Legal
Cookie Notice
How and why we use cookies and similar technologies on this Website.
Last updated: April 2026
1. What are cookies and similar technologies?
A cookie is a small text file that a website places on your browser or device when you visit it. Cookies let the site recognise your browser on subsequent visits, remember your preferences, keep you signed in, and understand how the site is being used.
We use the term "cookies" in this Notice to include cookies and similar technologies such as:
- Local storage and session storage — data stored in your browser by JavaScript, used for similar purposes to cookies.
- Pixels and web beacons — small transparent images embedded in pages or emails that allow us to understand whether you have visited a page or opened an email.
- Software development kits (SDKs) — code libraries embedded in applications to collect analytics and performance data.
- Device fingerprinting — techniques that combine device and browser attributes to recognise a user across sessions. We do not knowingly use fingerprinting for tracking purposes.
Cookies may be:
- First-party — set by sarayalombok.com directly; or
- Third-party — set by another domain (for example, an analytics or payment provider) whose code runs on our pages.
They may also be:
- Session cookies — deleted when you close your browser; or
- Persistent cookies — remain on your device for a set period or until you delete them.
2. Categories of cookies we use
We group cookies into four categories.
2.1 Strictly necessary cookies
These cookies are essential for the Website to function. They enable core features such as secure navigation, session management, payment processing, and fraud prevention. Because they are essential, they cannot be switched off in our preference centre, and your consent is not required for them under the EU ePrivacy Directive, the UK PECR, the PDP Law, or the APPs.
2.2 Functional cookies
These cookies allow the Website to remember choices you make (such as language or region) and provide enhanced, personalised features. Disabling them may affect the functionality of some parts of the Website.
2.3 Analytics cookies
These cookies help us understand how visitors interact with the Website, which pages are most visited, and where visitors come from. The data is used in aggregated form to improve the Website's performance and user experience.
Analytics cookies are set only with your consent where required by applicable law.
2.4 Marketing and advertising cookies
These cookies are used to deliver advertising that is more relevant to you and to measure the effectiveness of our advertising campaigns. They may be set by us or by third-party advertising partners.
Marketing cookies are set only with your consent.
3. Specific cookies used on this Website
The tables below list the cookies and similar technologies that may be set when you visit the Website. The exact cookies you receive depend on your interactions (for example, whether you make a payment or enable analytics).
3.1 Strictly necessary cookies
| Name | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
| __cf_bm | Cloudflare | Bot management and Website security | Third-party / session | 30 minutes |
| cf_clearance | Cloudflare | Security challenge verification | Third-party / persistent | 30 days |
| __stripe_mid | stripe.com | Fraud prevention for payment processing (set only when a payment page is loaded) | Third-party / persistent | 1 year |
| __stripe_sid | stripe.com | Fraud prevention for payment session (set only when a payment page is loaded) | Third-party / session | 30 minutes |
| cookieConsent | sarayalombok.com | Records your cookie preferences | First-party / localStorage | Until cleared |
3.2 Functional cookies
None currently set by the Website.
3.3 Analytics cookies
| Name | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
| _ga | Google Analytics 4 | Distinguishes unique users | Third-party / persistent | 2 years |
| _ga_VXJCEY2M22 | Google Analytics 4 | Session state for our GA4 property | Third-party / persistent | 2 years |
| GoHighLevel tracking script | HighLevel Inc. (via link.kinnara.capital) | Aggregated campaign attribution for enquiries submitted through the Website | Third-party / persistent | Up to 2 years |
| First-party analytics script | Kinnara Capital | Measures aggregated page views and interactions on the Website | First-party / persistent | Up to 2 years |
3.4 Marketing and advertising cookies
| Name | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
| _fbp | Meta Platforms | Meta Pixel — conversion tracking and retargeting | Third-party / persistent | 90 days |
| fr | Meta Platforms | Delivery of Meta advertising | Third-party / persistent | 90 days |
4. How we obtain your consent
When you first visit the Website from a region where consent is required, a cookie banner is presented. The banner allows you to:
- Accept all — consent to all categories of cookies;
- Reject all non-essential — only strictly necessary cookies are set; or
- Manage preferences — choose which categories of non-essential cookies to enable.
