KURA-KURA PRIVACY POLICY

PT JTB INDONESIA (hereinafter referred to as “KURA-KURA”) places great importance on the privacy of its users. As such, we have established this Privacy Policy to ensure the security and confidentiality of the personal information you provide. This Privacy Policy applies to information collected from users and is effective from 1 January 2014.

In this Privacy Policy, we provide information about the type and use of information that KURA-KURA collects from its users. Before submitting your personal information, please read this policy carefully to learn about our privacy practices. If you have any questions about this policy, please contact us at kura_rsv.id@jtbap.com.

What information we collect from you

1.General users

We automatically collect limited information about your computer when you visit our site. Kura-Kura records the IP address of visitors in the case of a problem occurring on our server, as well as for statistical purposes. The IP address of a user may be the same each time, or it may be different - this depends on the method of connection ie. dial-up or constant connection (eg. DSL or cable modem ). In both cases, it is extremely difficult to gain personal information from the IP address of a visitor, and we will never attempt to find out this information from you.。

If you came to our site by clicking on a link on a different site, Kura-Kura will also record this information. This kind of information helps us understand our users’ preferences and measure the effectiveness of various advertising. It will also help us to customize the content of our website and to improve our service. All information is collectively integrated into our our database (as opposed to being collected individually from each user) and is used as a general overview of all our users.

Small data text files called “cookies” will be sent to your computer’s hard drive. These cookies help us recognize previous visitors and also identify the route history of users. Kura-Kura cannot identify any personal information stored in these cookies, nor can we gain access to any information stored on your hard drive. In addition, we cannot access information from cookies sent from other websites. Information collected will only be used as described above, and also to improve our website.

Each user can prevent their browser from accepting new cookies, however in this case cookies from all websites will be blocked, not only cookies sent from Kura-Kura. As every browser is different, it is best to go to the Help portion of the toolbar of your browser to explain how to block cookies. As personal information cannot be gained, we recommend users to accept cookies sent to them from Kura-Kura.

2. For users using the Ubud Line booking system

If you use the Ubud Line booking system, we will collect personal information from you such as your name, email address and the hotel you are staying in. This information is personally input by you when completing the online booking form, and will be saved for your convenience as cookies on your hard drive. This means that you will not have to enter your information each time you fill out a booking form.

What we collect

Precise location (GPS and network-based)

This permission allows us to use the GPS hardware and Wifi location service to try to keep tracking your device with the high precision demanded by our application logic such as measuring distance between your location and bus stop, whether the device is on the road or inside the building.

Background location

This permission allows GPS tracking when the app is closed or not in use. This allows usage of other phone features or having the phone locked whilst still providing the Kura-Kura apps platform with uninterrupted position data for reliable tracking and give you full experience with the notification sounds. To give the app this permission on later versions of Android, you need to choose the “Allow all the time” option in Settings.
All of the above Information is never stored in our database nor shared with our partners or third parties. All process and logic for calculating the distance happens locally on the apps.

How we use your information

We will use users’ information for the benefit of both Kura-Kura and its website users.

With whom we share your information

As described in this Privacy Policy any personal information collected by KURA-KURA will not be sold or shared in any way (except in the case of our business partners and some third parties). With respect to third parties, general information collected from all users may be provided for the purpose of marketing or promotion. In this case, no information will be provided that can personally identify you.

We may provide personal information to third parties such as market research companies and marketing service providers (such as advertising agencies) for the purpose of KURA-KURA marketing. These third-parties are not permitted to share or use the information for any other purpose.

In addition, KURA-KURA has an obligation to cooperate with the judicial law, should personal information be demanded. In this instance, only limited information as required will be disclosed.

How we protect your information

KURA-KURA has taken steps to protect personal information stored in our systems. For example, only employees who we believe have a legitimate reason will have access to users’ personal information.

We perform measures to avoid the illegal access of users’ information, however no system can guarantee 100% security.

Changes to this Privacy Policy

In the future, KURA-KURA may update this Privacy Policy. We reserve the right to change this policy and in the case of significant changes that affect the personal information we have already collected from users, we will make all reasonable efforts to notify our users of these changes.

