Your data, summarised

Briefly put

You can read every page of Tumpak Sewu Waterfall without an account. The site sets no cookies and runs no analytics, advertising or tracking scripts. What does reach us is the connection data that any web server sees when it sends you a page, and it is described below.

Booking never happens on these pages. When you choose a tour, you book it on GetYourGuide, and their privacy rules apply there.

Who runs the site

Tumpak Sewu Waterfall
[email protected]

No law obliges us to appoint a data protection officer, so we have not. Write to [email protected] about any question on your data.

Visit records on the server

Every time your browser asks for a page or file, the web server logs the IP address it came from, the date and time, the address requested, the referring page and the identification text your browser and operating system send.

We need these records to deliver the site, keep it stable, recognise attacks and abuse, and count how often each page is read. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a site that works and stays safe. Raw records are deleted after 90 days at the latest; counts without IP addresses are kept longer. A hosting company runs the server and handles this data for us, on our instructions only.

The network layer ahead of the site

The pages and the email of this domain run through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which delivers the site quickly, filters attacks and forwards mail to our mailbox. To do this Cloudflare processes your IP address and technical connection data.

The legal basis is Article 6(1)(f) GDPR: our interest in a fast, protected site. Cloudflare is certified under the EU-US Data Privacy Framework and the European Commission's standard contractual clauses apply in addition. Cloudflare describes its handling at cloudflare.com/privacypolicy.

Photos in this guide

Tour photographs come straight from the image servers of GetYourGuide (GetYourGuide Deutschland GmbH, Sonnenburger Straße 73, 10437 Berlin, Germany). Showing one means your browser contacts those servers and gives them your IP address, which we cannot influence.

The legal basis is Article 6(1)(f) GDPR: showing each tour with its provider's own current pictures is our interest.

After you click through to book

Our booking links send you directly to GetYourGuide. Each link carries our partner number, so that the platform can credit us with a booking made through it.

When you arrive at GetYourGuide, the platform sets its own cookies and handles your data under its own privacy policy. From them we receive commission reports with totals only: no names, no contact details and no payment data.

Video players on pages

Videos are embedded through YouTube's privacy-enhanced mode and stay a still frame until you press play, so your browser does not contact YouTube before that. After you press play the video loads from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which receives your IP address and may set cookies.

Your consent is the press of the play button: Article 6(1)(a) GDPR and Section 25(1) TDDDG. Google's policy: policies.google.com/privacy.

Items stored in your browser

The site stores a few small notes in your browser so it can honour your choices. They never leave your device, and we cannot see them:

• the boxes you tick on a list, kept so they are still ticked on your return (local storage, until you clear it);
• the currency chosen in the menu, kept so prices stay in it on every page (local storage, until you clear it);
• for a chat you opened: its reference number, an access key, your email address and a copy of the exchange, kept so you can resume it (local storage, until you clear it);
• a flag that the chat bubble was already shown, so it does not pop up twice (session storage, cleared when the tab closes);
• a flag that the leaving-the-site offer was already shown, so it does not repeat (session storage, cleared when the tab closes).

These notes are strictly necessary for features you use yourself (Section 25(2) No. 2 TDDDG). You can remove them whenever you like in your browser settings.

Chat on this site

Opening a chat hands us your name, email address and messages. The chat service also logs the country of your connection, a scrambled form of your IP address (a salted hash, impossible to turn back into the address), and the page and language you were on.

The conversation is held by Cloudflare (named above) and each message is forwarded to our account on the Telegram messaging service, which processes it outside the European Union; our replies return the same way. Read more at telegram.org/privacy. Your email address serves only for our reply.

The legal basis is Article 6(1)(b) GDPR because you write and we answer, and Article 6(1)(f) GDPR for the scrambled IP address, which serves only to stop abuse and spam. A conversation is deleted by itself 180 days after its last message.

Sending us an email

We read an email only to answer it. The legal basis is Article 6(1)(f) GDPR, and Article 6(1)(b) GDPR if the message concerns a contract. The exchange is deleted when it ends, unless the law requires us to keep it.

Lettering and maps

Fonts are delivered from our own server, so no font service sees your visit. Maps are pictures stored on our server and drawn from OpenStreetMap data, so viewing or zooming them contacts no map provider. A "Google Maps" link opens Google only when you press it.

Pages we cite

Our pages quote official and expert sources and link to them. Those sites get nothing from you unless you open a link, and from then on their own privacy rules apply.

Requests you can make to us

You can ask which data of yours we hold (Article 15 GDPR), have it corrected (Article 16) or erased (Article 17), have its processing restricted (Article 18) and receive it in a portable form (Article 20). Where we rely on our legitimate interest, you may object at any time (Article 21), and any consent you gave can be withdrawn for the future. An email to [email protected] does the job.

You may also lodge a complaint with a data protection supervisory authority, particularly in the EU country where you live or work or where the alleged infringement took place (Article 77 GDPR).

We make no automated decisions about you and build no profiles. Giving us data is voluntary, but a page cannot reach your screen without the technical connection data.