Privacy Policy

BIND Room is a property management system operated by PT Kelola Kamar Dengan Teknologi, a company incorporated in Indonesia.

• Legal entity: PT Kelola Kamar Dengan Teknologi
• Business Identification Number (NIB): 3005260001633
• Registered office: Jl. Pulau Saelus I, Kel. Sesetan, Kec. Denpasar Selatan, Kota Denpasar, Bali 80223, Indonesia
• Contact: privacy@bindroom.com

Depending on the data, BIND Room acts either as a data controller (deciding why and how data is processed) or as a data processor (processing data on behalf of a property that uses BIND Room).

• Account data (the property owner and users who sign up): we are the controller.
• Guest data that a property enters into BIND Room (e.g. guest name, ID/passport, contact, reservations): the property is the controller and we are the processor, acting on its instructions.
• Usage and technical data (logs, analytics, device data): we are the controller.

• Account & identity data: name, email, phone, password, property and role.
• Guest data (entered by properties): guest name, contact, nationality, and identity documents such as ID card or passport — which may be sensitive personal data.
• Reservation & operational data: bookings, stays, tasks, staff attendance, messages, and reviews.
• Payment data: billing details and transaction records. Card payments are processed by certified gateways (Midtrans, Xendit); we do not store raw card numbers.
• Technical & device data: IP address, browser, device identifiers, cookies, and usage logs.
• Communications: messages you send to support and your preferences.

• Directly from you when you sign up, use the platform, or contact us.
• Automatically through cookies and similar technologies as you use the site and app.
• From third parties such as connected OTAs (Booking.com, Airbnb, Agoda, Expedia and others), payment gateways, and your property’s team.

We process personal data on one or more lawful bases: performance of a contract, consent, compliance with a legal obligation, and our legitimate interests.

• Provide, operate, and maintain the platform (contract).
• Process subscriptions, billing, and taxes (contract and legal obligation).
• Provide support and communicate about your account.
• Secure the service and prevent fraud and abuse (legitimate interest).
• Improve the product and understand usage through analytics (legitimate interest).
• Comply with legal, tax, and regulatory obligations.
• Send marketing where you have consented (you can opt out at any time).

We do not sell personal data. We share it only as needed to run the service and comply with the law:

• Sub-processors that help us run the platform (cloud hosting, payment gateways Midtrans and Xendit, analytics, and communication tools).
• OTAs and integrations you connect (e.g. Booking.com, Airbnb, Agoda, Expedia, Google Calendar), as directed by you.
• Professional advisors such as auditors and lawyers.
• Authorities, when required by law or to protect rights and safety.
• A successor entity in the event of a merger, acquisition, or business transfer.

Some of our providers may process data outside Indonesia. Where we transfer personal data across borders, we apply safeguards required by the PDP Law and, for data protected by the GDPR, appropriate mechanisms such as Standard Contractual Clauses.

We keep account and usage data for as long as your account is active and afterwards only as required for legitimate business, accounting, and legal purposes, then delete or anonymize it. Guest data is retained according to the instructions of the property that controls it.

• Encryption of data in transit.
• Role-based access controls so users only see what they should.
• Card payments handled by PCI-DSS compliant gateways; we do not store raw card data.
• Ongoing monitoring and access logging.

No method of transmission or storage is completely secure, but we work to protect personal data using appropriate technical and organizational measures.

Subject to applicable law, you have the right to access, correct, update, delete, restrict, or object to the processing of your personal data, to withdraw consent, to data portability, and to lodge a complaint with the relevant authority.

If your request concerns guest data held on behalf of a property, please contact that property (the controller); we will assist it as processor. To exercise your rights with us, email privacy@bindroom.com.

If a personal data breach occurs that is likely to affect your rights, we will notify affected data subjects and the relevant authority as required by law (generally within 3×24 hours under the PDP Law).

The platform is not directed to children. Where a property records data of a guest who is a minor, that processing is under the property’s responsibility and lawful basis, including any required parental or guardian consent.

We may update this Privacy Policy from time to time. We will post the updated version here and revise the “last updated” date. Material changes will be communicated where appropriate.

For any privacy question or to reach our data protection contact, email privacy@bindroom.com or write to PT Kelola Kamar Dengan Teknologi, Jl. Pulau Saelus I, Kel. Sesetan, Kec. Denpasar Selatan, Kota Denpasar, Bali 80223, Indonesia.