Who we are
Circus Castle Bali is an aerial arts training centre and co-living camp in Ubud, Bali, operated by PT Circus Castle Bali (NIB 2810250022223), Jalan Pura Gunung Sari Gang 1 No. 4, Banjar Ambengan, Peliatan, Kec. Ubud, Kab. Gianyar, Bali 80571, Indonesia. We provide aerial training, camps, classes, photoshoots, and booking support for guests who contact us online.
Information we collect
When you book with us
To confirm and manage a booking we collect the details you send us: your name, phone or WhatsApp number, email address, the dates and service you are booking, the age of a child if you book a class for one, and any health or accessibility information you choose to share so we can train you safely.
When you message us on Instagram
When you contact our business account @circus.castle.bali, we process the information needed to reply to your enquiry and manage a booking, including:
- Instagram Direct message content;
- the sender's Instagram-scoped user ID and username or display name;
- message timestamps;
- media attachments sent in the conversation.
The same applies when you message us on WhatsApp. To help us prepare routine replies, message content may be processed by an AI service provider (Anthropic) on servers outside Indonesia. A person handles any confirmation of dates, price or payment. We do not use this processing for advertising or profiling.
When you pay
Payments are processed by our payment provider and by our bank. We receive confirmation of the payment, the amount, the currency and a reference identifying your booking. We do not collect or store full card numbers, card expiry dates or security codes.
When you visit this website
Our websites (circuscastlebali.space and book.circuscastlebali.space) use these tools to see which pages and adverts lead to bookings:
- Meta Pixel (Meta Platforms) sets cookies (
_fbp, and_fbcif you arrive from a Meta advert) and reports page views and booking steps to Meta. - Google Analytics 4 (Google) sets cookies (
_ga) and reports page views and booking steps to Google. - Meta Conversions API. When you book or pay, our server tells Meta that the booking or payment happened. Your email address and phone number are sent only in hashed (one-way encrypted) form, together with your IP address, browser type and the Meta cookie values above, so Meta can match the booking to an advert.
We use this information to measure and improve our advertising. We do not sell it. You can limit it by blocking cookies in your browser, by changing your ad preferences in your Meta account (Accounts Center → Ad preferences), or with Google's Analytics opt-out browser add-on.
If you talk to the voice assistant on our website, your voice and the conversation are processed by ElevenLabs to answer you.
Our server keeps standard technical logs, such as the pages requested and the time of the request, for security and reliability. When you book, we also store your IP address, browser type and the page you arrived from, to prevent fraud and to understand where bookings come from.
How we use information
We use this information solely to:
- reply to your enquiry and provide customer support;
- confirm, manage and deliver your booking;
- issue payment links, verify payments and process refunds;
- run training sessions safely, taking account of anything you told us about your health;
- keep legitimate business and accounting records;
- measure which of our pages and adverts lead to bookings, as described under “When you visit this website”.
We do not sell personal data. We do not use Instagram message data for advertising or profiling.
Legal basis and consent
We process your information because you chose to contact us, and because the processing is necessary to respond to your enquiry, provide the service you booked, and keep the records we are required to keep.
We process personal data in line with Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP). For guests from the European Union or the United Kingdom, our legal bases are performance of a contract (your booking), our legitimate interests (security, business records and measuring our advertising) and legal obligations (tax and accounting records).
Sharing
We share personal data only with service providers that help us run the business, and only what each of them needs:
- Vercel and Upstash: website hosting and booking records;
- Xendit and our bank in Indonesia: payments and refunds;
- Resend: booking confirmation emails;
- Meta Platforms: Instagram and WhatsApp messaging, and the advert measurement described above;
- ManyChat: automated replies on Instagram;
- Google: Google Analytics and our internal booking spreadsheet;
- Telegram: internal notifications to our team about bookings and payments;
- Anthropic: an AI service that helps us prepare replies;
- ElevenLabs: the website voice assistant and speech-to-text for voice messages.
Most of these providers store data on servers outside Indonesia, mainly in the United States and the European Union. We use them because they offer contractual and technical safeguards for personal data. We do not sell personal data. Apart from the advert measurement described above, we do not share it for marketing.
Storage and security
Conversation and booking data is stored securely and access is limited to authorised staff who need it to respond to customers and manage bookings.
If a data breach affects your personal data, we will tell you and the relevant authority in writing within 3 × 24 hours of becoming aware of it, as UU PDP requires, and explain what happened and what we are doing about it.
Data retention
We keep conversation and booking data only as long as needed to provide support, manage bookings and maintain legitimate business and accounting records. For Adult Club Membership, membership records are kept for the membership period plus two years unless a longer period is required by law. Financial records are kept for at least five years for audit and tax purposes. We delete conversation data on request unless we are required to keep limited records for legal or operational reasons.
Your rights
You may request access to, correction of, or deletion of your data. Contact us on Instagram at @circus.castle.bali, by WhatsApp at +62 813-2580-5152, or by email at ptcircuscastlebali@gmail.com.
Data deletion
To request deletion of your data, message @circus.castle.bali on Instagram, write to ptcircuscastlebali@gmail.com, or contact us on WhatsApp at +62 813-2580-5152. Please tell us which Instagram account, email address or booking your request relates to. After we verify the request, we will delete the relevant data from our systems unless retention is legally required.
Children
Bookings for children must be made by a parent or guardian, who provides the child's details and accepts this policy on their behalf. We collect only what we need to run the class safely.
Changes to this policy
We may update this Privacy Policy when our services or legal obligations change. The effective date at the top of this page shows when the current version took effect.
Contact
PT Circus Castle Bali
Jalan Pura Gunung Sari Gang 1 No. 4, Banjar Ambengan, Peliatan, Kec. Ubud, Kab. Gianyar, Bali 80571, Indonesia
Email: ptcircuscastlebali@gmail.com
WhatsApp: +62 813-2580-5152