**Nihi Sumba Trip (nihisumbatrip.com) collects only the personal data needed to answer your enquiry and arrange a Sumba trip: your name, contact details, travel dates and party details. The site is run by Indonesia Juara Trip under Juara Holding Group, and we share your data with hotels and transport providers only to fulfil the request you make.**
Effective and last reviewed: 15 September 2026.
> We are an independent Sumba travel provider (Indonesia Juara Trip). This website is not owned, operated, sponsored by, or affiliated with NIHI Sumba. NIHI Sumba is mentioned as one accommodation option; bookings are subject to the hotel’s confirmation and terms.
The same statement appears in the footer of every page and in the site’s Organization schema. No hotel logos or trademarks appear on this site.
Who is responsible for your data?
The data controller for nihisumbatrip.com is Indonesia Juara Trip, a travel operator within Juara Holding Group, Indonesia. Under Indonesia’s Personal Data Protection Law (Law No. 27 of 2022, “UU PDP”, in full effect since October 2024) we are the Pengendali Data Pribadi. For visitors from the EU, EEA, UK or Switzerland we act as controller under the GDPR and UK GDPR when we handle your enquiry.
Contact routes for privacy questions:
- WhatsApp: +62 811-9941-919 (https://wa.me/628119941919)
- Email: sales@indonesiajuara.asia
Start the message with “Privacy” so it reaches the person handling data matters, not the reservations queue.
What data do we collect and where does it come from?
Almost everything we hold comes from you, by the enquiry form or WhatsApp.
| Data | How we get it | Why we need it |
|---|---|---|
| Name, WhatsApp number, email | Enquiry form, WhatsApp | To reply and send a quote |
| Travel dates, guest count, ages of children | Form or chat | To check villa, driver and 4×4 availability, tight from June to August when Sumba’s luxury room supply is small |
| Nationality and passport details | Only when a hotel or airline requires them for a confirmed booking | Hotel registration, domestic flight tickets |
| Dietary, mobility or medical notes | Only if you volunteer them | To brief the driver-guide and lodge; sensitive data under UU PDP and GDPR, held only with your consent |
| Payment confirmation (transfer reference, invoice number) | Your bank or payment provider | To reconcile a deposit or balance |
| Site usage (pages viewed, device, approximate country) | Analytics cookies | To learn which pages are useful |
We never ask for full card numbers by WhatsApp or email; if a chat claiming to be us does, stop and call the number above.
Why do we process it, and on what legal basis?
| Purpose | Legal basis (UU PDP / GDPR) |
|---|---|
| Answering an enquiry and issuing a quote | Steps taken at your request before a contract (GDPR Art. 6(1)(b)) |
| Arranging a confirmed trip: lodge, transfers, driver-guide | Performance of a contract |
| Keeping invoices and booking records | Legal obligation under Indonesian tax and accounting rules |
| Analytics cookies | Consent |
| One follow-up about a quote you asked for | Legitimate interest; you can stop it with one message |
As of September 2026 this site sends no newsletter, profiles nobody and makes no automated decisions.
Who do we share your data with?
Only the parties needed to deliver what you asked for. Nobody buys your data from us.
| Recipient | What they receive | When |
|---|---|---|
| The accommodation you choose (NIHI Sumba, Lelewatu, Cap Karoso or a boutique villa) | Guest names, dates, special requests, passport data if the hotel requires it | Only when you ask us to check availability or confirm a stay |
| Sumba driver-guides and transfer operators | Names, arrival flight, pick-up point (Tambolaka/TMC or Waingapu/WGP), phone number | After booking confirmation |
| Domestic airline or ticketing agent | Passenger names and passport data as the carrier requires | If you ask us to arrange the Bali to Tambolaka flight |
| Payment provider or bank | Amount, invoice reference | When you pay |
| Hosting, email and cloud tools | Whatever is in the message or booking file | Under their own data-processing terms |
Hotels are accommodation options, not partners. Once a hotel or airline holds your details, its own privacy policy also applies.
Is your data transferred outside your country?
Yes, if you live outside Indonesia: the reservations team works from Indonesia and the lodges are in Sumba. Indonesia has no EU adequacy decision, so for EU and UK visitors we rely on the transfer being necessary to perform the contract you requested (GDPR Article 49(1)(b)), and we send only what the booking needs.
How long do we keep it?
| Record | Retention | Reason |
|---|---|---|
| Enquiry that did not become a booking | 24 months from last contact, then deleted | So we can pick up the plan if you return next season |
| Confirmed booking file | 10 years after the trip | Indonesian tax bookkeeping rules require ten years |
| WhatsApp chat history | Same period as the enquiry or booking it belongs to | Reservations work runs on WhatsApp |
| Sensitive notes (medical, dietary) | Deleted within 30 days after the trip ends | No longer needed once you are home |
| Analytics data | 14 months maximum | Standard analytics retention setting |
What cookies and analytics does the site use?
| Cookie type | Purpose | Can you refuse? |
|---|---|---|
| Essential | Form security, spam protection | No; the site would not work |
| Analytics | Page views, device type, approximate country, with IP addresses truncated | Yes, via the cookie notice or browser settings |
| WhatsApp click-through | Records which page prompted a tap on the WhatsApp button | Yes |
As of September 2026 there are no advertising or retargeting pixels on nihisumbatrip.com; if that changes, this page is updated first.
What are your rights?
Under UU PDP you may see your data, correct it, delete it, withdraw consent, object to or restrict processing, or receive a copy in a usable format. EU, EEA and UK visitors hold the equivalent rights under GDPR Articles 15 to 22, plus the right to complain to your home data-protection authority. Indonesian residents may complain to the supervisory body designated under UU PDP; ask us for the current route.
To use them, send a WhatsApp or email starting with “Privacy request” from the number or address you used with us. We acknowledge within 3×24 hours and complete the request within the limits UU PDP sets, or one month for GDPR visitors. A confirmed booking file can be deleted early only for the parts we are not legally required to keep.
If a data breach affects you, UU PDP requires us to notify you and the authority within 3×24 hours of discovering it; we will use the WhatsApp number or email you gave us.
How does this policy sit with booking terms and liability?
A few booking points worth stating plainly:
- Quotes are indicative until confirmed in writing by the Indonesia Juara Trip team. The land-only ladder (as of 2026) starts at USD 390 per person for 4D3N and excludes the resort; any total that includes a resort is issued only as a confirmed quote.
- NIHI Sumba’s public rates, per its March 2026 price document, are exclusive of a 21 percent government tax and service charge. The hotel’s own deposit and cancellation terms apply to the room and we cannot override them.
- Transport and guides are arranged via vetted licensed local partners. We are not the hotel, not the airline and not an insurer; each provider’s own terms govern its service.
- Travel insurance covering medical care and cancellation is strongly recommended. Sumba’s wet season, November to April and heaviest in January and February, can stretch transfers and force route changes; refunds in those cases follow each provider’s policy.
- Nothing on this site is financial, legal or tax advice.
How do you reach us, and how will this policy change?
Write to sales@indonesiajuara.asia or WhatsApp +62 811-9941-919. This policy was reviewed on 15 September 2026; the date at the top changes whenever the text does, and any change affecting an active booking is sent to you directly.