Privacy Policy
This policy explains what personal data DAYS collects when you visit our website, talk to us on social media or messaging apps, or book a trip with us, and what we do with it. It also tells you how to see, correct or delete your data.
01Who we are
DAYS is a culture-driven travel concierge operated by PT Vakansi Media Global (formerly PT Vakansi Kaya Raya), a limited liability company incorporated in Indonesia. In this policy, "DAYS", "we", "us" and "our" mean PT Vakansi Media Global.
We are the data controller (pengendali data pribadi) for the personal data described here, as defined in Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP).
| Company | PT Vakansi Media Global |
| Registered office | Jl. Tebet Barat IX No. 2, RT 001 / RW 004, Kel. Tebet Barat, Kec. Tebet, Jakarta Selatan, DKI Jakarta 12810, Indonesia |
| Business ID (NIB) | 2606240050689 |
| Privacy contact | lets@talkaboutdays.com · +62 812-2000-0185 |
This policy applies to talkaboutdays.com, our accounts on Instagram, Facebook, WhatsApp and other platforms, and any booking or enquiry you make with us.
02Data we collect
We only collect what we need to plan, book and run your trip, and to keep in touch if you ask us to.
Data you give us
- Contact details: name, email address, phone or WhatsApp number, city of residence.
- Enquiry details: the package or event you're interested in, travel dates, group size, budget range and preferences you share in a form, DM or chat.
- Booking and travel documents: full legal name, date of birth, nationality, passport number and expiry, ID card (KTP) details, visa information and copies of documents needed to book flights, accommodation, event tickets or visas.
- Special requirements: dietary needs, accessibility needs, or health information you choose to tell us so we can arrange your trip safely. We treat health information as specific personal data under UU PDP and only use it with your explicit consent.
- Emergency contact: the name and phone number of someone we can reach if something goes wrong while you travel. Please tell them you've shared their details with us.
- Payment information: payment confirmations, bank transfer receipts and invoicing details. Card payments are processed by our payment providers; we do not store full card numbers.
- Communications: messages, emails, voice notes and feedback you send us.
Data we collect automatically
- Device and usage data: IP address, browser type, device type, operating system, pages viewed, referring page and time spent on our website.
- Cookies and similar technologies: see Cookies and the Meta Pixel.
Data from third parties
- Meta platforms (Facebook, Instagram, Messenger, WhatsApp): see the next section.
- Travel partners: booking references, confirmations and itinerary changes from airlines, hotels, ticketing platforms and local operators.
- A person booking for you: if a friend or family member books a group trip, they may give us your name and travel details. They should tell you about this policy.
03Data from Meta products
We use products from Meta Platforms, Inc. and Meta Platforms Ireland Limited ("Meta") to talk to you and to reach new travellers. Depending on how you interact with us, we may receive:
- Instagram and Facebook Messenger messages: your public profile name, username, profile picture and the content of messages you send to our accounts.
- WhatsApp Business messages: your WhatsApp display name, phone number and the content of messages you send us.
- Lead ad forms: the details you choose to submit through a DAYS lead form on Facebook or Instagram, such as your name, email, phone number and trip interest.
- Comments and mentions: public comments, tags and mentions of our accounts.
- Facebook or Instagram Login (if we offer it): your name, email address and profile picture, and only the other permissions you approve on the Meta login screen.
- Meta Pixel and Conversions API: see Cookies and the Meta Pixel.
We use this data only to reply to you, handle your enquiry or booking, and measure and improve our advertising, as described in this policy.
Our commitments on Meta Platform Data. We do not sell, license or purchase data received from Meta. We do not use it to discriminate, to make decisions about eligibility for housing, employment, insurance, credit or similar, for surveillance, or to build profiles of individuals beyond what you'd expect from your conversation with us. We do not share it with data brokers. We only keep it for as long as we need it for the purposes described here, and we delete it when you ask us to (see Deleting your data).
Meta processes your data under its own policies. To learn more, read the Meta Privacy Policy and the WhatsApp Privacy Policy.
04How we use your data
- To answer your enquiries and send you trip proposals and quotes.
- To book and run your trip: reserving flights, accommodation, event tickets and transfers, applying for visas, sending itineraries and supporting you on the ground.
- To take payment, issue invoices and handle refunds.
- To keep you safe while travelling, including contacting your emergency contact if needed.
