Privacy Notice
Version 1.0 · in force from 1 September 2026
This notice explains what we do with your personal data. It is written to
meet our obligations under Law No. 27 of 2022 on Personal Data Protection (UU PDP).
1. Who is responsible
PT Bali Beach Volleyball, operating Bali Volleyball Academy at Kerobokan, Bali, is
the data controller for the data described here. Our contact details are at the end.
2. What we collect
When you book or sign up: your name, the name you like to be called, your
WhatsApp number, your email address, and what you booked.
When you create an account: the above, plus a password, which we never store in
readable form.
When you pay: the amount, the method, and a reference. Card and e-wallet details
are handled by our payment provider and are never stored on our systems.
When you take part: attendance, session history, and, if you tell us, whether you
are a woman or a man, which we use only where a session is for women or for men.
If you are under 18: date of birth and a parent or guardian's name and contact
number. We treat this as specific personal data and hold it more carefully.
When you use this site: a session cookie so you stay signed in, your IP address
and browser, kept for security and to investigate abuse.
Photographs and video: images of you taken at the venue, used as described in
section 6.
3. Why we use it, and on what basis
| What we do | Why | Basis |
| Take and manage your booking | To give you what you booked | Performance of a contract |
| Send confirmations and reminders | So you know when and where to turn up | Performance of a contract |
| Manage your membership and payments | To run the membership you bought | Performance of a contract |
| Keep accounting records | Indonesian tax and company law | Legal obligation |
| Contact you about your booking | To reach you when something changes | Performance of a contract |
| Send you news and offers | To tell you what is on | Your consent, withdrawable at any time |
| Use your image in our marketing | To show what the club is like | Your consent, withdrawable at any time |
| Keep the venue safe and fair | To protect players and staff | Legitimate interest |
4. Who else sees it
- Our payment provider, to take payment
- Our email provider, to deliver confirmations and reminders
- Our messaging provider, where we reply to you on WhatsApp
- Our accountant and, where required, the Indonesian tax authority
- Coaches and reception staff, only as much as they need to run your session
We do not sell your personal data, and we do not share it for anyone else's
marketing.
Some of these providers process data outside Indonesia. Where they do, we rely on the
transfer conditions permitted by UU PDP and satisfy ourselves that the recipient
gives an adequate level of protection.
5. How long we keep it
- Your account and booking history: while your account is open, and for two years
after your last visit, so we can welcome you back rather than start again
- Accounting records: ten years, as Indonesian law requires
- Consent records: for as long as we rely on them, and afterwards as evidence that
consent was given
- Photographs and video: until you withdraw consent, or we no longer need them
- Security logs: twelve months
When a period ends, we delete or anonymise the data.
6. Photographs and video
You choose whether we may use images of you in our own posts and marketing, and you
can change your mind at any time by telling us. Withdrawing consent stops future use;
it cannot always pull back something already published, and we will tell you honestly
what we can and cannot remove. We do not use images of under 18s in marketing without
a parent or guardian's separate consent.
7. Your rights
Under UU PDP you may:
- be told what we hold about you and why
- get a copy of it
- have it corrected or completed
- have it deleted, where we have no lawful reason to keep it
- withdraw your consent, where consent is what we relied on
- object to how we use it, or ask us to pause using it
- ask us to send your data to somebody else in a usable form
- seek compensation where our failure has harmed you
Ask us and we will answer. If we cannot do what you ask, we will tell you why.
8. If something goes wrong
If personal data is exposed in a way that puts you at risk, we will tell you and the
Indonesian authority within 72 hours of becoming aware, and tell you what happened
and what to do about it.
9. Children
We do not knowingly create accounts for people under 18 without a parent or
guardian's consent. If you believe a child's data is here without that, tell us and
we will deal with it.
10. Keeping it safe
Passwords are stored only as salted hashes. Sessions can be revoked. Access to the
register is limited by role, so somebody who runs the desk cannot see the books and
somebody who reads the books cannot change a booking. We record who changed what.
11. Changes
We may update this notice. Every version is dated and kept, and you can ask for the
version that applied when you signed up.
12. Contact us
PT Bali Beach Volleyball, Kerobokan, Bali, Indonesia.
Reach us on WhatsApp or by email at the addresses shown on our contact page. Ask for
whoever handles data protection and your message will get to the right person.