Privacy Notice

This notice explains how Villaconn handles personal data when you visit our Bali website, submit an enquiry, or contact us about trying Villaconn on your properties.

Effective 16 August 2026 · Version 2026-08-16

1. Who controls your data

The personal data controller for this website and its enquiry form is Vitaly Babich, an individual operating under the Villaconn name. You can contact the controller at hello@villaconn.com.

This launch notice covers website visitors and prospective business customers. If you start using the Villaconn product, the customer agreement, product privacy notice and data-processing terms supplied during onboarding will govern operational, staff and guest data.

2. Data we collect

When you use the enquiry form, we collect:

• your name;
• your phone number, WhatsApp handle or other contact detail;
• the approximate number of villas you manage;
• your consent choice, notice version, market and submission time;
• technical and security data normally generated by hosting and delivery systems, such as IP address, browser information and server logs.

If you contact us through email, WhatsApp or Telegram, we also receive the profile details and message content that you choose to send through that service. Please do not send identity documents, payment details, health data or other sensitive information in an initial enquiry.

3. Website analytics

We measure how the website is used with Cloudflare Web Analytics. It is a privacy-preserving service: it sets no cookies, does not fingerprint your device, does not follow you across other websites and does not build advertising profiles.

For each page view it records:

• the page address and the referring page, if any;
• browser and operating-system type;
• country, derived from the IP address at the moment of the request;
• page loading performance.

Your IP address is processed to derive the country and to protect the service, and is not used by us to identify you or stored by us alongside enquiry data. Analytics data is aggregated; we cannot link a page view to a named person.

We rely on our legitimate interest in understanding whether the website is useful and in keeping it fast and reliable. Because no cookies or similar device storage are used, we do not ask for separate consent for measurement. If we later introduce advertising or cross-site tracking technologies, we will ask for consent where the law requires it and update this notice first.

4. Why and on what basis we process data

• Responding to your enquiry: based on your explicit consent and steps requested by you before entering a possible agreement.
• Arranging a demonstration or trial: to take requested pre-contractual steps and communicate with you.
• Security and reliability: for our legitimate interest in preventing abuse, diagnosing failures and protecting the website.
• Legal records: to demonstrate consent and comply with applicable legal obligations.

We do not use the enquiry consent for unrelated advertising. If we later introduce promotional mailing, we will request a separate choice where the law requires it.

5. Consent

The enquiry form asks for explicit electronic consent. The box is not pre-selected and the request is shown separately from other text. We record the consent value, its scope and the version of this notice with the form submission so that the choice can be demonstrated.

You may withdraw consent at any time by emailing hello@villaconn.com. Withdrawal does not affect processing that was lawful before we received it. If information is still required for a contract, legal claim, security record or other lawful basis, we will tell you what must be retained and why.

6. Who may receive the data

We disclose only what is necessary to service providers in these categories:

• CV Rumahweb Indonesia, which supplies the website's VPS hosting and infrastructure; the selected server zone is the TechnoVillage data centre in Bogor, Indonesia;
• Cloudflare, Inc. (United States), which provides the cookieless website analytics described in section 3;
• form delivery and business email;
• WhatsApp, Telegram or another communication service you choose to use;
• technical support and professional advisers under confidentiality duties;
• public authorities where disclosure is legally required.

These providers process data under their own terms or on our documented instructions, depending on their role. We do not sell personal data.

7. Processing outside Indonesia

Website and form data hosted on the selected Rumahweb VPS is intended to be stored in Indonesia at TechnoVillage, Bogor. Related data may still be processed outside Indonesia when you choose email, WhatsApp, Telegram or another international communication service, when the cookieless analytics described in section 3 is provided by Cloudflare in the United States, or when a necessary support or security provider operates internationally.

Where personal data is transferred across borders, we use an available lawful transfer mechanism, assess the protection available and apply contractual, organisational and technical safeguards. Where adequate or binding protection is not otherwise available, the form requests your explicit consent to the transfer.

8. Retention

• Unsuccessful or inactive enquiries are deleted or anonymised within 12 months after the last meaningful contact.
• Consent and deletion-request records may be retained for up to 3 years after the related enquiry to demonstrate compliance or resolve a dispute.
• Security logs are normally retained for no longer than 90 days unless an incident requires longer preservation.
• If you become a customer, relevant contact information moves to the customer record and follows the retention terms provided during onboarding.

9. Your rights

Subject to applicable law, you may ask us to:

• confirm whether we process your data and provide access or a copy;
• correct inaccurate or incomplete data;
• stop, restrict, delete or destroy data where the applicable conditions are met;
• withdraw consent;
• object to a decision based solely on automated processing that has a legal or similarly significant effect;
• receive data in a portable form where the right applies;
• raise a complaint or seek compensation as provided by law.

Send a request to hello@villaconn.com. We may ask for proportionate information to verify that the request relates to you. A practical deletion procedure is available on our data-deletion page.

10. Security and incidents

We will restrict administrative access, require our selected providers to use appropriate security measures and configure encrypted network transport for the production site. No internet system can be guaranteed completely secure. If a personal-data protection failure occurs, we will investigate, contain it and issue the notices required by applicable law.

11. Children

The enquiry form is intended for adult property owners and business representatives. We do not knowingly request data from children. Where Indonesian law requires parental or guardian consent, we will not process a child's data on consent alone without that authorisation.

12. Changes to this notice

This is version 2026-08-16, which added section 3 on website analytics. Consent given earlier remains linked to version 2026-08-15. We will update the page before a material change to the disclosed purposes, data, recipients, retention or transfer arrangements takes effect. Where required, we will request fresh consent.

13. Contact

Privacy questions, consent withdrawal and rights requests: hello@villaconn.com.