Privacy Policy

baliobserver.com can be read without an account, without registering, and without handing over personal data. We collect as little as possible, only to run and secure the site and to answer your messages. This page explains what data is processed, why, and what rights you have under Indonesian Law Number 27 of 2022 on Personal Data Protection (the PDP Law).

In short

There is no programmatic advertising, no ad tracker, and no social media pixel on the public pages of The Bali Observer.
The site is served through Cloudflare, a third party that handles content delivery, security, and visit statistics. Cloudflare's web analytics works without cookies and does not identify individual readers.
Article read counts are anonymous: a number goes up, not a record of who read what.
Display preferences, saved articles, and reading history are kept on your own device, not on our servers.
We do not sell, rent, or trade personal data.

Data controller

The controller of personal data for this site is PT. Kabar Delapan Belas, publisher of The Bali Observer, at Jalan Ir. Juanda No. 76, Kelurahan Simpang Tiga Sipin, Kota Jambi, Jambi. Questions and requests about personal data go to redaksi@baliobserver.com.

What we process

Server logs. Like almost every website, our servers and Cloudflare, our network provider, record technical data for each request: IP address, browser and device type, the page requested, the referring page, and the time of access. This is used to keep the site secure, to stop attacks and abuse, and to fix faults. Logs are not combined with other data to identify you personally, and are deleted or overwritten periodically.
Anonymous read counter. When an article has been open for a few seconds, the browser sends a short signal that increments that article's read count, per article and per day. The signal carries no name, account, cookie, or device identifier, and is not stored as an individual history. The figure is used to compile the most-read list.
Visit statistics. Page views and page load speed are measured by Cloudflare Web Analytics in aggregate form, without cookies. Details are under "Third-party services".
Your messages. If you email the newsroom — an error report, a right of reply, a news tip, or a question — we process the name, email address, contact number, and message content you provide. That data is used only to deal with the matter.
Newsroom accounts. The Bali Observer reporters and editors hold accounts in the internal publishing system. Account data and activity logs are used for newsroom work and system security. Readers neither need nor can create such an account.

What we do not do

We do not run advertising scripts, ad networks, or cross-site trackers.
We do not build reader profiles, fingerprint devices, or make automated decisions that affect you.
We do not load fonts or display libraries from third-party servers. There is exactly one third-party script on public pages: the Cloudflare Web Analytics measurement script described under "Third-party services".
We do not request permission for location, camera, microphone, or notifications.

Cookies and on-device storage

The public pages of The Bali Observer are built to work without tracking cookies. What is stored on your device is only the preferences you choose yourself, kept in the browser's local storage:

light or dark display theme;
article text size;
your saved articles and reading history on the "Saved" page.

That data is never sent to our servers and we cannot see it. You can clear it at any time through your browser settings by clearing site data for baliobserver.com. The only consequence is that display preferences and saved lists return to their defaults.

Strictly necessary technical cookies may be used in two situations: when a reporter or editor signs in to the newsroom system, and when Cloudflare, our network security provider, needs to distinguish real visitors from harmful automated traffic. Such cookies are never used for advertising or tracking.

Third-party services

Cloudflare. baliobserver.com is served through the network of Cloudflare, Inc., a third party we use for three things: a content delivery network (CDN) so pages load quickly, security protection against attacks and harmful automated traffic, and Cloudflare Web Analytics for visit statistics. As an intermediary, Cloudflare processes technical data for every page request, including the IP address. Cloudflare Web Analytics loads one small script from static.cloudflareinsights.com that measures page views, referring pages, browser and device type, country of origin, and load speed. According to Cloudflare, the service works without cookies, without on-device storage, and without fingerprinting visitors. What we receive is aggregate figures only, not a record of individual readers. Because Cloudflare's network is global, that technical data may be processed on servers outside Indonesia. The Cloudflare Privacy Policy applies.
Video. Articles containing video use YouTube's privacy-enhanced mode (youtube-nocookie.com). When a video is played, your browser connects to Google's services and Google's privacy policy applies. Articles without video make no such connection.
Share buttons. Share buttons are ordinary links or your device's built-in share sheet. No social media script is loaded. Data reaches the destination platform only after you choose to share.
The "Listen" feature. Article read-aloud uses the speech engine in your browser or device. Depending on the browser, processing happens on the device or through the browser vendor's service. The Bali Observer receives no data from this feature.
Outbound links. Sites we link to have their own privacy policies.
Hosting provider. The provider of the server this site runs on processes technical data on our behalf, solely to serve and secure the site.

Legal bases and purposes

Legitimate interest in keeping the site secure and reliable (server logs) and in understanding reader interest in aggregate (the read counter and Cloudflare visit statistics).
Your consent when you voluntarily send us a message or material.
Legal obligation of a press company, including serving the right of reply and the right of correction under the Press Law.
Journalistic activity in the public interest, conducted under the Press Law and the Journalistic Code of Ethics.

How long data is kept

Server logs are kept for a limited period as security and maintenance require, then deleted or overwritten.
Read counts and Cloudflare visit statistics are aggregate figures and contain no personal data.
Correspondence is kept as long as needed to resolve the matter. Right-of-reply, right-of-correction, and complaint files are archived longer as evidence that press-law duties were met.

Who data is shared with

We do not sell or rent personal data. It is accessible only to newsroom and technical staff who need it, and to infrastructure providers acting on our behalf, namely our hosting provider and Cloudflare. Requests from authorities are met only where the law requires and through lawful process. The identity of a source granted confidentiality is protected by the journalist's right to refuse disclosure under the Press Law.

Personal data in reporting

A person's name, position, statements, and photograph may appear in a story where they bear on the public interest. Such publication is governed by the Press Law, the Journalistic Code of Ethics, and our Editorial Standards, including the duty to protect the identity of children and of victims of sexual offences. Objections to a story are raised through the right of correction and right of reply in our Corrections Policy. The newsroom weighs each request against the applicant's privacy and the public's right to information.

Your rights as a data subject

The PDP Law gives you the right to:

be informed of the identity of the party processing your data, and the basis and purpose of that processing;
access and obtain a copy of your personal data;
complete, update, and correct data that is wrong or inaccurate;
end the processing of, delete, or destroy your personal data;
withdraw consent previously given;
postpone or restrict processing proportionately;
object to a decision based solely on automated processing;
receive your data in a common, machine-readable format;
sue for and receive compensation for unlawful processing under the applicable law.

To exercise these rights, email redaksi@baliobserver.com with the subject "Personal Data", state your request, and include enough detail for us to confirm the data is yours. Access and rectification requests are answered within three working days, as the PDP Law requires. The service is free. Exercise of these rights may be limited in the cases the law excepts.

Security

The site is served over an encrypted connection (HTTPS). Access to the newsroom system is limited to authorised staff. In the event of a personal data breach, we notify affected data subjects and the competent authority in writing within three working days, as required by the PDP Law.

Children

The Bali Observer is a general news site and does not knowingly collect children's personal data. A parent or guardian who learns that their child has sent us personal data may request its deletion.

Changes to this policy

If the way we process data changes — for example through reader accounts, an email newsletter, or a new form of advertising — this page is updated before the change takes effect, with the date of the update shown.

This page is reviewed regularly by the The Bali Observer newsroom. Contact: redaksi@baliobserver.com.