Privacy & terms — the deal, in plain words
This page holds everything you're entitled to see in writing: how we handle your personal data, and what applies when you book with us — or need to cancel. No legal maze, no fine print. What's written here is the whole agreement.
Jump straight to what you need: Privacy statement · Booking & cancellation terms — or go straight to deposit & balance, cancellation or arrival & departure
Last updated: July 2026.
Privacy statement
Who is responsible for your data? Villa Tanen is run by its Dutch family owners, reachable at info@villatanen.com. They are the "data controller" for all personal data that reaches us through villatanen.com, WhatsApp and email — not our web developer, not a booking platform. Us.
Here's how to reach us about your data (or anything else):
- Villa Tanen, Jl. Boyong, Tanen 01/25, Hargobinangun, Pakem, Sleman, Yogyakarta 55582, Indonesia
- Or use the contact page
We take your privacy seriously and treat your data confidentially, in line with European privacy law (the GDPR). This statement covers villatanen.com in both languages, plus our contact with you over WhatsApp and email.
What data do we use — and what for?
Only what's needed to answer your enquiry, arrange your booking and look after your stay. We never ask for more: no street address, no required phone number on top of your email, no account.
| What we process | Why | Legal basis (GDPR) |
|---|---|---|
| Your name, email address and/or WhatsApp number, preferred dates, group size, accommodation option and any message you add (the enquiry form's fields — there are no others) | To answer your enquiry and arrange your booking | Performance of a contract (and the steps leading up to it) |
| Your payment status for the deposit and balance (you pay by bank transfer directly to the owner; we only note whether and when payment has come in) | To handle payment and keep our accounts | Performance of a contract + legal obligation (tax records) |
| Practical stay details you choose to share: arrival time, who's in your party, dietary needs | To prepare your stay — so the staff know who's coming and what you need | Performance of a contract |
| WhatsApp and email correspondence | To answer your questions before, during and after your stay | Legitimate interest (good service) |
| Server logs (IP address, timestamp, page requested) | To keep the website secure and running | Legitimate interest (security) |
| Anonymous site statistics (see Cookies & analytics) | To understand which pages are useful | Legitimate interest — no personal data is stored |
What we don't do: we don't sell your data, we don't send newsletters you didn't ask for, and past guests only hear from us if they've explicitly said yes to that.
How long do we keep your data?
No longer than necessary — and "necessary" differs per type of data:
| Data | Retention period | Why |
|---|---|---|
| An enquiry that doesn't become a booking | 12 months | So we can find your details if you book later after all — then the enquiry is deleted |
| Booking and payment records (invoices, payment confirmations) | 7 years | Statutory (tax) retention obligation |
| WhatsApp and email correspondence around your stay | Up to 2 years after your stay | To handle follow-up questions (lost property, return bookings); deleted sooner at your request |
| Server logs | 14–30 days | Security and troubleshooting |
Ask us to delete your data and we will — except where the law requires us to keep something (such as payment records).
Who do we share your data with?
As few parties as possible, and only where it's needed to host you:
- Our staff in Tanen. They receive what they need to welcome you: your name, how many of you are coming, when you arrive, and any dietary needs. Not your payment details, not your correspondence. Since the villa is in Indonesia, these practical details do travel outside the European Economic Area — which is exactly why we keep them to this minimum.
- Our bank. Your deposit and balance are paid by bank transfer directly to the owner; that payment runs solely through the banking system, exactly like any ordinary transfer. All we see is that the amount has arrived — nothing more.
- WhatsApp (Meta). If you choose to message us — the easiest route, but always your choice — that conversation runs on Meta's servers under their own privacy terms. Rather not? Use the form or email instead; you'll get exactly the same answer.
- Our hosting and form providers technically store what you submit through the site. We have data-processing agreements with these parties.
That's the entire list. We don't share your data with anyone else, unless the law requires it.
Cookies & analytics
This website uses no tracking cookies and no advertising cookies. Our visitor statistics are cookieless and anonymous: we can see how many people visit a page, not who you are. That's also why there's no cookie banner here — there's nothing to accept.
