Privacy Policy

Effective date: 23 September 2026  |  Last updated: 23 September 2026

This Privacy Policy explains how PT Kotta Hospitality Management (“Kotta Hotels”, “we”, “us”) collects, uses, shares and protects your personal data across all of our digital properties, including:

• the Kotta Hotels mobile application for Android and iOS (the “App”);
• our website kottahotels.com and our direct-booking website book.kottahotels.com;
• our booking engine, checkout and payment flow (shared by the App and both websites);
• our membership and loyalty programme; and
• our newsletter and any other Kotta Hotels website, application or service that links to this Policy,

together the “Services”. This Policy applies whether or not you create an account, book a stay, or install the App — simply browsing our websites or subscribing to our newsletter is enough to bring you under it.

By creating an account, making a booking, or subscribing to our newsletter through the Services, you acknowledge that you have read and understood this Policy. If you do not agree with it, please do not use the Services.

1. Who is responsible for your data

The data controller is:

• PT Kotta Hospitality Management
• Registered address: Jl. Tentara Pelajar No. 40A, Kota Semarang, Provinsi Jawa Tengah 50249, Indonesia
• Privacy contact: privacy@kottahotels.com

We process personal data in accordance with Indonesia’s Law No. 27 of 2022 on Personal Data Protection (Undang-Undang Pelindungan Data Pribadi) and, where applicable to guests in those regions, the EU/UK General Data Protection Regulation.

2. Information we collect

2.1 Information you give us

• Account profile — your name, email address and profile photo, received from your Google Account (or, on iOS, your Apple ID) when you choose to sign in. See section 2.2.
• Guest and booking details — for each reservation: first and last name, email address, phone number, country, province/state, city, estimated arrival time, and any special requests you enter. If you book on behalf of another guest, you also provide that guest’s name and contact details; you confirm that you have their permission to share this information with us.
• Promotional / coupon codes you enter at checkout.
• Communications — the content of messages you send us for support, and records of our correspondence with you.
• Newsletter subscription — if you subscribe on kottahotels.com, your email address is collected and sent to our email marketing provider, Mailchimp, to send you news and offers. You can unsubscribe at any time using the link in every newsletter email, or by contacting us (section 13).

2.2 Information from sign-in providers

The App does not have its own password. You sign in with a third-party provider, which shares a limited set of profile data with us:

• Google Sign-In — your name, email address, profile picture URL, and a Google account identifier. We use the OAuth server auth code flow; we never receive your Google password.
• Sign in with Apple (iOS) — your name and email address (provided only the first time you authorise the App), and a stable Apple user identifier. If you choose “Hide My Email”, Apple gives us a private relay address instead of your real email; we use it only to send you booking-related messages.

Your sign-in with these providers is also governed by Google’s Privacy Policy and Apple’s Privacy Policy.

2.3 Booking, stay and loyalty data

• Your reservation history: properties booked, room types and rate plans, add-on services, stay dates, number of guests, and amounts.
• Your membership status: loyalty tier, points balance, points history and stay history.

2.4 Payment information

We do not collect or store your card, bank or e-wallet details. Payments are processed by Duitku (PT Adimulia Karya Teknologi), our payment gateway. When you proceed to payment, the App opens Duitku’s secure hosted payment page inside an in-app browser. You enter your payment details directly with Duitku. We receive only a booking reference and the resulting payment status (e.g. paid, pending, failed). Duitku’s handling of your data is governed by its own privacy policy.

2.5 Information collected automatically

• Technical data — when the App communicates with our servers, our servers receive your device’s IP address and standard request metadata (time, endpoint, response status). This is used for delivering the service and for security and abuse prevention.
• On-device storage — after you sign in, an authentication token and a copy of your basic profile are stored in your device’s encrypted secure storage (Android Keystore / iOS Keychain) so you stay signed in. If you make a booking for yourself, the contact details you entered (phone, country, province, city) are also stored on your device to pre-fill future bookings. This data stays on your device and is removed when you sign out.
• Image cache — hotel photos are cached locally on your device to reduce data usage. The cache contains no personal data and can be cleared from your device settings.
• Website analytics — kottahotels.com and book.kottahotels.com (separately from the App) use Google Analytics, and kottahotels.com additionally uses WP Statistics, to understand aggregate traffic to our sites. The mobile App itself contains no such tool — see section 2.7.

2.6 Cookies (websites only)

The App does not use cookies. Our websites (kottahotels.com and book.kottahotels.com) use cookies and similar technologies for: keeping you logged in and remembering your preferences; the analytics described above; and, if you interact with the newsletter sign-up, Mailchimp’s own cookies. You can control or delete cookies through your browser settings; blocking them may affect how well our websites work.