- To send updates you asked for, such as new package launches and early-access drops. You can opt out at any time by replying "STOP", clicking unsubscribe, or messaging us.
- To advertise and measure our campaigns on Meta and other platforms, including showing DAYS ads to people who visited our website or messaged us, and to people with similar interests.
- To improve our website and services using aggregated analytics.
- To meet legal obligations, including tax, accounting, tourism licensing and requests from authorities where the law requires it.
- To prevent fraud and protect our business, customers and partners.
We do not use automated decision-making that has legal or similarly significant effects on you.
05Legal basis
Under UU PDP (Article 20), we process personal data on one or more of these grounds:
- Contract: to take steps you ask for before booking and to deliver the trip you booked.
- Consent: for marketing messages, non-essential cookies and the Meta Pixel, and any health or other specific personal data. You can withdraw consent at any time; this doesn't affect processing that happened before.
- Legal obligation: to comply with Indonesian tax, tourism and other laws.
- Vital interests: to protect your life or health in an emergency.
- Legitimate interests: to run and improve our business, secure our systems and prevent fraud, balanced against your rights.
07Your travel documents
To book your trip, you'll often send us documents like your passport, KTP, visa, bank statements, employment letters or photos. We treat everything you share as confidential information that stays yours. Sharing it with us gives us no rights over it beyond what we need to deliver your trip.
We only share documents where your trip needs them
We use and share your documents only for the service you asked for, and only with the people who need them to deliver it:
- Airlines and booking systems, to issue your flight tickets.
- VFS Global, TLScontact, BLS International, embassies and consulates, to submit your visa application.
- Hotels and other accommodation, for check-in and registration where local law requires it.
- Event and festival organisers and ticketing platforms, where tickets are issued in your name or need ID.
- Transfer companies, local guides and tour operators running parts of your trip.
- Travel insurers, if you buy insurance through us.
- DAYS staff, agents and professional advisers who need the documents to deliver your trip.
Each of them gets only the documents and details needed for their part of the trip. For example, an event organiser gets your name, not a copy of your bank statement. Everyone at DAYS who handles your documents, including our agents and advisers, must keep them confidential. These commitments apply from the moment you send us a document, and continue after your trip ends until the document is deleted.
What we don't do
- We never use your documents for marketing, advertising or anything unrelated to your booking.
- We never sell them or share them with Meta or other advertising partners.
- We don't copy or reproduce them except when we need to send them to one of the parties above for your trip.
When we delete them
We delete your passport, ID, visa documents and other supporting documents within 90 days after your trip ends. If your trip is cancelled or doesn't go ahead, we delete them within 90 days of the cancellation. We delete them from email, chat, cloud storage and our devices, and tell any staff or agents who received copies to do the same.
You can ask us to return or delete your documents sooner at any time (see Deleting your data). We'll only keep something longer if a law, court process or ongoing dispute requires it, and we'll tell you if that happens. Once a document has gone to an airline, embassy or visa centre, it's handled under that organisation's own privacy policy.
If the law requires us to disclose them
If a court, government agency or regulator legally requires us to hand over your information, we'll tell you in writing before we disclose it, unless the law doesn't allow us to.
08International transfers
Most DAYS trips go abroad, so we have to send some of your data to suppliers outside Indonesia, for example to a hotel in the United Kingdom or a festival organiser in Spain. Some of our service providers (such as Meta and Google) also store data outside Indonesia.
When we transfer data abroad, we follow Article 56 of UU PDP: we transfer it to countries with an equivalent or higher level of protection, or use appropriate safeguards such as contractual commitments, or rely on your consent where no other safeguard is available. Transfers needed to book the trip you ask for are part of delivering that contract.
10How long we keep it
| Data | Retention |
|---|---|
| Enquiries that don't lead to a booking | Up to 12 months after our last contact, then deleted |
| Booking and travel records | For the duration of the trip and up to 2 years after, to handle claims and repeat bookings |
| Passport, ID, visa and other supporting documents | Deleted within 90 days after your trip ends, or 90 days after cancellation if the trip doesn't go ahead (see Your travel documents) |
| Invoices and financial records | 10 years, as required by Indonesian tax and company document retention law |
| Messages on Instagram, Messenger and WhatsApp | Up to 12 months after our last contact, or sooner if you ask us to delete them |
| Marketing contact lists | Until you unsubscribe or withdraw consent |
| Website analytics and cookies | Up to 13 months, or as set in the cookie banner |
When we no longer need your data, we delete or anonymise it.
