Privacy Policy

1. Data We Collect

• Identity Data: Full name, date of birth, gender, passport or government ID details.
• Contact Data: Email address, WhatsApp/phone number, physical address.
• Financial Data: Payment details (processed by Stripe/Xendit — Suaka does not store raw card data), bank account details for payouts.
• Profile Data: Account credentials, booking history, reviews, preferences.
• Property Data: Villa details, photos, videos, 3D tour data submitted by Hosts.
• Technical Data: IP address, browser type, device identifiers, cookies.
• Communications Data: Messages via in-app messaging; WhatsApp interactions with support.
• Agent Data: Agent code activity, referral history, commission records.

2. How We Use Your Data

3. Data Sharing

We share data only as necessary: (a) Hosts and Tenants — booking details required for the stay; (b) Payment processors (Stripe, Xendit, PayPal) — for transactions; (c) DocuSign — for digital lease signatures; (d) Google Cloud and AWS — secure data storage; (e) Identity verification providers; (f) Legal/regulatory authorities when required by law. We do not sell personal data to any third party.

4. Data Retention

Personal data is retained while your account is active or as needed to provide services. Financial and contract records are retained for 7 years per UK and Indonesian law. Identity documents are retained for the period required by applicable AML regulations. You may request deletion of your account subject to our legal retention obligations.

5. Cookies

We use essential, functional, analytics, and marketing cookies. A dedicated Cookie Policy is available at www.suaka.com/cookies. Essential cookies cannot be disabled. All other cookie types require your consent via our cookie consent banner. You may withdraw consent at any time through your account settings.

6. Your Rights (UK GDPR)

• Right to Access — request a copy of personal data we hold.
• Right to Rectification — correct inaccurate or incomplete data.
• Right to Erasure — request deletion (subject to legal retention obligations).
• Right to Restriction — limit how we process your data.
• Right to Data Portability — receive your data in a structured, machine-readable format.
• Right to Object — object to processing based on legitimate interests.
• Right to Withdraw Consent — where processing is consent-based.

To exercise any right: info@suaka.com. We will respond within 30 days.

7. International Transfers

Your data may be transferred outside the UK (including to Indonesia). We ensure appropriate safeguards including UK GDPR-approved standard contractual clauses.

8. Security

Suaka uses TLS 1.3 encryption, role-based access controls, and regular third-party security audits. Data is stored on Google Cloud and AWS. We do not store raw payment card data. In the event of a breach, affected users and the ICO will be notified within the legally required timeframe.

9. Children's Privacy

The Platform is not directed at anyone under 18. If we become aware of such data collected inadvertently, it will be deleted immediately.

10. Contact & Complaints

Data Controller: Suaka — operated by Bridging Mountains Ltd. info@suaka.com | +44 7794 881342 | Spitalfields House, Stirling Way, Borehamwood, Hertfordshire, WD6 2FX, United Kingdom

To lodge a complaint: UK Information Commissioner's Office at ico.org.uk.