GDPR Privacy Policy

The protection of your personal data is of great importance to JTB Group[ JTB Corp. and its affiliates listed in Exhibit. ]. This Privacy Policy therefore intends to inform you about how the JTB Group, whose entities may act as data controllers or processors, collect and processes your personal data that you submit or disclose to us, in the case where the General Data Protection Regulation (“GDPR”) applies to such collection or processing. JTB Group routinely collects, uses, stores and transfers a variety of data, including Personal Data. JTB Group is committed to ensure the privacy of Personal Data throughout its global business, and make sure its employees and business partners also take the necessary measures to protect Personal Data.

This Privacy Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Our Privacy Policy applies to you in the case where the GDPR applies to such collection or processing and is available on our website and through other channels. In all your dealings with us you must ensure that others you may represent are aware of the content of our Privacy Policy and consent to you on their behalf.

We encourage you to read this Privacy Policy carefully. If you do not wish your personal data to be used by us as set out in this Privacy Policy, please do not provide us with your personal data. Please note that in such a case, we may not be able to provide you with our services, and your customer experience may be impacted.

1.Your Personal Data

This refers to a combination of personal data such as your name, address, telephone number, email address, travel preference and special needs/disabilities/dietary requirements that you supply us or is supplied to us, including your social preference, activities and any information about other persons you represent such as those on your booking. Your personal data is collected when you contact us, make a booking, use our website(s)/apps, link to or from our website(s)/apps, connect with us via social media and any other engagement we or our business partner have with you.

2.Processing of Your Personal Data
Data processes

We may collect and process your personal data for the purposes set out below and disclose your personal data to the JTB Group companies for business purposes and also to our service providers who act as ‘controller’ or ‘processor’ on our behalf. These purposes include:

Fulfilling the contract with you and legal obligations (Articles 6(1)(b) and (c) of the GDPR: In order for you to travel abroad, it may be mandatory as required by government authorities at the point of departure and/or destination to disclose and process your personal data for immigration, border control and/or any other purposes. Also we need to provide airlines/accommodation providers with your name, passport number, contact details, and other related information in accordance with their terms and conditions. If you do not provide us with this personal data, we might not be able to offer our services to you.

Fulfilling your and our legitimate interests (Article 6(1)(f) of the GDPR): Where it is in both your and our benefit that we further process your personal data as part of our business administration, maintaining service quality, customer care, business management, risk assessment/management, security, and operation purposes.

Consent: For marketing purposes and other similar data processes that may require your authorization for their processing (Article 6(1)(a) of the GDPR). We will usually inform you before collecting your data if we intend to use your data for such purposes or if we intend to disclose your personal data to any third party for such purposes. You can exercise your right to prevent such processing by checking certain boxes on the forms we used to collect your data.

Explicit consent (Article 9(2)(a) of the GDPR): Information such as health or religion may be considered ‘sensitive personal data’ under the GDPR. This personal data might include information necessary to arrange bookings and travel plans, including your allergies, disabilities, and other relevant health information. We collect it to provide you with our services, cater to your needs or act in your interest, and we are only prepared to accept sensitive personal data on the condition that we have your positive consent. We will process your data for as long as possible in order to fulfil our service to you and comply with the applicable fiscal, tax, securities and commercial law regulations on retention of business and financial documentation.

Children

Our products and services are intended for adult customers. However, we may knowingly collect and process personal data on children under sixteen (16). On these occasions, we will take account of this event when processing the personal data of children and implementing the legal basis for such processing. For example, where the processing of personal data of children is based on their consent such as the processing of his/her sensitive personal data, we will seek the consent of parents, tutors, or other adults holding parental responsibility over children, if required under the GDPR.

Links to other sites

We may propose hypertext links from our websites to third-party websites or Internet sources. We do not control and cannot be held liable for third parties’ privacy practices and content. Please read carefully their privacy policies to find out how they collect and process your personal data.

Data transfers

JTB Group

When we process your personal data, we will store it on our systems located within the European Economic Area (EEA), which comprises the Member States of the EU, Norway, Iceland and Lichtenstein, as well as outside the EEA. In the event of a merger, reorganization, acquisition, joint venture, assignment, spin-off, transfer, or sale or disposition of all or any portion of our business, including in connection with any bankruptcy or similar proceedings, we may transfer any and all personal data to the relevant third party.

