How your data is handled

Fast overview

Every page of Penida Snorkel can be read without an account. We set no cookies and run no analytics, advertising or tracking scripts. What does reach us is the connection data any web server sees when it delivers a page, set out below.

Nothing is booked on this site. Choosing a trip takes you to GetYourGuide to book it, and its privacy rules apply there.

Who runs Penida Snorkel

Penida Snorkel
[email protected]

We are under no legal duty to appoint a data protection officer, so there is none. Questions about your data go to [email protected].

What the web server stores

Whenever your browser requests a page or a file, our web server notes the IP address of the request, the date and time, the address asked for, the page you arrived from and the text your browser sends to identify itself and your operating system.

We need these records to deliver the site, keep it stable, spot attacks and abuse, and count how often each page is read. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a site that works and is safe. Raw records are deleted after 90 days at the latest; counts without IP addresses are kept longer. A hosting company runs the server and processes this data for us, on our instructions only.

The shield ahead of our server

The pages and the email of this domain are routed through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which speeds up delivery, blocks attacks and forwards email to our mailbox. For that, Cloudflare processes your IP address and technical connection data.

The legal basis is Article 6(1)(f) GDPR: our interest in a quick, protected website. Cloudflare is certified under the EU-US Data Privacy Framework, and the standard contractual clauses of the European Commission apply as well. Cloudflare describes its own practice at cloudflare.com/privacypolicy.

Photos of the outings

Pictures of the trips are loaded directly from the image servers of GetYourGuide (GetYourGuide Deutschland GmbH, Sonnenburger Straße 73, 10437 Berlin, Germany). To display one, your browser contacts those servers and sends them your IP address, an exchange we cannot influence.

The legal basis is Article 6(1)(f) GDPR: our interest in illustrating each trip with the provider's current photographs.

If you follow a link to book

Every booking link goes directly to GetYourGuide and includes our partner number, which allows the platform to credit a booking to us.

After you arrive on GetYourGuide, that platform sets its own cookies and processes your data under its own privacy policy. We get back commission statements with totals only, never names, contact details or payment data.

Embedded video

Videos are embedded in YouTube's privacy-enhanced mode and remain a still image until you press play, so before that your browser does not contact YouTube. Once you press play, the video loads from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which receives your IP address and may set cookies.

Your consent comes from pressing the play button: Article 6(1)(a) GDPR and Section 25(1) TDDDG. Google's privacy information: policies.google.com/privacy.

What your browser holds on to

Your browser keeps a few small notes so that the site remembers what you chose. They stay on your own device and we cannot read them:

• the items you ticked in a packing list, so they are still marked on your next visit (local storage, kept until you clear it);
• the currency chosen in the menu, so every page quotes prices in it (local storage, kept until you clear it);
• once you open a chat: its reference number, an access key, your email address and a copy of the thread, so you can pick it up again (local storage, kept until you clear it);
• that the chat bubble has already been shown, so it stays out of the way (session storage, erased when the tab closes);
• that the pop-up offered on your way out has been shown, so it does not return (session storage, erased when the tab closes).

These notes are strictly necessary for functions you ask for yourself (Section 25(2) No. 2 TDDDG). You can erase them whenever you like in your browser settings.

Chat conversations

Starting a chat means giving us your name, your email address and your messages. The chat service also logs the country your connection comes from, a hashed form of your IP address (a salted hash that cannot be turned back into the address) and the page and language you wrote from.

Chat threads are stored with Cloudflare (named above), and each message you write is passed on to our account with the messaging service Telegram, which handles it outside the European Union; our replies return the same way. Details: telegram.org/privacy. Your email address is used only to send our answer to you.

The legal basis is Article 6(1)(b) GDPR, since you ask and we answer, together with Article 6(1)(f) GDPR for the hashed IP address, which serves only to stop abuse and spam. A thread is erased automatically 180 days after its last message.

When you email the team

When you write to us by email, we use your message to reply. The legal basis is Article 6(1)(f) GDPR, or Article 6(1)(b) GDPR where the message concerns a contract. Once the exchange is closed we delete it, unless the law obliges us to keep it.

Letterforms and map pictures

Typefaces are delivered by our own server, so no font service hears about your visit. Maps are pictures kept on our server and drawn from OpenStreetMap data, so viewing or zooming them contacts no map service. A "Google Maps" link reaches Google only when you press it.

Where we found our facts

Our pages quote official and expert sources and link to them. Those sites receive nothing from you until you open a link, and from then on their own privacy rules apply.

What you can do as a visitor

You may ask what data we hold about you (Article 15 GDPR), have it corrected (Article 16) or deleted (Article 17), have its processing restricted (Article 18) and receive it in a portable form (Article 20). Where we rely on legitimate interest you may object at any time (Article 21), and a consent you gave can be withdrawn for the future. An email to [email protected] will reach us.

A complaint can also go to a data protection supervisory authority, above all in the EU country of your home or workplace or of the suspected infringement (Article 77 GDPR).

We take no automated decisions about you and build no profiles. You do not have to give us data, but a page cannot reach your screen without technical connection data.