Your preferences are stored as `cookieConsent` in your browser's local storage and applied to subsequent visits.
Consent is:
- Freely given — you can reject non-essential cookies without losing access to the Website;
- Specific — consent is obtained separately for each non-essential category;
- Informed — this Notice describes the cookies in use before consent is requested; and
- Unambiguous — consent requires a clear affirmative action (ticking a box or clicking "Accept"). Continued browsing is not treated as consent.
Consent is refreshed every 12 months, or sooner if we introduce new categories of cookies, in accordance with guidance from the European Data Protection Board, the UK ICO, and the Indonesian data protection authority.
5. How to change or withdraw your consent
You can change or withdraw your consent at any time:
- Preference centre — click the "Cookie Preferences" link in the footer of the Website to reopen the preference centre.
- Clear local storage — clear site data for sarayalombok.com in your browser settings (which removes the `cookieConsent` entry) and the banner will re-appear on your next visit.
- Browser settings — most browsers let you view, manage, and delete cookies, and block cookies from specific domains.
Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
6. Third-party cookies and your privacy
Some cookies are set by third parties when you visit the Website. We do not control those cookies, and their use is governed by the third party's own privacy policy. Key third parties and their policies:
| Provider | Purpose | Privacy policy |
|---|---|---|
| Stripe, Inc. | Payment processing, fraud prevention | stripe.com/privacy |
| Cloudflare, Inc. | Security and bot mitigation (CDN in front of the Website) | cloudflare.com/privacypolicy |
| Google LLC | Google Analytics 4 | policies.google.com/privacy |
| Meta Platforms, Inc. | Meta Pixel — conversion tracking and retargeting | facebook.com/privacy/policy |
| HighLevel Inc. (GoHighLevel) | Lead attribution and CRM integration for enquiries | gohighlevel.com/privacy-policy |
If a third party is not listed above but you notice a cookie being set, please contact us at [email protected] and we will investigate.
7. International transfers
Cookies set by third-party providers may involve transferring your information to jurisdictions outside your country of residence, including the United States, the European Union, and the United Kingdom. Our approach to international transfers — including the safeguards we rely on (EU SCCs, UK IDTA, PDP Law mechanisms, and APP 8 reasonable steps) — is set out in clause 9 of our Privacy Policy.
8. Do Not Track and Global Privacy Control
Some browsers send a "Do Not Track" (DNT) or "Global Privacy Control" (GPC) signal indicating that you do not want to be tracked across websites.
- We honour GPC signals as a valid opt-out of sale or sharing of personal information for California residents under the CCPA/CPRA.
- We do not currently act on DNT signals, as there is no industry consensus on how to interpret them. You can achieve the same outcome using our cookie preference centre.
9. Cookies and children
The Website is not directed at children under 18, and we do not knowingly set non-essential cookies for children. If you believe a child has used the Website and provided consent to non-essential cookies, please contact us at [email protected] and we will delete the associated data.
10. Changes to this Notice
We may update this Cookie Notice to reflect changes in the cookies we use or in applicable law. Material changes will trigger a refreshed consent request through the cookie banner on your next visit. The "Last updated" date above reflects the most recent amendment.
11. Further information and contact
Privacy enquiries: [email protected] Data Protection Officer: [email protected]
PT Saraya Resort Lombok (PT PMA) Registered office: Jalan Sunset Road Nomor 88, Kuta, Kab. Badung, Bali 80361, Indonesia NIB: 1411250065654 — NPWP: 1000000006760818
Kinnara Capital Limited (Hong Kong) Registered office: Unit 2, LG1, Mirror Tower, 61 Mody Road, Tsim Sha Tsui, Hong Kong
You also have the right to lodge a complaint with a supervisory authority, including:
- the Indonesian data protection authority under the PDP Law;
- the Office of the Australian Information Commissioner (OAIC) — oaic.gov.au;
- the UK Information Commissioner's Office (ICO) — ico.org.uk;
- the data protection authority in your EU Member State of residence; or
- the California Privacy Protection Agency for CCPA/CPRA matters.
Related Documents
Review our terms of service, privacy policy, and other legal information.