Your data may also be processed by staff operating outside the EEA who work for us or for one of our suppliers (e.g., travel guides, transportation services). Such staff may be engaged in, among other things, the provision of support services.

Service providers

For the purpose of providing you with our services, including your booking of flight, hotel, security, incident/accident management etc., we may disclose and process your personal data outside of the EEA countries. In order for you to travel abroad, it may be mandatory as required by government authorities at the point of departure and/or destination to disclose and process your data for immigration, border control and/or any other purposes. Also we need to provide airlines/accommodation providers with your name, passport number, contact detail, etc. in accordance with their terms and conditions.

Legal compliance and security

It may be necessary for us – by law, legal process, litigation, and/or requests from public and governmental authorities within or outside your country of residence – to disclose your personal data. We may also disclose your personal data if we determine that, due to purposes of national security, law enforcement, or other issues of public importance, the disclosure is necessary or appropriate. We may also disclose your personal data if we determine in good faith that disclosure is reasonably necessary to protect our rights and pursue available remedies, enforce our terms and conditions, investigate fraud, or protect our operations or users.

Safeguards to protect your personal data

Where we share your data with a data processor, we will put the appropriate legal framework in place in order to cover such transfer and processing (Articles 26, 28 and 29). Furthermore, where we transfer your data from EEA to any entity outside the EEA, we will put appropriate legal frameworks in place, notably Binding Corporate Rules (Article 47 GDPR), controller-to-controller

(2004/915/EC) and controller-to-processor (2010/87/EU) Standard Contract Clauses approved by the European Commission, in order to cover such transfers (Articles 44 ff. GDPR), or we will share your data based on rules of the GDPR.

By submitting your personal data, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy, in particular, by adopting Binding Corporate Rules (for transfers among certain JTB companies) and Standard Contract Clauses (for transfers among certain JTB companies and with third-parties) where possible.

3.Our Records of Data Processes

We handle records of all processing of personal data in accordance with the obligations established by the GDPR (Article 30), both where we might act as a controller or as a processor. In these records, we reflect all the information necessary in order to comply with the GDPR and cooperate with the supervisory authorities as required (Article 31).

4.Security Measures

We process your personal data in a manner that ensures their appropriate security, including protection against unauthorised or unlawful processing, accidental loss, destruction or damage. We use appropriate technical or organisational measures to achieve this level of protection (Article 25(1) and 32 GDPR). We will retain your personal information for as long as it is necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

5.Notification of Data Breaches to the Competent Supervisory Authorities

In case of breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed, we have the mechanisms and policies in place in order to identify it and assess it promptly. Depending on the outcome of our assessment, we will make the requisite notifications to the supervisory authorities and communications to the affected data subjects, which might include you (Articles 33 and 34 GDPR).

6.Processing Likely to Result in High Risk to your Rights and Freedoms

We have mechanisms and policies in place in order to identify data processing activities that may result in high risk to your rights and freedoms (Article 35 of the GDPR). If any such data processing activity is identified, we will assess it internally and either stop it or ensure that the processing is compliant with the GDPR or that appropriate technical and organisational safeguards are in place in order to proceed with it.

In case of doubt, we will contact the competent Data Protection Supervisory Authority in order to obtain their advice and recommendations (Article 36 GDPR).

7.Your Rights

You have the following rights:

–Access to personal data: You have the right to be provided full information about your personal data that we hold.

–Data correction: You have the right to require that we correct any incorrect information we hold about you.

–Data deletion: You may also have the right to ask that we delete your personal data. Please note that certain conditions may apply to the exercise of this right.

Restriction on processing of personal data: You may have the right to ask that we restrict the use of your personal data. Please note that certain may conditions apply to the exercise of this right.

–Object to processing of personal data: You may have the right to object to the use of your personal data by us. Please note that certain conditions may apply to the exercise of this right.

–Portability of personal data: You may have the right to receive your personal data in a structured and commonly used format. Please note that certain conditions may apply to the exercise of this right.

