Privacy Policy

1. Who We Are

SailTix.com is operated by PT Sailtix Lintas Samudra, a company registered in Bali, Indonesia ("Sailtix", "we", "us"). PT Sailtix Lintas Samudra is the data controller for the personal data described in this policy. You can reach us about anything privacy-related via our Contact page or at support [at] sailtix [dot] com.

2. Information We Collect

We collect personal information that you provide directly to us when you use our services, make a booking, or contact us. The types of information we collect include:

• Personal Identification Information: Name, email address, phone number, and other contact details.
• Booking Information: Details of your bookings, such as trip dates, destinations, and passenger information.
• Payment Information: Payment method details and transaction information used to complete your bookings. We use Xendit as our secure payment processor with tokenization technology to process payments without storing your actual card data.

3. Information Collected Automatically

When you visit our website, we may also collect certain information automatically, subject to the consent choices described in section 5:

• Log Data: Your IP address, browser type, operating system, and pages visited on our website.
• First-Party Analytics: We operate our own visitor analytics. A random identifier (not your name) is stored in your browser and sent with events such as page views and searches, together with the page visited and your country and network (derived from your connection). If you complete a booking, we link this browsing activity to your order so we can understand which searches lead to bookings and assist you with your reservation.
• How You Found Us: When you arrive via a link that carries campaign or referral information (for example from a search engine or an advertisement), we record that source and associate it with any booking you make in the same visit.
• Google Analytics: With your consent where required, Google Analytics collects pseudonymized information such as your browsing behavior and device information to help us understand how the site is used.

4. How We Use Your Information and Our Legal Bases

We use the information we collect for the following purposes. Where EU/EEA, UK, or Swiss data protection law applies, the legal basis for each purpose is noted:

• To process your bookings and provide the requested services, including sharing passenger details with the operator of your vessel (performance of a contract).
• To communicate with you regarding your bookings and travel updates (performance of a contract).
• To process payments securely through Xendit (performance of a contract).
• To keep transaction records required by tax and financial regulations (legal obligation).
• To secure our website and prevent fraud and abuse (legitimate interests).
• To analyze how the website is used and improve our services and marketing (consent, where required; otherwise legitimate interests).
• To send you promotional communications, where permitted by law (consent).

5. Cookies, Similar Technologies, and Your Choices

We use cookies and browser storage in two categories:

• Essential: Sign-in sessions, your language and currency preferences, security tokens, and the record of your cookie choice itself. These are required for the site to work and do not need consent.
• Analytics: Google Analytics cookies (such as _ga) and the first-party analytics and attribution identifiers described in section 3. These are optional.

If you are visiting from the EU/EEA, the United Kingdom, or Switzerland, analytics is switched off until you allow it in the consent banner. You can change your choice at any time using Cookie Settings in the page footer; withdrawing consent stops all further analytics collection from your browser.

6. Secure Payment Processing with Xendit Tokenization

We use Xendit as our secure payment processing partner with advanced tokenization technology to process your payments. This ensures maximum security for your payment information while maintaining seamless transaction processing. Xendit is a trusted third-party payment processor that adheres to strict security standards and PCI DSS compliance requirements.

Tokenization Technology: When you make a payment on our website, your card information is securely transmitted to Xendit and immediately converted into a secure token. This token is used for transaction processing while your actual card data is never stored on our servers or in our systems.

What we collect: We only collect payment method information necessary for transaction processing. Your actual card details are never stored on our servers — they are immediately tokenized by Xendit for secure processing.

How Xendit processes your data: Xendit securely processes your payment information using tokenization technology and handles all transaction processing. They are responsible for the security and compliance of your payment data during the transaction process. For more information on how Xendit handles your data, please refer to Xendit's Privacy Policy.

7. Sharing Your Information

We do not sell or rent your personal information to third parties. We share it only where needed to provide our services:

• Vessel Operators: The ferry or charter operator running your trip receives the passenger details required for your booking, such as names on the passenger manifest.
• Payment Processing: Xendit processes your payments as described in section 6. See Xendit's Privacy Policy.
• Analytics: Google processes analytics data on our behalf, subject to your consent choices. See Google's Privacy Policy.
• Service Providers: Hosting, communication, and support providers that help us operate the website. They are contractually obligated to keep your information confidential and use it only for the purposes we specify.

8. International Data Transfers

We are based in Indonesia, and your data is processed on our systems there as well as by service providers in other countries, including the United States (Google) and Singapore. Indonesia and some of these countries are not covered by an adequacy decision of the European Commission, meaning their laws do not guarantee the same level of data protection as the EU.

Where we transfer data of visitors from the EU/EEA, UK, or Switzerland, we rely on the transfer being necessary to perform your booking contract, on your consent (for optional analytics), and on contractual protections with our service providers. Google participates in the EU-U.S. Data Privacy Framework.

9. Data Retention

We keep personal data only as long as it is needed:

• Transaction Records: Retained for accounting and legal purposes, typically 7 years as required by financial regulations. We never store card details — only transaction metadata and secure tokens, as described in section 6.
• Account Data: Kept until you delete your account or ask us to remove it — see our Data Deletion Policy.
• Analytics Events: Raw first-party analytics events are deleted in periodic clean-ups once they are no longer needed for the analysis described in section 3.

10. Data Security

We take reasonable measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction. However, please be aware that no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

11. Your Rights

You have the right to access, correct, update, or delete your personal information. If you wish to exercise any of these rights, please contact us via our Contact page or at support [at] sailtix [dot] com. We will respond to your request within a reasonable timeframe.

If you are in the EU/EEA, the United Kingdom, or Switzerland, you additionally have the right to:

• Restrict or object to our processing of your data;
• Receive the data you provided to us in a portable format;
• Withdraw consent at any time (for analytics, use Cookie Settings in the page footer) — this does not affect processing that happened before withdrawal;
• Lodge a complaint with the data protection authority in your country.

12. Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal obligations. Any changes will be posted on this page, and we encourage you to review our privacy policy periodically.

13. Contact Us

If you have any questions or concerns about our privacy practices, please contact us at our Contact page or at support [at] sailtix [dot] com.