Privacy Policy
How The Spot Lombok collects, uses and protects your personal data — bookings, accounts, payments, and the passports held for scooter rentals.
_Last updated: 14 July 2026_
1. Who we are
PT SAME SAME Bungalows ("The Spot", "we", "us"), a company registered in Indonesia, at Jl. Sawe-Batu Riti, Kuta, Kec. Pujut, Kabupaten Lombok Tengah, Nusa Tenggara Barat 83573.
We are the data controller for the personal data described here.
Privacy contact: [email protected]
2. What this covers
This policy applies to thespotlombok.com and to the personal data we handle when you eat with us, book a desk, stay in a bungalow, rent a scooter, or contact us.
3. What we collect, and why
3.1 When you book coworking or create an account
| Data | Why |
|---|---|
| Name | To identify your booking |
| Email address | To create your account, send your one-time login code, confirm bookings, and send invoices |
| WhatsApp / phone number | To reach you about a booking |
| Booking history | To operate the space, and to work out whether you are a first-time visitor (which changes the hours you may arrive) |
| Credit balance and its history | To honour credit from cancellations |
Legal basis: performance of a contract with you.
We use a one-time code sent to your email to sign you in. We do not store a password.
3.2 When you pay
Card payments are processed by Stripe. We never see or store your full card number. Stripe holds it; we hold only the outcome (paid / failed), the amount, and a reference.
Cash and card-at-reception payments are recorded in our operations system as a transaction against your booking.
Legal basis: performance of a contract, and our legal obligation to keep accounting records.
3.3 When you order food through the website
Our online menu builds an order and hands it to WhatsApp for you to send. The order does not pass through our servers. Once you send it, the message — and whatever you put in it — is handled by WhatsApp under WhatsApp's own privacy policy, which we do not control.
3.4 When you book a room
Room bookings are handled by Little Hotelier, our booking engine. The data you enter there is processed under their privacy policy as well as ours.
3.5 When you send us an enquiry
Name, email, phone, and whatever you tell us. Held so we can answer you and follow up.
Legal basis: your consent, or our legitimate interest in responding to you.
3.6 When you visit the website
We use Google Analytics to understand how the site is used — pages viewed, roughly where visitors come from, which device.
We do not run advertising. We do not track you across other websites. We do not sell your data to anyone, ever.
Analytics cookies are set only if you accept them. Decline, and they are not set.
Legal basis: your consent.
4. Passports held for scooter rental
If you rent a scooter and are not staying at SAME SAME Bungalows, we hold your passport for the duration of the rental. This is standard practice in Indonesia in the absence of a deposit.
- It is kept in a locked place, accessible only to authorised staff.
- It is returned to you when the scooter is returned.
- We do not photocopy, scan, upload or share it, and we do not keep a record of its contents after it is returned.
- You may decline. If you would rather not leave a passport, tell us and we will discuss an alternative — but we may not be able to rent to you.
Guests staying at SAME SAME Bungalows do not leave a passport.
We take this seriously. It is your identity document and it is not ours to copy.
5. Who we share data with
We share only what is necessary, only with these parties, and never for their own marketing:
| Who | What | Why |
|---|---|---|
| Stripe | Payment data | To take card payments |
| Little Hotelier | Room booking data | To manage room availability and bookings |
| Google Analytics | Website usage (if you consent) | To understand how the site is used |
| WhatsApp (Meta) | Whatever you send us in a message | Because you chose to message us |
| Our own operations system (ops.thespot.id / api.thespot.id) | Bookings, accounts, invoices | To run the business |
| Indonesian authorities | Only what the law requires | Legal obligation |
We do not sell your data. We do not share it for advertising. There is no third category.
6. Where your data lives
Our systems run on servers in Indonesia (Jakarta). Some of our providers (Stripe, Google, Meta) process data outside Indonesia, including in the EU and the United States, under their own safeguards.
7. How long we keep it
| Data | Kept for |
|---|---|
| Booking and account records | While your account is active, then 7 years (Indonesian accounting requirements) |
| Payment records | 7 years |
| Enquiries | 2 years from your last contact |
| Analytics | 14 months |
| Passports (scooter rental) | Only for the duration of the rental. Returned immediately after. |
8. How we protect it
Encrypted connections (HTTPS). Passwordless sign-in via a one-time email code. Staff access limited to those who need it. Card data never touches our servers.
No system is perfectly secure. If a breach ever occurs that puts you at risk, we will tell you and the relevant authority, promptly and honestly.
9. Your rights
You may ask us to:
- See the data we hold about you
- Correct anything that is wrong
- Delete it, where we are not required to keep it
- Export it, in a portable format
- Stop using it for a particular purpose
- Withdraw consent at any time — for analytics, simply decline the cookie banner
Email [email protected]. We will respond within 30 days.
If you are unhappy with our answer you may complain to the relevant supervisory authority — in Indonesia, the authority designated under Law No. 27 of 2022 on Personal Data Protection; in the EU, your national data protection authority.
10. Children
Our website and services are not directed at children under 18, and we do not knowingly collect their data. Children are welcome in the café, accompanied by an adult — we do not collect data about them.
11. Changes
We may update this policy. The version published here at the time you use our services is the one that applies. The date at the top tells you when it last changed.
12. Contact
PT SAME SAME Bungalows Jl. Sawe-Batu Riti, Kuta, Kec. Pujut, Kabupaten Lombok Tengah, Nusa Tenggara Barat 83573, Indonesia [email protected] · WhatsApp +62 878-6401-3961
For the related General Terms & Conditions, see our Terms.