We are a small liveaboard company in Indonesia. We collect what we need to answer you, to run your cruise safely and to meet the law. We never sell your data, we never share it so that others can market to you, and we only ever promote our own cruises.
This policy explains what we collect, why, who sees it, how long we keep it and how you stay in control. It applies to our website temanliveaboard.com, our emails and WhatsApp conversations, our booking and online check-in forms, and your time on board.
1. Who we are and how to reach us
The controller of your personal data is PT The Teman Seas ("Teman", "we", "us"), Jalan Himalaya II No. 7, Denpasar, Bali, Indonesia.
For anything about your personal data, write to privacy@temanliveaboard.com. A person on our team reads every message.
2. The short version
| What | Why | How long |
|---|---|---|
| Your name, contact details and trip wishes | To answer your enquiry and prepare an offer | 3 years after our last exchange if you do not book |
| Booking and billing details | To confirm, invoice and run your cruise | 10 years, for tax and accounting |
| Passport details | Harbour clearance, immigration and national park requirements | 30 years from the end of the cruise, as part of the signed release |
| Health and medical answers | Your safety on board and in the water | 3 years, then deleted, unless linked to an incident |
| Dive certification and insurance | Diving safety and the law | 30 years, as part of the signed release |
| Photos and videos of you | Our own marketing, only if you agree | Until you withdraw your consent |
| Cookies | Website function, and with your consent, statistics and ads | See our Cookie Policy |
3. What we collect
When you contact us or enquire. Your name, email address, phone number, country, the number of guests, the dates and destination you have in mind, whether you dive or snorkel, your certification level and logged dives, and anything you choose to write in your message. This reaches us through our website forms, email, WhatsApp, or a partner website that uses our booking widget.
When you book. The full names of every traveller, billing name and address, the cabin and departure, and payment records. We see who paid, how much, when and with which reference. We never see or store your card number. Card payments are handled by Flywire and bank transfers by our bank.
When you check in online and sign the release. For each traveller: passport details (name, sex, nationality, passport number, date of birth, expiry, issuing country) and a copy of the passport, contact details, an emergency contact, flight times if you share them, your diving profile, gear sizes, dietary needs and allergies, your answers to our health and medical questionnaire, your travel and dive insurance, your certification card, and your signature on our liability release. When you sign, our system records the time, your IP address and a fingerprint of the signed document, so that the signature can be proven.
On board. Notes the crew needs to look after you, such as dives logged, gear rented and drinks or extras to settle at check-out. If something happens, an incident report.
Photos and videos. Our crew and guides take photos and videos during the cruise. We use the ones where you can be recognised only if you have said yes (see section 7).
From partners. When you book through a travel agent, a dive centre or a booking platform such as LiveAboard.com or ScubaDates, they send us your name and the details we need for your booking. We tell you about this policy as soon as we are in direct contact with you, and at the latest within 30 working days.
On our website. Your IP address, browser and device type, the pages you visit and how you arrived, collected by our security tools and by statistics and advertising cookies according to your cookie choice (see section 15). We record that choice with its date and a scrambled (hashed) form of your IP address, never the address itself, so that we can prove it.
Sensitive data. Health information, passport data and data about children receive extra protection. Health answers are encrypted in our check-in system and only a very small number of people can open them (see section 10).
4. Why we use it, and on what legal basis
We only use your data for a stated purpose and on a legal basis recognised by Indonesian Law No. 27 of 2022 on Personal Data Protection and, where it applies to you, the EU and UK General Data Protection Regulation.
| Purpose | Legal basis |
|---|---|
| Answering your enquiry and preparing an offer | Steps you asked for before a contract |
| Confirming your booking, invoicing, taking payment, running your cruise | Performance of our contract with you |
| Harbour clearance, passenger lists, immigration and national park requirements, tax and accounting | Legal obligation |
| Your health and medical answers, used for your safety | Your explicit consent, and in an emergency your vital interests |
| Responding to a medical emergency on board | Vital interests |
| Keeping the signed release and records as evidence in case of a claim | Legal obligation and our legitimate interest in defending legal claims |
| Website security, fraud and spam prevention | Our legitimate interest, assessed and documented |
| Website statistics and advertising cookies | Your consent in the EEA, the UK and Switzerland; elsewhere our legitimate interest, which you can refuse at any time |
| Sending you news and offers about our own cruises | Your consent, or for past guests our legitimate interest, with an opt-out in every message |
| Using photos and videos where you can be recognised | Your consent |
Where we rely on legitimate interest, we have weighed our need against your rights and put safeguards in place. You may ask us for that assessment.
We do not make decisions about you by automated means alone, and we do not build profiles that have legal or similar effects on you.
5. Who sees your data
Inside Teman. Only the people who need it: our reservations team, our Cruise Director, the Captain and, where it matters for your safety, the dive team. Medical answers are visible in our system to one master user only, and on board to the Cruise Director, the Captain and the dive team.
Service providers working for us. They process your data on our instructions, under contract, and may not use it for their own purposes:
| Provider | What they do for us |
|---|---|
| Hostinger | Website hosting, content delivery and our email mailboxes |
| Google (Google Workspace, Drive, Sheets, Forms, Calendar) | Storing booking records, check-in documents and our schedule |
| Flywire | Processing card and international payments |
| PT Bank OCBC NISP | Receiving bank transfers |
| WhatsApp (Meta) | Messaging with you, when you write to us there |
| Brevo | Sending our email newsletters, once you are subscribed |
| Wordfence (Defiant) | Protecting our website against attacks |
| GTranslate | Translating our website pages |
| Anthropic (Claude) | An AI assistant that helps our team read and draft emails and documents. Your data is not used to train its models |
| Google reCAPTCHA | Protecting our forms against spam robots |
| Google Tag Manager, Google Analytics, Google Ads, Meta (Facebook, Instagram) | Website statistics and advertising, according to your cookie choice |
Others, only when needed. - Indonesian authorities: the harbour master, immigration and national park authorities, when the law or a permit requires your details. - Medical, evacuation and rescue providers, and your insurer, in an emergency or when you make a claim. - The travel agent or partner you booked through, for your own booking. - Our lawyers, accountants and auditors, under a duty of confidentiality. - A court or authority, when the law obliges us. - A buyer of our business, under the same protections, if we ever sell it.
