1. Who We Are
Bali Zero ("we", "us", "our") provides immigration, business registration, tax, and property services for foreign nationals and companies in Indonesia. Our AI assistant Zantara processes your inquiries across WhatsApp, Telegram, Web, Instagram, and other channels.
Under the Indonesian Personal Data Protection Law (UU PDP No. 27/2022), we act as the Personal Data Controller for the data we collect and process.
2. Data We Collect
General Personal Data (Art. 4(2))
- Full name, email address, phone number
- Nationality, date of birth, gender
- Address (residential and business)
- Passport number and expiry date
- Communication history (messages across all channels)
- Usage data (pages visited, device and browser type, traffic source) collected through Google Analytics with anonymized IP, only after you accept analytics cookies
Specific Personal Data (Art. 4(1))
- Passport photograph (biometric data when processed via OCR)
- KTP (Indonesian ID card) scans
- NPWP (tax identification number) documents
- Financial information (salary, investment amounts for visa applications)
3. Legal Basis for Processing
- Contract performance (Art. 20(b)): Processing necessary to fulfill our immigration and business services
- Explicit consent (Art. 21): For specific personal data (passport scans, KTP, biometric processing)
- Legal obligation (Art. 20(c)): Tax record retention as required by Indonesian tax law
- Legitimate interest (Art. 20(f)): Pre-contractual inquiries via WhatsApp/chat
4. How We Use Your Data
- Processing visa applications and company registrations
- Document verification via OCR (optical character recognition)
- AI-powered assistance for your inquiries
- Tax filing and compliance monitoring
- Communication about your active services
- Improving our service quality
5. Data Storage and Cross-Border Transfer
Your data is stored on servers in Singapore (Fly.io, Qdrant Cloud) and processed by:
- Fly.io (Singapore) — Application hosting and PostgreSQL database
- Qdrant Cloud (US) — Vector search database
- Google (global) — Google Drive for document storage, Gemini for AI processing
- Upstash (global) — Redis cache (temporary, 5-minute TTL)
- Vercel (global) — Hosting and delivery of the balizero.com website
- Local processing (Bali) — Ollama AI for document OCR (no cross-border transfer)
Cross-border transfers are protected by standard contractual clauses and data processing agreements with each provider, in compliance with Art. 56 of UU PDP.
6. Data Retention
- Active service data: Duration of our engagement + 5 years
- Tax records: 7 years (Indonesian tax law requirement)
- Communication history: 2 years after last interaction
- Document scans: 5 years after visa/permit expiry
- Cache data: 5 minutes (automatically deleted)
- Usage analytics: 26 months
7. Your Rights (UU PDP Art. 5-12)
You have the right to:
- Access: Request a copy of your personal data
- Rectification: Correct inaccurate data
- Erasure: Request deletion of your data (within 72 hours)
- Portability: Receive your data in a structured format
- Withdraw consent: Revoke previously given consent at any time
- Object: Object to automated decision-making
- Complaint: Lodge a complaint with the Indonesian personal data protection authority
To exercise your rights, contact our Data Protection Officer at privacy@balizero.com
8. Data Security
- Encryption at rest (database-level and column-level for sensitive fields)
- PII detection and redaction in AI-generated responses
- Immutable audit logging of all data access
- Role-based access control (RBAC)
- Regular security assessments
9. Breach Notification
In the event of a data breach affecting your personal data, we will notify you and the relevant Indonesian authorities (MOCD/Lembaga PDP) within 72 hours (3 x 24 hours) of discovery, as required by Art. 46 of UU PDP.
10. Cookies
We use essential cookies for authentication and preferences. Analytics cookies (Google Analytics) are opt-in. See our Cookie Policy for the full list.
11. Contact
Data Protection Officer: privacy@balizero.com
General inquiries: hello@balizero.com
Bali Zero · Bali, Indonesia · PSE Registration: TD-PSE 029817.01/DJAI.PSE/09/2026 (Komdigi, registered 14 September 2026)