Privacy Policy

OriVista is a luxury villa rental and property management company based in Bali, Indonesia, operated by Azure International. We manage a curated portfolio of private pool villas across Canggu, Seminyak, Ubud, Uluwatu, Umalas, and Tabanan.

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights in relation to it. It applies to all personal data collected through orivista.com, book.orivista.com, and any related booking, concierge, or communication services we operate.

For any privacy enquiries, contact us at: support@orivista.com

a) Information you provide directly

Full name, email address, phone number, and nationality

Booking details: check-in and check-out dates, number of guests, villa preference, and special requests

Payment information — processed securely via our PCI-DSS compliant payment provider; we do not store card details

Identity documents where required for villa check-in under Indonesian regulations

Communications submitted via our contact form, email, WhatsApp, or phone

Newsletter subscription and marketing opt-in

b) Information collected automatically

IP address, browser type, device type, and operating system

Pages visited, session duration, scroll depth, referral source, and click behaviour (via analytics tools)

Booking engine interactions and search behaviour on book.orivista.com

c) Information from third parties

Booking data received from OTA channel partners (Airbnb, Booking.com, Expedia, and others)

Reviews and ratings submitted on third-party platforms that we display on our website

We use your personal data for the following purposes:

To process, confirm, and manage your villa reservation and all related services

To send booking confirmations, pre-arrival instructions, and in-stay communications

To provide concierge services including experience bookings, transport, chef arrangements, and beach club access

To personalise your guest experience and improve our services over time

To comply with Indonesian legal and regulatory requirements, including guest registration

To send marketing emails and promotional offers where you have opted in — you may unsubscribe at any time

To prevent fraud, enforce our terms of service, and protect the safety of guests and staff

To analyse website traffic and booking behaviour in order to improve our digital platforms

For guests from the European Economic Area (EEA) or United Kingdom, we process your personal data under the following legal bases:

Contract performance — necessary to fulfil your booking and deliver the services you have requested

Legal obligation — compliance with Indonesian law and applicable international regulations

Legitimate interests — fraud prevention, security, service improvement, and direct marketing to existing guests

Consent — for marketing communications and non-essential cookies (you may withdraw consent at any time)

Our websites use cookies and similar tracking technologies. Full details of the cookies we use, their purpose, and how to manage your preferences are set out in our Cookie Policy, available at orivista.com/cookie-policy. You can update your cookie preferences at any time via the Cookie Settings link in our website footer.

We do not sell your personal data. We may share it with trusted third-party providers who support our operations:

Hostaway — booking and channel management platform

Frappe CRM — guest relationship and lead management

Payment processors — PCI-DSS compliant providers for secure transaction handling

WhatsApp Business API provider (Twilio or 360dialog) — for pre-arrival and in-stay guest communications

Experience and activity operators (e.g. Viator, GetYourGuide) — only where you have booked an experience through us

Vercel — website hosting and performance monitoring

Google Analytics — anonymised website analytics

Meta (Facebook/Instagram) and TikTok — advertising and conversion tracking, subject to your cookie consent

Legal and regulatory authorities — where required by Indonesian or applicable international law

All third-party service providers are bound by data processing agreements and are not permitted to use your data for their own marketing or commercial purposes.

OriVista is based in Bali, Indonesia. If you are located in the EEA, UK, Australia, or the United States, your personal data will be transferred internationally. Where required, we ensure appropriate safeguards are in place, including standard contractual clauses approved by relevant data protection authorities.

We retain personal data only for as long as necessary to fulfil the purposes described in this policy or as required by applicable law. Booking records are typically retained for 7 years for accounting and legal compliance purposes. Marketing data is retained until you withdraw your consent or unsubscribe. You may request deletion of your data at any time (subject to legal retention obligations).

Depending on your country of residence, you may have the following rights regarding your personal data:

Right to access — request a copy of the personal data we hold about you

Right to rectification — request correction of inaccurate or incomplete data

Right to erasure — request deletion of your data, subject to legal retention requirements

Right to restrict processing — request that we limit how we process your data

Right to data portability — request your data in a structured, machine-readable format

Right to object — object to processing based on legitimate interests or for direct marketing

Right to withdraw consent — where processing is consent-based, you may withdraw at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at support@orivista.com. We will respond within 30 days.

If you are a California resident, you have the right to know what categories of personal data we collect and how they are used, to request deletion of your personal data, and to opt out of any sale of your personal data. OriVista does not sell personal data. To submit a CCPA request, contact support@orivista.com.

Our services are not directed to children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data without parental consent, please contact us immediately and we will remove it promptly.

We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our booking platform uses SSL/TLS encryption for all data transmission. Access to personal data is restricted to authorised staff only.

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data practices. The effective date at the top of this document will reflect the most recent revision. We encourage you to review this policy periodically. Continued use of our website following any update constitutes acceptance of the revised policy.

Company: OriVista — Azure International

Email: support@orivista.com

Phone / WhatsApp: +62 811 3803 600

Address: Jl Raya Padonan, Tibubeneng, Canggu, Bali 80361, Indonesia

Website: orivista.com | book.orivista.com