — a legal or natural person that, alone or jointly with others, organises and carries out the processing of personal data and determines the purposes of processing, the categories of data and the operations performed on them.

2.7. Personal data — any information relating directly or indirectly to an identified or identifiable User of the website.

2.8. User — any visitor to the website https://predmetresort.com/.

2.9. Provision of personal data — actions aimed at disclosing personal data to a specific person or a defined group of persons.

2.10. Cross-border transfer of personal data — transfer of personal data to the territory of a foreign state, to a foreign natural or legal person or to a foreign public authority.

2.11. Destruction of personal data — actions after which the data are irreversibly destroyed and cannot be recovered.

3. Rights and obligations of the Operator

3.1. The Operator has the right to: obtain accurate information and documents containing personal data from the data subject; continue processing without consent, where lawful grounds exist, after consent has been withdrawn; determine independently the scope and list of measures required to fulfil its obligations.

3.2. The Operator is obliged to: provide the data subject with information about the processing of their personal data upon request; respond to requests and enquiries from data subjects and their legal representatives; ensure unrestricted access to this Policy; take legal, organisational and technical measures to protect personal data against unlawful access, destruction, alteration, blocking, copying and dissemination; cease the transfer and processing of personal data and destroy them where required; fulfil other obligations provided for by law.

4. Rights and obligations of data subjects

4.1. Data subjects have the right to: receive information about the processing of their personal data; demand the correction, blocking or destruction of their data where those data are incomplete, outdated, inaccurate or unlawfully obtained; withdraw consent to processing; appeal against the Operator’s actions to the competent authority or in court.

4.2. Data subjects are obliged to provide the Operator with accurate information about themselves and to notify the Operator of changes to their personal data.

4.3. Persons who provide the Operator with inaccurate information about themselves, or with information about another person without that person’s consent, bear responsibility in accordance with the law.

5. Principles of personal data processing

5.1. Processing is carried out on a lawful and fair basis.

5.2. Processing is limited to the achievement of specific, predetermined and lawful purposes.

5.3. Databases processed for mutually incompatible purposes are not combined.

5.4. Only personal data that meet the purposes of processing are processed, and their volume is not excessive.

5.5. The accuracy and currency of personal data are ensured.

5.6. Personal data are stored no longer than the purposes of processing require, unless a retention period is established by law or by contract.

6. What data are processed, and why

6.1. The website https://predmetresort.com/ is informational. It has no contact forms, no registration and no user account: the website itself neither collects nor stores personal data.

6.2. Personal data are provided to the Operator by the User on their own initiative, when contacting the Operator through the details published on the website — by email or messenger. In that case the name, email address, telephone number and the content of the enquiry are processed. The purpose is to answer the enquiry and, where required, to arrange accommodation.

6.3. Reservations are made in an external booking system, to which the “Book now” buttons lead. The data entered by the User in that system are processed by its operator under that operator’s own privacy policy. The Operator of this website has no access to the data entered there.

6.4. The Website uses cookies for web analytics, and only with the User’s consent. Until consent is given no cookie is set and no third-party script is loaded. Section 7 describes how this works.

6.5. The hosting provider processes the technical data that any browser transmits when contacting a server: IP address, date and time of the request, browser and operating system type, and the address of the requested page. These data are used to deliver the content of the website and to keep it secure.

7. Cookies and analytics

7.1. Cookies are small text files that a website, or a service it loads, stores in the User’s browser. This Website uses them for web analytics only.

7.2. Until the User has given consent, the Website loads no third-party script and sets no cookie at all. Consent is requested by a separate notice on the first visit.

7.3. Once consent is given, Google Tag Manager is loaded and, through it, Google Analytics 4. These services set cookies of their own and send Google information about the visit: IP address, the addresses of the pages viewed, the referring source, the device and browser type, and an approximate location derived from the IP address.

7.4. The purpose is to understand which pages are read and where visitors come from, and to improve the Website. No advertising or retargeting tools are used.

7.5. The User’s own choice — consent or refusal — is kept in the local storage of their browser. This is a technical record: without it the answer could not be remembered and the question would be asked on every visit. It contains no personal data and is not sent to any server.

7.6. Consent may be withdrawn or changed at any time through the “Cookies” link at the bottom of every page. On refusal the analytics cookies are deleted and the services are no longer loaded. Refusal does not restrict access to the Website or its content.

7.7. Cookies can also be deleted and blocked through the browser’s own settings.

7.8. Google processes the information it receives outside the Republic of Indonesia, under its own privacy policy. Data retention settings and lifetimes are configured in the Operator’s Google Analytics account.

8. Conditions for processing personal data

8.1. Processing is carried out with the data subject’s consent to the processing of their personal data.

8.2. Processing may be necessary for the performance of a contract to which the data subject is a party, or in order to enter into such a contract at the data subject’s initiative.

8.3. Processing may be necessary for the administration of justice or the enforcement of a judicial act.

8.4. Processing may be necessary for the legitimate interests of the Operator or of third parties, provided that the rights and freedoms of the data subject are not infringed.

8.5. Processing is permitted where the personal data have been made publicly available by the data subject.

9. Collection, storage, transfer and other processing

9.1. The security of personal data is ensured by legal, organisational and technical measures.

9.2. The Operator maintains the confidentiality of personal data.

9.3. Personal data are not transferred to third parties, except in the cases provided for by law and where such transfer is necessary in order to provide the service requested.

9.4. The period of processing is determined by the achievement of the purposes of processing.

9.5. The User may withdraw consent to the processing of their personal data at any time by sending written notice to predmetresorts@gmail.com.

10. Cross-border transfer of personal data

10.1. The resort is located in the Republic of Indonesia, where Users’ enquiries are also processed.

10.2. Before commencing a cross-border transfer of personal data, the Operator satisfies itself that the foreign state provides adequate protection of the rights of data subjects.

10.3. Transfer of personal data to states that do not meet those requirements is possible only with the written consent of the data subject or for the performance of a contract to which the data subject is a party.

11. Final provisions

11.1. The User may obtain clarification on any question concerning the processing of their personal data by contacting the Operator at predmetresorts@gmail.com.

11.2. Any changes to the personal data processing policy are reflected in this document. The Policy is valid indefinitely until replaced by a new version.

11.3. The current version of the Policy is freely available at https://predmetresort.com/.