Privacy policy

The data controller is PT Mata Luxury Corp, trading as Mata Property, a real estate agency registered in Indonesia, Jl. Gn. Tangkuban Perahu, Kerobokan Kelod, Kuta Utara, Badung, Bali 80361, Indonesia.

For any question about your personal data or to exercise your rights, write to [email protected]. We do not have a designated data protection officer; this address reaches the management of the agency directly.

When you send a request through a form on the site:

• your name, email address and, if you give it, your phone number (with its country code and whether it is on WhatsApp) and your message;
• the optional details of your project: country of residence, time zone (suggested by your browser), whether you are in Bali, type of project, budget, timeline, services you are interested in and preferred way of contact;
• the property you are asking about, and how you found us: the campaign or website that brought you to us and the first page you visited (see section 9).

When you create a client account: your first and last name, email address, phone number if you give it, password (stored only as an irreversible hash), language and currency preferences, the properties you save or compare, the selections our agents send you, and, for each login session, the date, IP address and browser used.

When you propose a property to us from your account: its description, location (the exact address is never published), price, photos and the contact details you give for it.

When you contact us directly by WhatsApp, phone or email: the content of our exchanges, handled in WhatsApp and in our professional email.

When you browse the site: technical data (IP address, browser, pages viewed, referring site) recorded by our host and our network provider for security, and the audience-measurement and advertising data described in section 9. We also count visits and clicks on each property in aggregate form, without any identifier.

We do not ask for, and ask you not to send us through the forms, identity documents, bank details or sensitive data. When a transaction requires them, they are exchanged directly with you and the notary.

Where the Indonesian Personal Data Protection Law (Law No. 27 of 2022) applies, these processing operations rely on the corresponding bases: your consent, the performance of an agreement with you, our legal obligations and our legitimate interests.

We never sell your data, and we do not make decisions about you based solely on automated processing.

Your request is read by the agents and managers of Mata Property who handle it. Our service providers process data on our behalf and only for the services they provide to us:

• Hostinger (hosting of the site and its database, data centre in Jakarta, Indonesia);
• Cloudflare (content delivery and security network through which every visit passes);
• Google (professional email and encrypted backups in Google Workspace; Google Analytics, Google Ads and Google Tag Manager for measurement — see section 9);
• Microsoft (Clarity, which records navigation sessions, with what you type masked, to improve the site — see section 9);
• Meta (WhatsApp, when you choose to contact us that way);
• the OpenStreetMap Foundation, whose servers provide the map tiles displayed on the site and therefore receive your IP address when a map is shown;
• providers of artificial-intelligence tools (Anthropic, OpenAI) that our team uses to draft property descriptions and to manage requests; the content of a request, including your contact details, may be processed by these tools on our behalf.

When your project requires it, and with your knowledge, we pass the necessary information to the professionals involved: notary, lawyer, developer, seller or partner agency. We may also disclose data when required by law or by an authority.

Our database is hosted in Indonesia. Some of our providers (Cloudflare, Google, Microsoft, Meta, the OpenStreetMap Foundation, AI providers) process data in other countries, including the United States and the European Union. When data concerning residents of the European Economic Area, the United Kingdom or Switzerland is transferred, we rely on the safeguards offered by these providers, in particular the standard contractual clauses of the European Commission.

Depending on the law that applies to you (European GDPR, UK GDPR, Swiss data protection law, Indonesian Personal Data Protection Law), you can:

• access your data and obtain a copy of it;
• have it corrected or completed;
• have it deleted, and withdraw your consent at any time;
• object to or restrict its use, in particular for measurement and advertising;
• receive the data you gave us in a commonly used format, to pass it on;
• lodge a complaint with the data protection authority of your country (for example the CNIL in France or the ICO in the United Kingdom) or, in Indonesia, with the Ministry of Communication and Digital Affairs.

To exercise these rights, write to [email protected] from the address you used with us. We answer within the time limit set by the law that applies to you. You can update your name, phone number and preferences yourself in your account; to delete the account, send us a request.

The site is only accessible over an encrypted connection. Passwords are stored as irreversible hashes, access to the back office is limited to our team with individual accounts, backups are encrypted, and our database is not reachable from the internet. No system is completely safe: if a breach likely to affect you occurs, we will inform you and the competent authorities as required by law.

The site uses a small number of cookies and similar storage in your browser. Some are necessary for the site to work; the others are used to measure the audience and the results of our advertising.

In the European Economic Area, the United Kingdom and Switzerland, measurement and advertising cookies are only set if you accept them in the banner shown on your first visit, and the campaign information is only stored after your consent. Until you accept, Google tags may send signals that contain no identifier and are not stored on your device; Google uses them to estimate overall statistics. Elsewhere, measurement is active by default.

Wherever you are, you can change your choice at any time with the "Cookie settings" link at the bottom of every page; refusing deletes the measurement cookies already set.

Our measurement tags are served through our own domain (Google tag gateway, operated by Cloudflare) before reaching Google. When you send a request through a form, your email address and phone number may be sent to Google Ads in hashed form to measure our advertising ("enhanced conversions"); in the countries listed above this only happens with your consent. If you reached us through a Google ad, the click identifier that Google adds to the link is kept with your request; when your project moves forward (active search, then purchase), we report it to Google Ads with that identifier, the stage reached and the date only — never your name, email or phone number — so that Google can measure which ads bring genuine buyers. Google acts as an independent controller for some of these processing operations; see the Google privacy policy for details.

Our services are intended for adults. We do not knowingly collect data from people under 18.

We may update this policy to reflect changes to the site or to the law. The date of the last update is shown at the top of the page; in the event of a significant change, we will inform you on the site or by email.