We never sell your personal data. We never share it with anyone for their own marketing.
6. Marketing
We only ever tell you about our own cruises and offers.
- If you enquire, we send you news and offers only if you tick the box to agree.
- If you have sailed with us, we may send you news about similar cruises unless you have told us not to.
- Every email carries an unsubscribe link. On WhatsApp, reply STOP. Or write to privacy@temanliveaboard.com. We stop within 3 x 24 hours.
7. Photos and videos
During the online check-in, we ask each traveller whether we may use photos and videos in which they can be recognised, on our website, social media and advertising. The box is never ticked for you.
- If you say no, we will not publish images in which you can be recognised. When a group photo includes you, we leave it out or make you unrecognisable.
- You can change your mind at any time by writing to privacy@temanliveaboard.com. We remove the images from our website and accounts within 3 x 24 hours and do not use them again. Material already printed or published by others before your request cannot always be recalled.
- For children, only a parent or legal guardian can say yes.
8. Children
Children are welcome on our cruises. We collect a child's data only from a parent or legal guardian, who consents for them, signs the release on their behalf and answers the health questions for them. We never send marketing to children.
9. International transfers
We are based in Indonesia. Some of our service providers store data on servers in other countries, including the United States, the European Union and Singapore. When your data leaves Indonesia, we use providers bound by contract to protect it to a standard at least equal to Indonesian law and, where it applies, the GDPR, including the European Commission's standard contractual clauses where they offer them. We follow the transfer rules of Indonesian law and its implementing regulation as they come into force.
10. How we protect your data
- Health answers are encrypted in our check-in system, with the key kept separate from the data.
- Access is limited by role: our team members only see what their job needs.
- Our website runs on a secure connection and is protected by a firewall.
- Our team is bound to confidentiality.
- Payment card data never reaches us.
No system is perfectly safe. If a breach puts your data at risk, we will tell you and the competent authority within 3 x 24 hours of confirming it, with what happened, what data is involved and what we are doing about it.
11. How long we keep it
| Data | How long |
|---|---|
| Enquiries that do not lead to a booking | 3 years after our last exchange |
| Booking, invoice and payment records | 10 years, as Indonesian tax law requires |
| Signed release, risk acknowledgements, passport, insurance and certification details | 30 years from the end of the cruise, the limitation period for civil claims under Article 1967 of the Indonesian Civil Code |
| Health and medical answers | 3 years, then deleted. If linked to an incident, injury or claim, kept with the whole record for 30 years |
| Unfinished online check-ins | 90 days after the last activity |
| Newsletter subscription | Until you unsubscribe, or 3 years without any interaction |
| Photos and videos | Until you withdraw your consent |
| Cookies | See our Cookie Policy |
At the end of the period we delete the data or make it anonymous, and we keep a record that we did.
12. Your rights
You have the right to: - Know what we hold and why, and get a copy of it. - Correct anything wrong or incomplete. - Delete your data, or ask us to stop or pause using it. - Withdraw your consent at any time, without affecting what we did before. - Object to processing based on our legitimate interest, and to marketing at any time. - Receive your data in a common format, or have it sent to someone else. - Not be subject to decisions made by automated means alone. - Claim compensation if we breach the law.
To use any of these rights, write to privacy@temanliveaboard.com. We may ask you to confirm your identity, proportionately. We act on your request within 3 x 24 hours, as Indonesian law requires. It is free.
Some data cannot be deleted while the law requires us to keep it, for example tax records or the signed release kept as evidence. We will tell you when that is the case and why.
13. Complaints
Please write to us first, we would like the chance to put it right. You may also complain to the Indonesian personal data protection authority (until it is established, the Ministry of Communication and Digital Affairs, Komdigi). If you live in the European Economic Area, the United Kingdom or Switzerland, you may complain to the data protection authority of your country.
14. Where you live
European Economic Area, United Kingdom, Switzerland. We comply with the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection when they apply to you. The legal bases in section 4 and the rights in section 12 are your rights under those laws.
United States. We do not sell personal data and do not share it for anyone else's advertising. You can refuse advertising cookies in our cookie banner at any time, and our website treats the Global Privacy Control signal sent by your browser as a refusal.
Canada, Australia, Singapore and elsewhere. This policy applies to you in full. You may also contact the privacy regulator of your country.
15. Cookies
Our website uses cookies. Those needed for the site to work are always on. If you visit from the European Economic Area, the United Kingdom or Switzerland, statistics and advertising cookies stay off until you accept them. Elsewhere they are on unless you refuse them, which you can do at any time. You can change your choice whenever you like with the round cookie button at the bottom left of every page. Details are in our Cookie Policy.
16. Changes to this policy
When we change this policy, we update the date at the top. If a change affects how we use data you already gave us, we tell you directly before it applies.
17. Language and governing law
This policy is published in English, French and Bahasa Indonesia. It is governed by the law of the Republic of Indonesia. If the versions differ, the Bahasa Indonesia version prevails, without reducing any right you hold under the law of the country where you live.
