Privacy policy

1. Controller

The controller responsible for data processing on this website is:

PT AVANTI INDO DEV (trading as Lombok Horizon)
Jalan Pemutih No. 01
Banjar Dinas Labuan Sait, Desa Pecatu
Kec. Kuta Selatan, Kab. Badung, Bali 80361, Indonesia
Email: hi@lombokhorizon.com

We have not appointed a data protection officer. We are not established in the EU and have not appointed an Art. 27 GDPR representative in the Union.

2. Your rights at a glance

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing. Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. You also have the right to lodge a complaint with a supervisory authority. To exercise any of these rights, contact us at the address above.

3. Hosting and server log files

This website is hosted by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) on Cloudflare Workers, and is served from Cloudflare's global edge network, including data centres in the EU. When you visit the site, the host automatically collects and stores information in server log files that your browser transmits: IP address, browser type and version, operating system, referrer URL, and the time of the request. This data is not merged with other data sources. The legal basis is our legitimate interest in the secure and stable operation of the website (Art. 6(1)(f) GDPR). We do not store these log files ourselves; Cloudflare retains them only for the limited periods required for security and operational purposes.

4. Fonts

We host all fonts on our own server. No connection to Google Fonts or other third-party font services is made, and no data about you is transmitted to such providers when the site loads its fonts.

5. Buyer profile and contact form

When you submit the buyer-profile form, we process the data you enter (for example name, email, phone/WhatsApp, country of residence, budget, timeline and your message) in order to respond to your enquiry and to prepare a possible contract. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract) and, for any purely voluntary fields, Art. 6(1)(a) GDPR (consent). We keep enquiry data for as long as needed to handle your request and thereafter in line with statutory retention periods, then delete it.

Recipients of this data. Your form submission is stored by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) in Cloudflare Workers KV, on Cloudflare's edge network. We are notified of your enquiry by email through Plus Five Five, Inc., trading as Resend (2261 Market Street #5039, San Francisco, CA 94114, USA), which processes your name, email address and the content of your enquiry for the sole purpose of delivering that notification to us. Both act as processors on our instructions under Art. 28 GDPR and do not use your data for their own purposes. We pass your data to no one else. In particular we do not sell it, and we do not share it with developers or sellers unless you ask us to introduce you.

6. Project updates by email

We reply to enquiries by email. Beyond that, you can join our free project-updates list: through the form on the properties page, through the readiness check, or by ticking the optional box on the contact form. Submitting an enquiry alone never puts you on the list.

The list works by double opt-in. We first send you an email with a confirmation link, and you are only subscribed once you click it. If you do not confirm within 7 days, your request is deleted automatically. The legal basis is your consent, Art. 6(1)(a) GDPR; the click on the confirmation link is how that consent is recorded.

What we store for the list: your email address, an optional name, your preferred language, which form you signed up through, the time of your request and of your confirmation, and, if you use the readiness check and ask to receive your result, that result. We use this data to send you updates about new projects and to nothing else. We build no profile from it and pass it to no one for advertising.

The list is stored in Cloudflare Workers KV, and confirmation and update emails are delivered through Cloudflare, Inc. or through Resend, both already named in section 5. Both act as processors on our instructions under Art. 28 GDPR.

Every email we send to the list contains an unsubscribe link. One click removes you, with no login and no confirmation step; this withdraws your consent with effect for the future (Art. 7(3) GDPR). After you unsubscribe we keep only a suppression record of your address, so that we do not email you again, and delete the rest of your list data.

7. Contact by WhatsApp

If you choose to contact us via WhatsApp, your communication is processed through WhatsApp (Meta Platforms Ireland Ltd.), which may transfer data to servers outside the EU, including the USA. We have no influence over WhatsApp's own processing. If you prefer to avoid this, contact us by email or through the form. The legal basis for handling a WhatsApp message you send us is Art. 6(1)(b)/(f) GDPR.

8. Cookies and analytics

We measure this site in two layers, and they are deliberately different.

Cloudflare Web Analytics, always active. This records page views, the referring page, the country a visit comes from and how quickly pages load. It sets no cookies, stores no identifier on your device and builds no profile of you. It cannot follow you to other websites. Legal basis: our legitimate interest in knowing whether the site works and where visitors come from, Art. 6(1)(f) GDPR.

Google Analytics 4, only if you agree. If you accept in the banner, we load Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It sets cookies and processes a randomly generated identifier so that we can see which pages lead to an enquiry. IP anonymisation is active, advertising features and ad personalisation are switched off, and we do not use the data for advertising. Data is retained for 14 months. Until you accept, nothing is loaded and no request reaches Google at all. Legal basis: your consent, Art. 6(1)(a) GDPR and section 25(1) TTDSG.

If you decline, or simply ignore the banner, Google Analytics is never loaded. You can change your mind at any time, with effect for the future, through the Cookie settings link at the bottom of every page. Your choice is stored locally in your browser, not in a cookie, and we can withdraw it as easily as you gave it.

9. Data transfer to a third country

Because our team operates from Indonesia, some data you send us (for example enquiry details) is accessed and processed there. Indonesia is a country outside the EU/EEA for which no EU adequacy decision exists. We take appropriate measures to protect your data and process it only as described in this policy. The legal basis for such transfers, where they relate to a contract or steps taken at your request, is Art. 49(1)(b) GDPR.

The providers named in sections 3, 5, 6, 7 and 8 are established in the United States, or transfer data there, which is likewise outside the EU/EEA. Transfers to them take place on the basis of the EU standard contractual clauses contained in their data processing agreements with us, and where applicable on their certification under the EU-US Data Privacy Framework.

10. SSL/TLS encryption

This site uses TLS encryption for security and to protect the transmission of the content you send us. You can recognise an encrypted connection by the "https://" in your browser's address bar.