–You also have the right to obtain from us a copy of the Binding Corporate Rules or of any Standard Contract Clauses that we use if we transfer your personal data outside the EEA and take such arrangement.

To exercise your rights, or if you require further information about how your personal data is used by us, you can contact the staff member in charge of your travel or write to us at: private@jtb.com.

Following is the procedure when you want to execute these rights:

1. Upon receiving your request, we will contact you to confirm the request is being handled, and we will indicate the reasonable timeframe for us to respond.

2. Our special team will make an initial assessment of the request to decide whether it is a valid request and whether confirmation of identity is required.

3. If no further action from you is required, we will proceed with the processing of your request.

4. At the end of our assessment and internal procedure, we will provide a confirmation as to our compliance or processing of your request.

5. For any unfounded or excessive (e.g., further repeated) requests, we may charge a reasonable fee based on administrative costs.

8.When you want to complain about your personal data

We have appointed appropriate staff with management support to oversee and ensure compliance with the GDPR. You can bring complaints in writing by contacting the JTB Data Protection Team at private@jtb.com.

You can also contact the JTB Data Protection Team members or other employees to complain about the way we handle your personal data. The employees to have been confronted with the complaint will inform you about the contract details to file a complaint in accordance with the present procedure or pass the complaint to the JTB Data Protection Team whichever appropriate.

After receiving the complaint the Data Protection Team will send an acknowledgement of receipt within one week to you. The confirmation may include further questions necessary for the clarification of the issues. The Data Protection Team or local Human Resources Department will provide an answer to you as soon as reasonably practicable, but no later than one month upon receiving the complaint. If, due to complexity of the complaint, a substantive response within one month cannot be provided, you will be notified with a reasonable estimate of the timeframe, but not exceeding two months from the notice.

You may also raise the complaint to the relevant Data Protection Authority or lodge a claim with a court of competent jurisdiction.

9.Changes to our Privacy Policy

We may revise or update this Privacy Policy from time to time. Any changes we may make to our Privacy Policy in the future will be posted on this webpage. If we make changes which we believe are significant, we will inform you through the website to the extent possible and seek your consent where applicable.

10.Contact

Questions, comments and requests regarding this Privacy Policy are welcomed and should be addressed to :

PT. JTB INDONESIA
JL. Bypass Ngurah Rai, No 88, Kelan Abian, Tuban, Kuta, Badung, Bali - Indonesia, 80361
PT. JTB INDONESIA Data Protection Team
Email : adi_p.id@jtbap.com

11.About Cookie

PT JTB INDONESIA uses cookie information to provide better services, secure security, analyze and distribute appropriate advertisements to customers. Third-party companies may distribute advertisements or obtain behavioral information for the purpose of advertising their company. Third-party companies use cookies only for advertisement distribution purposes and acquire information. If you wish to invalidate this function, please disable (opt out) from the site of the corresponding company below. ※ If you change browser, delete cookie, etc., you need to set opt-out and opt-in again.

https://kura2bus.rezdy.com/

Exhibit
A. Japan

–JTB Corp.

–JTB OKINAWA INC.

–PTS Corp.

–JTB Global Marketing & Travel Inc.

–JTB Business Travel Solutions, Inc.

–JTB Grand Tours & Services, Inc.

–JTB Media Retailing Corp.

–ASAHI SUN TOURS Inc.

–Travel Plaza International, Inc.

–JTB GAIAREC, Inc.

–JTB Business Network Inc.

–ABI Inc.

–JTB BENEFIT SERVICE INC.

–Japan Tourism Marketing Co.

–JTB BUSINESS INNOVATORS Corp.

–JTB Communication Design, Inc.

–JTB Publishing, Inc.

–JTB Trading, Inc.

–JTB LIFENET Co., LTD.

–JTB GLOBAL ASSISTANCE, INC.

–JTB MEDIA CREATION, Inc.

–Japan Health & Research Institute

–JTB Management Service Corp.

–JTB SAPPORO BUSINESS CENTER Corp.

–JTB Global Merchandising & Support

–JTB System Solution, Inc.

–Tumlare Corporation (Japan)

Kuoni Japan Co. Ltd.

