Privacy Statement

Last updated: June 22, 2026

Bali Property Advisory ("BPA", "we", "us") respects your privacy and is responsible for the processing of personal data collected via this website. This statement explains what data we collect, why, and what your rights are.

1. Who are we?

Data Controller:

Data Protection Officer (DPO)

We are not required to appoint a DPO. For privacy questions, please use the email above.

2. What data do we process?

When you use our ROI calculator, we process:

CategoryExamplesSource
Identification dataFirst name, email addressProvided by you in the form
Location dataLatitude/longitude of villa location, region nameIndicated by you via map pin
Investment dataPurchase price, property type, number of bedroomsProvided by you
Calculated outcomesGross yield, net ROI, break-even yearCalculated by our ROI engine
Marketing consentOpt-in checkbox statusIndicated by you
Technical dataIP address (truncated), browser type, language preference, visit timestampAutomatic from your browser
Marketing attributionUTM parameters (source, medium, campaign), referrer URLAutomatic from URL and browser

We do not collect special-category personal data (health, religion, political views, etc.).

3. Why do we process this data?

PurposeLegal basis (GDPR Art. 6)
Generate and send your requested ROI reportPerformance of contract (Art. 6.1.b)
Reach out for a non-binding conversation about Bali propertyConsent via opt-in (Art. 6.1.a)
Site operation and fraud preventionLegitimate interest (Art. 6.1.f)
Site improvement via anonymized analyticsConsent via cookie banner (Art. 6.1.a)
Marketing attribution (which ad brought you here)Consent via cookie banner (Art. 6.1.a)
Comply with legal obligations (accounting, tax)Legal obligation (Art. 6.1.c)

4. How long do we retain your data?

CategoryRetention period
Lead data in CRM (GoHighLevel)24 months after last contact, or as long as the customer relationship is active
ROI calculation logs6 months (technical troubleshooting)
Analytics data (Google Analytics)14 months (GA4 default)
Email delivery logs (Resend)30 days after delivery
Marketing opt-in recordsUntil withdrawal + 5 years (proof of consent)

After this period, data is anonymized or deleted.

5. With whom do we share your data?

We share your data with the following processors (sub-processors), each under a Data Processing Agreement:

ServicePurposeLocation
Vercel Inc.Website hostingEU (Frankfurt)
RailwayBackend worker hostingEU (Amsterdam)
GoHighLevelCRM for lead managementUS (under DPF/SCCs)
ResendEmail delivery of the ROI reportEU/US (under DPF/SCCs)
Anthropic / OpenAIAI text generation for the reportUS (under DPF/SCCs)
MapboxReverse geocoding (location name)US (under DPF/SCCs)
Google Analytics 4Anonymized site analyticsUS (under DPF/SCCs)
SentryError detection and monitoringEU (Frankfurt)
Cloudflare TurnstileBot protectionUS (under DPF/SCCs)

For transfers to the US, we rely on the EU-US Data Privacy Framework (DPF) or Standard Contractual Clauses (SCCs).

We never sell your data to third parties.

6. What are your rights?

Under the GDPR, you have the right to:

Send a request to privacy@balipropertyadvisory.com. We will respond within 30 days.

Not satisfied with our response? You can lodge a complaint with the Dutch Data Protection Authority (https://autoriteitpersoonsgegevens.nl) or any other EU supervisory authority.

7. Security

We take technical and organizational measures to protect your data:

8. Cookies

See our cookie statement for the full list of cookies we use.

9. Changes

We may update this privacy statement. The "Last updated" date at the top shows the latest version. For substantial changes, we will request fresh consent via the cookie banner.

10. Contact

Privacy questions? Email privacy@balipropertyadvisory.com.