11Your rights
Under UU PDP, and other data protection laws where they apply to you, you have the right to:
- Be informed about who is processing your data and why (this policy).
- Access your personal data and get a copy of it.
- Correct data that is inaccurate or incomplete.
- Delete your personal data, ask us to return documents you sent us, or ask us to stop processing it.
- Withdraw consent at any time, including for marketing and the Meta Pixel.
- Object to processing based on legitimate interests, and to automated decision-making.
- Restrict or delay processing in certain cases.
- Data portability: receive your data in a commonly used, machine-readable format, or have it sent to another controller.
- Claim compensation for violations of your data rights, as provided by law.
To use any of these rights, email lets@talkaboutdays.com. We may ask you to confirm your identity. We'll respond within 3 × 24 hours for access, correction and deletion requests as required by UU PDP, and tell you if we need more time or can't fully meet a request (for example, where we must keep invoices for tax law).
If you're unhappy with how we've handled your data, please talk to us first. You can also complain to the Indonesian personal data protection authority or the Ministry of Communication and Digital Affairs (Komdigi).
12Deleting your data
You can ask us to delete all personal data we hold about you at any time, including data we received through Facebook, Instagram, Messenger or WhatsApp.
How to request deletion
- Email lets@talkaboutdays.com with the subject line "Data deletion request", or send us a WhatsApp message on +62 812-2000-0185, or a DM on Instagram saying "Delete my data".
- Include your full name and the email address, phone number or Instagram / Facebook username you used with us, so we can find your records.
- We'll confirm we received your request and may ask you to verify your identity.
- We'll delete your data from our systems within 3 × 24 hours of verifying your request, and send you a confirmation with a reference number. Backups are overwritten within 30 days.
If you used Facebook or Instagram Login
You can also remove DAYS's access in your Meta account: go to Settings & privacy → Settings → Apps and websites on Facebook (or Settings → Website permissions → Apps and websites on Instagram), find DAYS and select Remove. Then send us a deletion request using the steps above to delete the data we already received.
What we may have to keep
We may keep a limited amount of data where the law requires it, such as invoices and payment records for tax purposes, or where needed to handle an ongoing claim. We'll tell you what we're keeping and why, and delete it when the obligation ends.
You can also delete messages from your own side of a conversation in Instagram, Messenger or WhatsApp, but that won't remove copies we hold. Send us a request to remove ours.
Step-by-step instructions are also on our data deletion page.
13Security
We protect your data with reasonable technical and organisational measures, including encrypted connections (HTTPS), access limited to staff who need it, two-factor authentication on our business accounts, and secure storage for travel documents. No system is completely secure, so please share passport and ID copies only through the channels we ask you to use.
If a data breach is likely to affect you, we'll notify you and the relevant authority in writing within 3 × 24 hours of becoming aware of it, as required by Article 46 of UU PDP, explaining what happened, what data was involved and what we're doing about it.
14Children
Our website and services are intended for adults aged 18 and over. We do not knowingly collect personal data directly from children. When a child travels on a DAYS trip, we collect their data only from a parent or legal guardian, with their consent. If you believe a child has given us personal data, contact us and we'll delete it.
15Changes to this policy
We may update this policy when our services or the law change. We'll post the new version on this page and update the "Last updated" date. If the changes are significant, we'll let you know by email, WhatsApp or a notice on our website before they take effect.
16Governing law and disputes
This policy is governed by the laws of the Republic of Indonesia. If you have a dispute with us about your personal data, we'll first try to resolve it together. If we can't resolve it within 30 days of one of us notifying the other in writing, either of us may take it forward under Indonesian law, including by complaining to the authority mentioned in Your rights.
17Contact us
For questions about this policy or your personal data, contact:
| Company | PT Vakansi Media Global (DAYS) |
| lets@talkaboutdays.com | |
| Phone / WhatsApp | +62 812-2000-0185 |
| Address | Jl. Tebet Barat IX No. 2, Tebet, Jakarta Selatan 12810, Indonesia |
| Website | talkaboutdays.com |
If this policy is translated into Bahasa Indonesia and the two versions differ, the Bahasa Indonesia version prevails, as required by Law No. 24 of 2009.