ENRU
Subscribe

Privacy policy

How we handle your data.

Last updated April 24, 2026 · Effective immediately · Governed by GDPR (EU residents) and CCPA (California residents) where applicable

1. Who we are

Bali Villa Select (“we”, “us”, the “Site”) is an editorial publication about Bali property investment. We operate the website balivillaselect.com. We do not broker property, sell listings, or earn commissions from developers. For contact, see the bottom of this page.

2. What we collect

  • Data you provide directly via our forms: your name, email address, WhatsApp number, and any qualifying information you choose to share (e.g., investor status, timeline).
  • Usage data automatically, via Google Analytics 4: pages visited, session duration, approximate geographic location (country/city level), device type, and referrer. IP addresses are anonymized by us at the Analytics level.
  • Reading list data stored locally in your browser via localStorage. This data stays on your device and is not transmitted to our servers.
  • Cookies – see our cookie policy for a full list.

3. Why we collect it (legal basis)

  • Consent (GDPR Art. 6(1)(a)) – when you submit a form or subscribe. You can withdraw consent at any time.
  • Legitimate interest (GDPR Art. 6(1)(f)) – for basic website analytics and security monitoring.
  • Contract (GDPR Art. 6(1)(b)) – to fulfil your request for a specific report, playbook, or dossier.

4. Third-party processors

We use the following sub-processors. Each processes your data under their own privacy terms, which we have reviewed.

  • Brevo (Sendinblue SAS, France) – email delivery and subscription management. Brevo privacy policy.
  • Google LLC (United States) – Google Analytics 4 for aggregate usage analytics, with IP anonymization enabled and Google Signals disabled. Google privacy policy.
  • Hostinger International Ltd (Cyprus) – website hosting. Server logs retained for security monitoring up to 30 days. Hostinger privacy policy.
  • Cloudflare, Inc. (United States) – content delivery, DDoS protection, and TLS termination. Cloudflare privacy policy.

5. International transfers

Some of our sub-processors are located outside the EEA. For such transfers we rely on Standard Contractual Clauses (SCC) and, where applicable, Data Processing Agreements with the sub-processors.

6. How long we keep data

  • Email subscriptions: until you unsubscribe. Every email from us contains an unsubscribe link.
  • Lead capture data: up to 24 months after last interaction, then deleted or anonymized.
  • Analytics data: 14 months (Google Analytics 4 default retention).
  • Server logs: up to 30 days.

7. Your rights

Under GDPR (EU residents), CCPA (California residents), and equivalent frameworks:

  • Access – request a copy of the data we hold about you.
  • Correction – ask us to correct inaccurate data.
  • Deletion – ask us to erase your data (subject to legal retention obligations).
  • Portability – receive your data in a machine-readable format.
  • Objection – object to processing based on legitimate interest.
  • Consent withdrawal – withdraw previously given consent at any time.
  • Complaint – lodge a complaint with your local data protection authority.

To exercise any of these rights, email us at [email protected]. We respond within 30 days.

8. Security

We use HTTPS / TLS 1.3 site-wide, strict security headers (CSP, HSTS, X-Frame-Options, Permissions-Policy), and minimum-privilege access to any data we collect. We do not store payment data or government IDs on our servers.

9. Children

The Site is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has submitted data to us, please contact us and we will delete it.

10. Changes to this policy

We update this policy when our data handling changes. Material changes will be communicated via a notice on the Site and, for subscribers, via email. The "Last updated" date at the top of this page is always current.

11. Contact

Email: [email protected]
General inquiries: [email protected]