2.7 What we do not do

The App contains no advertising, no third-party analytics or tracking SDKs, and no crash-reporting SDK. We do not track you across other apps or websites. We do not build advertising profiles. We do not sell your personal data.

3. How we use your information

We do not send marketing email without your separate opt-in (e.g. subscribing to our newsletter). Where we rely on your consent, you may withdraw it at any time (see section 7).

4. How we share your information

We share personal data only as described here:

• The hotel / property you booked — the guest name, contact details, stay dates and special requests are shared with the specific Kotta Hotels property so it can prepare and provide your stay, including through its property-management system.
• Duitku — to process your payment, as described in section 2.4.
• Google / Apple — only as part of the sign-in you initiate.
• Mailchimp — your email address, only if you subscribe to our newsletter, so it can send you those emails on our behalf.
• Google Analytics and WP Statistics — aggregate website usage data (see section 2.6), for our websites only, not the App.
• Service providers — hosting and infrastructure providers that operate our servers on our behalf, under contract and only on our instructions.
• Legal and safety — courts, regulators or law-enforcement authorities where we are legally required to disclose, or to establish, exercise or defend legal claims, or to protect the rights and safety of any person.
• Corporate transactions — if we are involved in a merger, acquisition or asset sale, your data may be transferred, subject to this Policy.

We do not share your personal data with advertisers or data brokers.

5. Data retention

• Account profile and preferences — kept while your account is active; deleted (or anonymised) after you request account deletion, subject to the exceptions below.
• Reservation and payment records — retained for up to 10 years after the stay, to meet tax, accounting and audit obligations, then deleted or anonymised.
• Support correspondence — kept for up to 24 months.
• Newsletter subscription — kept until you unsubscribe.
• On-device data — removed from your device when you sign out or uninstall the App.

6. Account and data deletion

You can ask us to delete your Kotta Hotels account and associated personal data at any time by sending a request from your registered email address to privacy@kottahotels.com with the subject “Delete my account”. You do not need the App installed to make this request.

We will verify your identity and complete the deletion within 30 days. This removes your profile, saved contact details, loyalty record and stay history from active systems. We will confirm by email when it is done.

What we may retain: reservation and payment records that we are legally required to keep for tax, accounting and fraud-prevention purposes are retained for the period stated in section 5, in restricted-access storage, and are then deleted. Data already shared with a hotel for a completed or upcoming stay, or with Duitku for a completed payment, is retained by them under their own obligations.

Signing out or uninstalling the App does not delete your account on our servers — use one of the methods above.

7. Your rights

Subject to applicable law, you have the right to:

• access the personal data we hold about you, and obtain a copy;
• correct inaccurate or incomplete data;
• delete your data (see section 6);
• restrict or object to certain processing;
• withdraw consent where processing is based on consent;
• data portability, where applicable;
• lodge a complaint with the competent data-protection authority.

To exercise any of these rights, contact privacy@kottahotels.com. We respond within the timeframe required by law (30 days under UU PDP, extendable where permitted).

8. Data security

We protect your data with measures including: encryption in transit (HTTPS/TLS) for all communication between the App and our servers and payment provider; token-based authentication; encrypted storage of session data on your device; and access controls limiting staff access to personal data. No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the authorities of a breach where required by law.

9. International data transfers

Our servers are located in Indonesia. Some of the third parties described in section 4 — our sign-in providers (Google, Apple), Mailchimp (our newsletter provider), Google Analytics, and, for guests in some regions, our payment provider — may process data on servers outside Indonesia, including in the United States. Where data is transferred internationally, we rely on appropriate safeguards as required by applicable law.

10. Children’s privacy

The Services are intended for individuals aged 17 and over. We do not knowingly collect personal data from children. A booking may include a child as a named guest, but the account and booking must be made by an adult. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Links to third-party services

Our App and websites may link to external services such as WhatsApp (to contact a hotel), Google Maps (to view a location), or social media pages. Those services are operated by third parties under their own privacy policies; this Policy does not cover them.

12. Changes to this Policy

We may update this Policy from time to time. We will post the revised version here with a new “Last updated” date and, for material changes, provide a notice in the App or by email before the change takes effect. Continued use of the Services after the effective date means you accept the updated Policy.

13. Contact us

• Privacy matters: privacy@kottahotels.com
• Reservations and general support: support@kottahotels.com
• Postal: PT Kotta Hospitality Management, Jl. Tentara Pelajar No. 40A, Kota Semarang, Provinsi Jawa Tengah 50249, Indonesia