What happens to your data
Short version: this website sets no cookies, runs no analytics and loads nothing from advertising networks. The only personal data we receive is what you send us yourself when you book.
1. Who is responsible
Sumatra Thomas Leaf Monkey Guesthouse & Jungle Trek, Bukit Lawang, Kabupaten Langkat, Sumatera Utara, Indonesia, represented by Brian. Contact: WhatsApp +62 821 6340 7746. Full details are in the legal notice.
We are based in Indonesia. Because we offer our treks to guests from the European Union and the United Kingdom, we apply the standards of the EU General Data Protection Regulation (GDPR) to their data as described here. We have not appointed a representative in the EU.
2. Visiting the website
When you open sumatralife.com, your browser transmits technical data that is needed to deliver the page: your IP address, date and time, the page requested, the referring page, browser type and operating system.
- Server. The website runs on a server in Frankfurt, Germany (Oracle Cloud Infrastructure, EU region). The web server writes an access log containing the data above. Log files are rotated automatically and overwritten after roughly five rotations of 10 MB each; they are used only to detect faults and abuse.
- Cloudflare. Requests reach our server through the content delivery network of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare caches images and files close to you, encrypts the connection and blocks attacks. For this it processes your IP address and request data on its servers, some of which are outside the EU. Cloudflare is certified under the EU–US Data Privacy Framework and offers standard contractual clauses; see Cloudflare's privacy policy.
Legal basis: our legitimate interest in a secure, fast and reliable website (Art. 6 (1) (f) GDPR).
3. No cookies, no tracking
This website does not set cookies and does not use analytics or advertising services. Fonts are served from our own server, not from Google. Your browser may keep a temporary copy of the page in its cache; that is controlled by you.
4. Booking a trek
What you type into the booking dialog (trek, date, number of travellers, name, e-mail address, WhatsApp number, country, remarks) stays in your browser while you fill it in. When you click Reserve, the request is sent encrypted to our server in Frankfurt and stored there together with a booking reference, the date and time of the request and the price calculated for it. Our server does not store your IP address with the booking.
- Purpose. Answering your request, confirming the booking, organising guides, permits, camp and transport, and contacting you before and during the trek (Art. 6 (1) (b) GDPR).
- Confirmation. You receive a confirmation e-mail with your reference and payment details, and Brian confirms on WhatsApp once the deposit has arrived. After reserving, the dialog also offers to open WhatsApp with a message containing your details; it is sent to us only if you confirm it in WhatsApp.
- E-mail delivery. Our e-mails are sent through Resend (Resend, Inc., 2261 Market Street, San Francisco, CA 94114, USA), which processes the recipient address and message content on servers in Japan and the USA for delivery; Japan and the EU–US Data Privacy Framework provide an adequate level of protection under GDPR. Incoming mail to [email protected] is forwarded by Cloudflare to our mailbox. See Resend's privacy policy.
- WhatsApp. The conversation is processed by WhatsApp Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, part of Meta Platforms, under WhatsApp's privacy policy. If you prefer not to use WhatsApp, you can send the same details to us in any other way you like.
- Access. Only Brian can see the stored requests, through a password-protected area. Every access to a booking is logged.
- Payments. Deposits are paid by bank transfer or through Wise (Wise Europe SA, Brussels, Belgium). We receive the payer name, amount and payment reference from our bank or from Wise. We never see your card or online-banking details.
- Storage. Booking records are deleted three years after the trek date (or after cancellation), which covers questions afterwards and Indonesian book-keeping obligations. Chat messages that are no longer needed are deleted earlier. Daily backups of the booking database are kept for 30 days on the same server.
- Sharing. Guides and drivers receive only what they need for your trek (name, group size, dietary or health remarks you gave us). National park permits require the names of participants; these are passed on to the Gunung Leuser National Park office. We do not sell or rent personal data.
5. Links to other services
Buttons and links lead to Booking.com, Tripadvisor, Instagram, Wise and WhatsApp. Data is transmitted to those services only after you click and leave our website; their own privacy policies apply from then on. No content from these services is embedded in our pages.
6. Your rights
You have the right to information about the personal data we hold about you, to have it corrected or deleted, to restrict its processing, to receive it in a portable format and to object to processing based on our legitimate interest. Where processing is based on consent, you can withdraw it at any time with effect for the future. To exercise any of these rights, message us on WhatsApp or write to the address in the legal notice. If you are in the EU or UK, you may also complain to a data protection supervisory authority.
7. Security
The connection between your browser and this website is encrypted (HTTPS), and so is the connection between Cloudflare and our server. Access to the server is limited to key-based logins.
8. Changes
We will update this policy when the website or our services change. The current version is always available at sumatralife.com/privacy/.