Personal data policy

TEMPLATE — replace with your company's reviewed policy before go-live.

Natural Investment Group (the data controller) collects guest identity documents solely for the check-in registration required by Indonesian law and for reporting foreign guests to immigration (APOA). Passport data is stored encrypted (AES-256-GCM); every access is written to an append-only log. Guest records are kept for 5 years after check-out and then deleted. Owners' payout and tax attributes are processed to fulfil the management agreement. Processor: the Tenang platform, acting on documented instructions. Requests concerning personal data: privacy@nig.demo. In the event of a personal data breach, affected persons and the supervisory authority are notified within 3x24 hours as required by UU 27/2022.