The Malca Voyages privacy policy covers malcavoyages.com, published by Juara Holding Group. The site collects limited analytics and security data, takes no payments and stores no card details. When you send a WhatsApp message or email about Malca Voyages, it goes straight to Komodo Luxury’s reservations team, which handles your booking.
Effective 16 September 2026. Version 1.0. Applies to malcavoyages.com and its subpages.
Who is responsible for your data on malcavoyages.com?
malcavoyages.com covers one vessel: Malca Voyages, a 30 m VIP phinisi departing Labuan Bajo. Two companies from the same group handle different parts of your data.
| Role | Company | What it handles |
|---|---|---|
| Site publisher | Juara Holding Group | Site content, hosting, analytics, security logs |
| Vessel owner and reservations | Komodo Luxury, a Labuan Bajo operator and part of Juara Holding Group | Inquiries, quotes, invoices, guest lists, trip records |
Indonesia’s Personal Data Protection Law (Law No. 27 of 2022, known as UU PDP) has been fully in force since October 2024. Under that law, Juara Holding Group is the controller for website data and Komodo Luxury is the controller for reservation data. For visitors from the EU or UK, we also follow the transparency and rights standards of the GDPR where it applies.
What does this site collect when you browse?
Not much. There are no accounts, logins or forms that save your details here. As of this version:
| Category | Tool | Purpose | Browser storage |
|---|---|---|---|
| Strictly necessary | Cloudflare delivery and bot protection | Loads pages quickly and filters malicious traffic | Short-lived security cookies such as __cf_bm |
| Analytics | Google Analytics 4 | Counts page views, device type, approximate location, referring site and clicks on WhatsApp or email buttons | _ga cookies, which expire within 2 years |
| Advertising and remarketing | None | Not used | None |
According to Google, Google Analytics 4 does not log or store IP addresses. Our web host keeps standard access logs (IP address, browser, time, page) to spot attacks. If these tools change, this table is updated first.
You can block cookies in your browser or install Google’s Analytics opt-out add-on. The rates, itineraries and contact routes still work.
What happens when you contact Komodo Luxury through this site?
Every booking button on malcavoyages.com opens one of three routes, and Komodo Luxury handles all of them:
- WhatsApp +62 811 3823 875, a Meta service under its own terms
- Email sales@komodoluxury.com, straight to the reservations inbox
- The Malca Voyages page on komodoluxury.com, covered by its own privacy terms
This site does not intercept or store what you write; analytics records only the click. To quote, the desk usually asks for your travel dates, a cabin or charter type (a shared 3D2N cabin or a private whole-boat charter), guest numbers, guest names and children’s ages. Children aged 3 and over pay the full rate. The desk may also ask for your Labuan Bajo hotel or flight time, because Malca pick-ups run from 08:00 to 09:00.
UU PDP treats health information as specific personal data. Share allergies or medical conditions only if you want the crew to plan for them; they are used only for safety and catering.
Does malcavoyages.com take payments or store card data?
No. This site has no checkout, no payment form and no stored card data. You pay Komodo Luxury directly, following instructions from its reservations team. Its terms, as published in September 2026 and subject to change, are:
- A 50% deposit secures the booking. The balance is due no later than 30 days before departure.
- Bookings made less than 30 days before departure are paid in full.
- Bookings made a year ahead pay a 30% deposit, another 20% at 120 days out, and the balance at 30 days.
- Deposits are non-refundable. You can nominate a replacement guest instead of cancelling.
- The sender pays bank charges. Guests are liable for any equipment they lose or damage.
If anyone asks for payment through another channel, confirm with the desk on WhatsApp +62 811 3823 875 or at sales@komodoluxury.com before sending money.
Who else receives your information?
We do not sell personal data. Only the parties needed to run the website or your trip see it:
- Komodo Luxury’s reservations team and crew see names, pick-up points and any dietary or safety notes.
- Government bodies, such as park or harbour authorities, receive guest details where Indonesian regulation requires registration.
- Service providers process data on our behalf: Meta for WhatsApp, the email host, Google for analytics, Cloudflare and our web host.
- Banks process your transfers.
Some providers process data outside Indonesia. UU PDP allows such transfers where protection is equal or stronger, adequate safeguards exist, or you consent.
How long is your data kept?
| Data | Held by | Retention period |
|---|---|---|
| Analytics event data | Google, for Juara Holding Group | Up to 14 months, then only aggregate reports remain |
| Server security logs | Web host | Up to 30 days, longer only while an attack is being investigated |
| Inquiries that do not become bookings | Komodo Luxury | Up to 24 months, then deleted |
| Confirmed booking and payment records | Komodo Luxury | 10 years, as Indonesian tax-administration law requires for bookkeeping records |
| Trip photos and video | Komodo Luxury | Kept for promotional use, as the booking terms allow |
Komodo Luxury films trips, shares raw footage with guests and may use it promotionally under its booking terms. If you prefer not to appear, raise it with the desk before departure; on a shared boat, no one can promise you stay out of every frame.
What rights do you have over your personal data?
UU PDP gives you the right to:
- be told how your data is used and why
- see your data and get a copy of it
- correct data that is wrong or out of date
- have your data deleted or destroyed
- withdraw consent you have given
- object to decisions made purely by automated means, including profiling
- pause or limit processing
- receive your data in a usable format to take elsewhere
- claim compensation if your data is misused
EU and UK visitors may also complain to their local data-protection authority. Limits apply: tax rules require booking records to be kept, deleting details before departure can make the trip impossible, and published footage may not be fully recoverable.
How do you make a privacy request?
- Email sales@komodoluxury.com with the subject line “Privacy request – malcavoyages.com”. You can also send a WhatsApp message to +62 811 3823 875.
- Say which right you want to use, and give the name, phone number or email address you used when you contacted the desk.
- We may confirm your identity by replying through that same channel.
For access and correction requests, UU PDP sets a response window of 3 × 24 hours, and we aim to meet it. Requests about website analytics are forwarded to Juara Holding Group.
How is your information protected?
The site runs over HTTPS behind Cloudflare, and only staff who need reservation data can access it. No system is completely secure. If a breach affects you, UU PDP requires written notice to you and the authority within 3 × 24 hours, stating what was exposed, when, and what is being done.
This site is not aimed at people under 18. A parent or guardian should send any children’s details for a booking.
When does this policy change?
We review this policy when our tools or booking processes change, and at least yearly; the date at the top shows the latest version. This page is not legal advice. Vessel details and rates on this site are indicative as of September 2026; binding terms sit on Komodo Luxury’s official Malca Voyages page.