B. EUROPE

–Travel Plaza (Europe)B.V.

–JTB Europe Ltd.

–City Circle UK Ltd

–JTB Switzerland S.A.

–JTB France S.A.S.

–My Bus Trance S.A.S.

–JTB Italy s.r.l.

–My Bus (Italy) s.r.l.

–JTB Germany GmbH

–JTB Viajes SPAIN S.A.

–Travel Plaza Netherlands B.V.

–JTB Greece E.P.E.

–Tumlare Corporation A/S

–Net Service Holding Limited

–Universal NetlinkLimited, Bangkok Limited

–Tumlare Brasil Agencia de Viagens e Turismo LTDA

–Tumlare Software Service Pvt.Ltd.New Delhi

–Tumlare Travel Service Pvt.Ltd.New Delhi

–Tumlare Corporation Inc.

–Tumlare Corporation AS

–OY Tumlare Corporation AB

–TUMLARE CORPORATION AUSTRIA GmbH.

–Tumlare Corporation Hungary Kft.

–Tumlare Corporation Croatia D.O.O.

–Tumlare Corporation Czech Republic.s.r.o.

–Tumlare o.o.o.

–Tumlare Net Travel Service o.o.o.

–Tumlare Corporation Estonia OU

–TUMLARE CORPORATION SWEDEN AB

–Helsingin Laatumatkat OY

–Europa Mundo Vacaciones S.L.

–Kuoni Destination Management Austria GmbH

–Kuoni Destination Management s.r.o.

–Kuoni Destination Management A/S

–Kuoni Euro Accommodation Agency, Paris Branch (in liq.)

–Kuoni GTS (France) SAS

–Conference & Touring C&T GmbH

–GTA-Reisen GmbH

–Kuoni Destination Management S.p.A.

–Kuoni Global Travel Services Italy S.r.l.

–Kuoni Destination Management S.L.

–Gullivers Travel Associates SA

–Kuoni Global Travel Services (Schweiz) AG

–Kuoni Travel Investments Ltd.

–Kuoni Destination Management B.V.

–Kuoni Global Travel Services (UK) Ltd.

–Kuoni Destination Management Ltd.

C. ASIA/PACIFIC

–JTB PTE LTD

– TOUR EAST HOLDINGS PTE. LTD.

–Tour East Singapore (1996) Pte Ltd

–Tour East (Hong Kong) Limited

–Tour East (2009) Sdn Bhd

–Tour East Australia Pty Limited

–PT Perjalanan Wisata Tour East Indonesia

–Singapore Alive Pte Ltd

–Star Holiday Mart Pte Ltd

–JTB POLESTAR COMPANY LIMITED

–JTB-TNT Co., Ltd.

–JTB Taiwan Ltd.

–JTB INDIA PRIVATE LIMITED

–PT JTB INDONESIA

–JTB Cambodia

–JTB New Zealand Limited

–JTB ASIA PACIFIC PHIL. CORP.(JTB Philippines)

–Gullivers (Beijing) Commercial Consulting Services Ltd.

–Gullivers (Beijing) Commercial Consulting Services Ltd., Shanghai Branch

–Gullivers (Beijing) Commercial Consulting Services Ltd., Guangzhou Branch

–Gullivers (Beijing) Commercial Consulting Services Ltd.; Chengdu Branch

–GTA (Hong Kong) Limited

–KGTS (Hong Kong) Limited

–Kuoni Global Travel Services (India) Pvt. Ltd.

–PT GTA Indonesia

–Travel Mark Holidays & Tours SDN. BHD.

–KGTS (Hong Kong) Ltd, New Zealand Branch

–Kuoni GTS (Singapore) Pte. Ltd.

–Kuoni Korea Ltd.

–Kuoni GTS (Taiwan) Limited

–Kuoni GTS (Thailand) Ltd. (formerly Dadsoi Co. Ltd.)

–The Tourism Representative Office of GTA (Hong Kong) Limited in Hanoi

–The Tourism Representative Office of GTA (Hong Kong) Limited in Ho Chi Minh City

D. USA

JTB USA Inc

Kuoni Destination Management USA Inc