Your data in plain words

The short form

You can read every page of Jakarta Food Tour without an account. The site sets no cookies and runs no analytics, advertising or tracking scripts. What does reach us is the connection data that any web server sees when it sends you a page, and it is described below.

No booking is made on this site. You book a tour on GetYourGuide or Viator, and their privacy rules apply there.

Who is behind the site

Jakarta Food Tour
[email protected]

No law obliges us to name a data protection officer, so Jakarta Food Tour has none. Questions about your data go to [email protected].

Records our server keeps

When your browser asks for a page or a file, our web server notes the IP address it came from, the date and time, the address requested, the page that referred you and the description of itself and your operating system that the browser sends.

We keep these records to run the site, keep it stable, recognise attacks and abuse, and count how often each page is read. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a site that works and stays safe. Raw records are deleted after 90 days at the latest; counts without an IP address are kept longer. A hosting company runs the server and handles the data for us, on our instructions only.

The relay in front of our server

Pages and email for this domain run through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which serves the site fast, filters attacks and forwards email to our mailbox. For that Cloudflare processes your IP address and technical connection data.

The legal basis is Article 6(1)(f) GDPR, our interest in a fast, protected site. Cloudflare is certified under the EU-US Data Privacy Framework, and the European Commission's standard contractual clauses apply as well. Cloudflare describes its own handling at cloudflare.com/privacypolicy.

Food and tour pictures

Pictures of tours and dishes load straight from the image servers of GetYourGuide (GetYourGuide Deutschland GmbH, Sonnenburger Straße 73, 10437 Berlin, Germany) and, where a card shows a Viator listing, from the image servers of Viator. To show a picture your browser contacts those servers and passes on your IP address, which we cannot influence.

The legal basis is Article 6(1)(f) GDPR: we want each tour shown with the provider's up-to-date pictures.

once you tap a booking link

Each booking link goes straight to GetYourGuide or Viator and carries our partner number, which lets the platform credit us with a booking made through it.

On GetYourGuide or Viator the platform sets its own cookies and handles your data under its own privacy policy. What comes back to us are commission reports with totals only, without names, contact details or payment data.

Videos on pages

Embedded videos run in youtube's enhanced-privacy setting and stay a still picture until you press play, so your browser does not contact YouTube before that. After you press play the video streams from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which receives your IP address and may set cookies.

Pressing play is how you consent: Article 6(1)(a) GDPR and Section 25(1) TDDDG. Google's policy is at policies.google.com/privacy.

what your browser keeps from the Jakarta guide

Your browser stores a handful of small notes so that the site follows your choices. They stay on your device and we have no way to read them:

• the checklist boxes you ticked, so they are still marked on your next visit (local storage, kept until you clear it);
• the currency you pick in the menu, which each page then uses for its prices (local storage, kept until you clear it);
• for a chat you open: its reference number, an access key, your email address and a copy of the thread, so it waits for you on return (local storage, kept until you clear it);
• a flag that the chat bubble already appeared, so it stays quiet afterwards (session storage, gone when the tab closes);
• a flag that the leave-the-page window already appeared, so it does not return (session storage, gone when the tab closes).

Every one of these notes serves a feature you switch on yourself (Section 25(2) No. 2 TDDDG). Clear them in your browser settings whenever you please.

Chat with us

Starting a chat means giving us your name, email address and messages. The chat service also notes the country your connection comes from, a scrambled version of your IP address (a salted hash that cannot be turned back into the address), and the page and language you wrote from.

Cloudflare stores the chat logs (named above); each message you type is relayed to our account on the Telegram messenger, which handles it outside the European Union, and our answers travel back by the same route. More: telegram.org/privacy. We use your email address only to reply to you.

The legal basis is Article 6(1)(b) GDPR, since you ask and we answer, and Article 6(1)(f) GDPR for the scrambled IP address, which we use only against abuse and spam. A conversation is erased automatically 180 days after its last message.

By email

An email to us is used only to answer you. The legal basis is Article 6(1)(f) GDPR, and Article 6(1)(b) GDPR when the message concerns a contract. Once the exchange is over we delete it, unless a legal duty makes us keep it.

Typefaces and map files

We serve the typefaces ourselves, from our own server, so no font service hears about your visit. The maps are images stored on our own server and drawn from OpenStreetMap data; viewing or zooming them contacts no map service. A "Google Maps" link opens Google only when you press it.

where our facts came from

Pages here quote official and specialist sources and link to them. Those sites receive nothing from you until you open a link, and after that their own privacy rules apply.

What you may ask

Request a copy of what we hold on you (Article 15 GDPR), request corrections (Article 16) or deletion (Article 17), limit how the data is used (Article 18) or take a portable copy (Article 20). Where our legitimate interest is the basis you can object whenever you wish (Article 21), and any consent can be withdrawn going forward. Send a message to [email protected] and that is all we need.

You may also lodge a complaint with a data protection supervisory authority, most of all in the EU country where you live, work or think a violation took place (Article 77 GDPR).

No automated decisions are made about you and build no profiles. You do not have to give us data, but without the technical connection data no page could reach your screen.