The only thing we store on your device is a functional language preference: if you manually switch to English or Dutch, we remember that choice so the site opens in your language next time. That cookie does nothing else and doesn't track you anywhere.
Your rights
Your data stays yours. You can ask us at any time for:
- Access — what do you hold about me?
- Correction — something's wrong, fix it.
- Deletion — remove my data (we will, except what the law makes us keep — see the table above).
- Restriction or objection — stop using my data, temporarily or permanently.
- Portability — hand my data back to me in a usable file.
One message or email via the contact page is all it takes; you'll hear from us within days, and always within the legal one-month limit. If you feel we've handled things badly, you can complain to the supervisory authority — for the Netherlands that's the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Security. The site runs entirely over an encrypted connection (HTTPS), and access to booking data is limited to the people actually arranging your stay. Your deposit and balance are paid by bank transfer directly to the owner — you receive the account details in writing beforehand, in your personal booking confirmation, so you know exactly who and where you're paying. No one can promise one hundred percent security on the internet; this is what we do to get as close as possible.
Booking & cancellation terms
How your booking becomes final
An enquiry through the site, WhatsApp or email is not yet a booking — writing to us commits you to nothing. Here's how it works, exactly as described on the booking page:
- You enquire — by WhatsApp, the form or email, with your dates and group size.
- We confirm personally that your dates are free, with the exact price and what it includes. Usually within a few hours, always within 24 hours.
- You confirm with the deposit by bank transfer to the owner — you'll get the account details in our confirmation. From that moment your booking is final — for you and for us: your dates come off the market, and we won't offer them to anyone else.
Until step 3 you can walk away at no cost; nothing has been booked yet. The price we quote in step 2 is the price you pay — no charges appear that you haven't seen upfront.
Ready for step 1? Check availability — enquiring is free and nothing is locked in until the deposit.
Deposit & balance
- Deposit: once we've confirmed your dates in person, you pay 30% of the total price by bank transfer to the owner, within one month of booking. That makes your booking final.
- Balance: the remainder is due no later than one month before arrival, the same way. We'll send you a reminder in good time — you don't have to track deadlines yourself.
- Always directly to the owner. You pay by bank transfer; every detail — dates, price and the account details — is put in writing in your booking confirmation beforehand, so you know exactly who you're paying.
- What the price includes — breakfast, daily housekeeping, all villa facilities — is listed in full on rooms & rates; the price in our confirmation is all-in, with no hidden surcharges.
Ready to lock in your dates? See if your dates are still open — enquiring is free, and the deposit only follows once your dates are confirmed.
Need to cancel?
Plans change — especially for a trip to the other side of the world. The full cancellation terms, including the schedule of deadlines and refunds, come with your booking confirmation and are set out on the booking page.
Cancelling takes one WhatsApp message or email; we confirm the cancellation and any refund in writing, and refund to the same bank account you paid from.
And if we have to cancel?
Fair is fair — this cuts both ways. If circumstances on our side mean we can't deliver your stay, we make sure you don't lose out financially: you get back every cent you've paid, or you rebook to new dates at no cost — your choice.
If cancelling is this easy, imagine how easy booking is: plan your stay — nothing is locked in until the deposit.
Arrival & departure
- Check-in: the exact check-in time comes with your booking confirmation. Landing early on a morning flight? Message us — the staff are around all day, and you can usually drop your bags and head straight into the garden.
- Check-out: the exact check-out time comes with your booking confirmation. Late flight home? Just ask — there's often room to be flexible, though we can't promise anything when new guests arrive the same day.
- Tell us when you land: share your expected arrival time by WhatsApp beforehand, and someone will be ready for you.
The full house rules — what the staff take care of, how the pool and shared spaces work — come with your booking confirmation and are summarised on the practical page. There aren't many, and they exist mostly so twelve guests can enjoy the same garden at once.
One more question before you book? Just message us — you'll get a personal reply from the same people who look after your stay, and the rest is sorted in a couple of messages.
Questions about your data or our terms?
Just ask — there's no lawyer standing between you and us on this page. Use the contact page or send us a message via WhatsApp us; you'll get a personal reply from the same people who handle your booking.
Done with the fine print that isn't? Check availability and book direct with the owner.