GDPR Notice

Who controls your data, why we process it and what rights you have.

Last updated: 3 September 2026

Information on the processing of personal data pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 of 27 April 2016 (GDPR).

Controller

The controller of personal data is M&M Marcin Marcińczak (trading as Art Bali Travel), ul. Widokowa 8, 78-111 Ustronie Morskie, Poland, VAT/NIP 6711639780; contact person: Malwina Marcińczak, e-mail: kontakt@artbalitravel.pl, phone +48 514 895 277.

Purposes and legal bases

  1. Replying to enquiries and preparing a journey offer — Art. 6(1)(b) GDPR (steps at your request prior to a contract) and Art. 6(1)(f) GDPR (legitimate interest: correspondence).
  2. Concluding and performing the journey agreement, including hotel, transport and guide bookings — Art. 6(1)(b) GDPR.
  3. Legal obligations (tax, accounting) — Art. 6(1)(c) GDPR.
  4. Newsletter — Art. 6(1)(a) GDPR (your consent).
  5. Special-category data (health, diet, fitness information relevant to safe participation) — Art. 9(2)(a) GDPR (explicit consent), only to the extent you provide it.
  6. Establishing or defending claims — Art. 6(1)(f) GDPR.

Recipients

Data may be shared with: the form service provider (FormSubmit), the hosting and e-mail provider (LH.pl), local partners in Indonesia (hotels, carriers, guides — only data needed for bookings), the accounting office, the insurer and public authorities where required by law. Details in the Privacy Policy.

Transfers outside the EEA

To organise journeys to Indonesia, some data (name, passport details, date of birth) must be shared with partners in Indonesia — a country without an EU adequacy decision. The transfer is based on Art. 49(1)(b) GDPR (necessary for the performance of a contract concluded in your interest). Online tool providers outside the EEA operate under standard contractual clauses or the Data Privacy Framework.

Retention

  • correspondence and enquiries — until the matter is closed, no longer than 12 months;
  • agreement data — for the duration of the agreement, then for the limitation period and as required by tax law (up to 6 years);
  • newsletter — until consent is withdrawn;
  • photos with your image — until consent is withdrawn.

Your rights

You have the right to access, rectify, erase, restrict, port your data, to object, and to withdraw consent at any time (without affecting prior processing). You may also lodge a complaint with the President of the Polish Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw) or your local supervisory authority.

Voluntary provision

Providing data is voluntary but necessary to reply to your enquiry, conclude an agreement and take part in a journey. Providing an e-mail for the newsletter is entirely voluntary.

Automated decisions

We do not make automated decisions and do not profile your data.

Contact

For all matters concerning personal data: kontakt@artbalitravel.pl, phone +48 514 895 277.