Margana - OTA Tour & Travel

1. Introduction

PT MARGANA VISTA INDONESIA ("we", "our", or "us") is committed to protecting the privacy and personal data of our customers, including those in the European Union (EU) and European Economic Area (EEA). This GDPR Compliance Statement explains how we comply with the General Data Protection Regulation (GDPR).

2. Data Controller

PT MARGANA VISTA INDONESIA
Legal Number: AHU-0053748.AH.01.01.TAHUN 2026
Perumahan Taman Sekar VI D Blok T. No .5, Desa/Kelurahan Padangsambian, Kec. Denpasar Barat, Kota Denpasar, Provinsi Bali, Kode Pos: 80117
Email: info@marganago.com
Phone: +62 813 3838 892

3. Legal Basis for Processing

We process your personal data based on the following legal grounds:

Contractual Necessity: Processing necessary to fulfill our contractual obligations for tour bookings and services
Consent: Where you have given explicit consent for specific processing activities
Legitimate Interests: For purposes such as fraud prevention, security, and business operations
Legal Obligation: Where required by applicable laws and regulations

4. Data We Collect

We collect and process the following personal data:

Identity Data: Name, date of birth, passport/ID information
Contact Data: Email address, phone number, mailing address
Travel Data: Booking details, travel preferences, special requirements
Financial Data: Payment information (processed securely through third-party payment processors)
Technical Data: IP address, browser type, device information, cookies
Communication Data: Emails, chat messages, customer support interactions

5. Your GDPR Rights

Under GDPR, you have the following rights:

Right to Access: Request a copy of your personal data
Right to Rectification: Request correction of inaccurate or incomplete data
Right to Erasure: Request deletion of your personal data (right to be forgotten)
Right to Restrict Processing: Request limitation of how we process your data
Right to Data Portability: Request transfer of your data to another organization
Right to Object: Object to processing based on legitimate interests
Right to Withdraw Consent: Withdraw consent at any time where consent is the legal basis

6. Exercising Your Rights

To exercise your GDPR rights, please contact us at info@marganago.com with the subject line "GDPR Rights Request." We will respond to your request within 30 days of receipt.

7. International Data Transfers

As an Indonesian company, we may transfer your data to countries outside the EU/EEA. We ensure appropriate safeguards are in place to protect your data, including:

Standard Contractual Clauses (SCCs) approved by the European Commission
Data Protection Agreements with third-party service providers
Adequacy decisions where the European Commission has recognized the destination country as having adequate data protection laws

8. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this policy:

Booking Data: Retained for 7 years after completion of travel (accounting and legal requirements)
Account Data: Retained while your account is active and for 3 years after account closure
Marketing Data: Retained until you withdraw consent or request deletion
Support Communications: Retained for 3 years after the last interaction

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

Encryption of data in transit and at rest
Secure payment processing through PCI DSS compliant providers
Access controls and authentication systems
Regular security assessments and updates
Employee training on data protection

10. Cookies and Tracking

We use cookies and similar technologies to improve your browsing experience. You can manage your cookie preferences through your browser settings. For detailed information about our cookie usage, please refer to our Privacy Policy.

11. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you without undue delay and, where feasible, within 72 hours of becoming aware of the breach. We will also notify relevant supervisory authorities as required by GDPR.

12. Changes to This Policy

We may update this GDPR Compliance Statement from time to time to reflect changes in our practices or applicable laws. We will notify you of any material changes by posting the updated policy on our website.

13. Supervisory Authority

If you believe our processing of your personal data infringes GDPR requirements, you have the right to lodge a complaint with a supervisory authority in the EU member state where you reside or where the alleged infringement occurred.

14. Contact Information

For GDPR-related inquiries, data subject requests, or to exercise your rights, please contact us at: