Privacy Policy
Effective Date: 08-Mar-2024
Last Updated: 12-Oct-2026
INTRODUCTION
This Privacy Policy outlines how Mulia Group (“Mulia”, “we”, “us”, or “our”) collects, uses, discloses, and protects your personal data when you interact with us across our websites, mobile applications, guest communications, and affiliated services.
We are committed to safeguarding your privacy in accordance with the General Data Protection Regulation (GDPR), Indonesia’s Personal Data Protection Law (PDP Law – Law No. 27/2022), and other global data protection frameworks.
This policy applies to:
- Mulia websites, booking engines, and guest portals;
- Official mobile applications and social media channels;
- Messaging platforms (WhatsApp, Instagram, Facebook Messenger, WeChat);
- E-commerce features (e.g. Instagram Shop, QR order systems);
- Meta Ads and Google Advertising tools;
- AI-powered concierge and chatbot platforms;
- Offline interactions (in-person stays, calls, and event enquiries).
By using our services, you agree to the practices outlined below. You may be asked for explicit consent at key points, such as when subscribing to communications or participating in loyalty programmes.
1. DATA CONTROLLER INFORMATION
This Privacy Policy covers two entities operating under the Mulia brand:
- PT. Mulia Intan Lestari
Hotel Mulia Senayan, Jakarta
Jl. Asia Afrika, Senayan, DKI Jakarta 10270, Indonesia
- PT. Mulia Graha Tatalestari
The Mulia, Mulia Resort & Villas – Nusa Dua, Bali
Jl. Raya Nusa Dua Selatan, Kawasan Sawangan, Nusa Dua 80362, Bali, Indonesia
These entities jointly determine the purpose and means of processing your personal data and are referred to collectively as “Mulia”.
2. GOVERNING LAW & JURISDICTION
This policy is governed by the laws of the Republic of Indonesia. Disputes arising from its application shall be subject to the exclusive jurisdiction of the Central Jakarta District Court (for Hotel Mulia Senayan) or Denpasar District Court (for The Mulia Bali).
3. PERSONAL DATA WE COLLECT
A. Information You Provide Voluntarily
- Full name, date of birth, passport/visa details
- Contact details (postal address, email, phone number)
- Booking and stay history, loyalty programme status
- Credit/debit card information (processed via PCI DSS-compliant gateways)
- Guest preferences, dietary or health information (when provided voluntarily)
- Social media handles or user IDs
- Event or corporate travel data (e.g. RFP forms)
- Communication preferences and marketing opt-in or opt-out selections, as recorded at check-in, through our booking engine, or via direct request to Mulia
B. Automatically Collected Information
- IP address, device type, browser version, location
- Session logs, referral sources, site navigation patterns
- Interaction logs with concierge bots or WhatsApp
- Behavioural data collected via cookies, pixels, and similar technologies
4. HOW WE USE YOUR INFORMATION
Your personal data may be used to:
- Process bookings and transactions
- Send pre-stay, in-stay, or post-stay messages via WhatsApp, WeChat, or email
- Personalise your experience and tailor offers
- Operate AI concierge platforms and digital assistants
- Conduct guest satisfaction and service improvement analysis
- Send marketing messages (subject to consent)
- Enforce regulatory obligations and enhance guest safety
We may use profiling tools (AI-driven insights, segmentation models) to improve your experience — for example, by suggesting relevant room types or offers. These tools will never be used to make decisions that produce legal or similarly significant effects without human oversight. You may opt out or request manual review at any time.
Where the Hotel deploys AI-powered tools in guest-facing communications or booking assistance — including chatbot platforms and messaging automation — the use of such technology will be disclosed at the point of interaction. Data processed through such tools is handled in accordance with this Privacy Policy, applicable Indonesian data protection law, and the terms of the relevant technology provider.
5. DISCLOSURE OF INFORMATION
Your information may be shared with:
- Authorised Mulia staff and affiliated entities
- Booking platforms and CRM systems
- Trusted marketing and analytics providers (Meta, Google, TikTok)
- Regulators, legal authorities, or auditors (where required by law)
- Successors or acquiring entities in the event of a business restructuring
All third parties are subject to binding Data Processing Agreements (DPAs). Where data is transferred internationally, Mulia ensures appropriate safeguards such as Standard Contractual Clauses (SCCs) or UK International Data Transfer Agreements (IDTA) are in place.
6. INTERNATIONAL TRANSFERS
Your data may be stored or processed in:
- Indonesia, the United States, the European Union, or other jurisdictions
- Data centres or cloud providers adhering to recognised data protection standards
Cross-border transfers are protected by contractual and technical measures in line with GDPR and PDP Law.
7. LEGAL BASIS FOR PROCESSING
Depending on your location and the nature of the interaction, we rely on:
- Consent — for cookie-based analytics, opt-in marketing programmes, and loyalty communications
- Contractual necessity — for booking processing and service delivery
- Legitimate interests — for service optimisation, fraud prevention, CCTV security, and direct marketing to existing guests where the communication relates to similar products or services and where the guest would reasonably expect to receive it, subject always to the guest’s right to object
- Legal obligations — for immigration compliance, tax reporting, and regulatory requirements
You may withdraw consent at any time without affecting the lawfulness of prior processing.
8. YOUR RIGHTS
Subject to applicable laws, you may exercise the following rights:
- Access and correct your personal data
- Request deletion (“right to be forgotten”)
- Object to direct marketing or profiling
- Withdraw prior consent
- Request data portability (in machine-readable format)
Please send requests to dataprivacy@themulia.com. We may require ID verification to protect your data security.
9. CCTV & SECURITY SURVEILLANCE
For the safety and security of our guests, associates, and property, Mulia Hotels Group operates closed-circuit television (CCTV) systems in public and operational areas of our properties, including entrances, lobbies, corridors, pool decks, and external perimeters.
CCTV is not installed in private areas where guests have a reasonable expectation of privacy, including guest rooms, bathrooms, and spa treatment rooms.
The legal basis for this processing is our legitimate interest in maintaining a safe environment for all guests and associates. Footage is retained for a maximum of 30 days unless a longer period is required in connection with a specific incident, investigation, or legal obligation. Access is strictly limited to authorised personnel and, where required, law enforcement or regulatory authorities. CCTV footage will not be used for marketing, performance monitoring, or behavioural evaluation.
10. SECURITY MEASURES
We implement technical and organisational safeguards, including:
- SSL encryption, firewall protection
- Role-based access control and audit logging
- Staff training and secure onboarding procedures
- Regular review of privacy practices (“privacy by design”)
11. DATA RETENTION
Your personal data is retained for:
- The duration necessary to fulfil bookings, marketing preferences, or legal obligations
- As long as you are an active loyalty programme member
Once no longer required, your data will be securely deleted or anonymised.
12. CHILDREN’S PRIVACY
We do not knowingly collect personal data from individuals under the age of 18 without parental or legal guardian consent. If data is collected for family stays, it is processed solely for service provision.
13. COOKIES & TRACKING TECHNOLOGIES
We use cookies to:
- Enhance site performance and personalise guest journeys
- Analyse browsing behaviour and improve usability
- Deliver personalised ads via trusted platforms
Cookie Consent Management:
We use a certified consent management platform (CMP) that allows you to:
- Accept all cookies
- Reject non-essential cookies
- Customise cookie preferences by category
By default, only essential cookies are enabled. Consent logs are retained for at least 6 months. You may change your preferences via the “Cookie Settings” link in the website footer.
14. LOYALTY PROGRAMME (MULIA PRIVILEGE)
If you are a Mulia Privilege member, we use your data to:
- Manage your tier status and redemptions
- Send member-specific offers or anniversary rewards
- Enable recognition across properties
All safeguards and rights described in this policy apply equally to loyalty programme data.
15. MARKETING COMMUNICATIONS
Mulia may send you marketing communications on one of the following bases:
- Consent-based marketing: Where you have expressly indicated your preference to receive marketing communications from Mulia — including by ticking the relevant opt-in box at check-in, on our website, or through our booking engine — we will send you promotional messages via email, WhatsApp, SMS, and push notifications on the basis of your consent. You may withdraw this consent at any time.
- Legitimate interests-based marketing (existing guests): Where you have completed a stay or made a booking with Mulia, we may contact you with news, offers, and updates relating to our properties and services on the basis of our legitimate interest in maintaining our relationship with you as a guest. We consider this use of your data to be proportionate, to cause minimal privacy impact, and to be within the reasonable expectations of a guest who has stayed with us.
In all cases, you have the right to object to receiving marketing communications from us at any time, with no requirement to give a reason. To unsubscribe, click the unsubscribe link in any email communication, reply STOP to any SMS, or contact us at dataprivacy@themulia.com. Your objection will be acted upon within 5 business days and will not affect any other aspect of your relationship with Mulia.
Unsubscribing from marketing communications will not affect the receipt of transactional or operational communications relating to your reservation or stay. Mulia may retain a record of your opt-out preference to ensure no further marketing is directed to you.
A. GUEST COMMUNICATION PREFERENCES AT CHECK-IN
At check-in, guests may be invited to indicate their preference regarding marketing communications from Mulia. This preference is recorded in our Property Management System and used to determine whether the guest receives promotional communications during and after their stay.
Where a guest does not indicate a preference at check-in, Mulia may still contact that guest with marketing communications on the basis of legitimate interests as described in Section 14(b), subject always to the guest’s right to object at any time.
Where a corporate or group booking agreement specifies restrictions on the use of guest data beyond the purposes of the stay, Mulia will honour those restrictions and will not use the personal data of guests in that group for marketing communications regardless of the individual guest’s registration card selection.
Guests who wish to review or update their communication preferences at any time during or after their stay may do so by contacting dataprivacy@themulia.com or by speaking with the Front Desk team.
B. PHOTOGRAPHY, FILMING & SOCIAL MEDIA CONTENT
Mulia Hotels Group regularly photographs and films its properties, facilities, and events for the purposes of marketing, social media, editorial, and brand communications across our owned and operated channels, including but not limited to Instagram, Facebook, YouTube, TikTok, Xiaohongshu, and the Mulia website.
By entering our properties, guests and visitors acknowledge that photography and filming may take place in public and communal areas of the resort, including pools, beaches, restaurants, lobbies, and event spaces.
We process this content on the basis of our legitimate interest in documenting and promoting our property and services. Where footage or photography incidentally captures guests as part of the broader environment, we consider this to be proportionate, non-intrusive, and within the reasonable expectations of guests visiting a resort of this nature.
We do not intentionally create close-up, identifiable, or personal content featuring individual guests without their prior knowledge. Where a guest is the clear and primary subject of a photograph or video — rather than appearing incidentally in the background — we will seek consent directly before publishing that content.
Third parties — including content creators, commercial production companies, media representatives, and wedding or event photographers — are not permitted to film or photograph other guests of the property without the prior written authorisation of the Resort and the explicit consent of the individuals being filmed. Any such activity conducted without authorisation may result in the third party being asked to cease filming and leave the property.
Right to Request Removal
If you believe you have been captured in Mulia’s published social media or marketing content and you object to its use, you may submit a removal request to:
Email: dataprivacy@themulia.com
Please include a description or link to the relevant content and the platform on which it appears. We will acknowledge your request within 5 business days and complete removal or obscuring of identifiable images within 14 days of confirmation.
Please note that content indexed by third-party search engines, shared by other users, or appearing in cached or archived versions of pages may not be retrievable by Mulia and is outside our direct control. We will make reasonable efforts to support removal where possible. This right to object does not affect content captured and published prior to receiving your request, except where required by applicable law.
16. THIRD-PARTY LINKS
You may unsubscribe at any time by replying STOP or contacting dataprivacy@themulia.com.
Our website may contain links to third-party platforms (e.g. Instagram Shop, e-ticketing, Meta Ads). We are not responsible for the privacy practices or security of these external sites. Please review their privacy policies before submitting personal data.
17. LIMITATION OF LIABILITY
We adopt reasonable measures to protect your personal data. However, no system can guarantee absolute security.
To the extent permitted by applicable law, Mulia shall not be liable for:
- Unauthorised access due to cyberattacks, force majeure, or user negligence
- Indirect, incidental, or consequential losses unless arising from gross misconduct or fraud
18. INDEMNITY
You agree to indemnify and hold harmless Mulia, its affiliates, owners, directors, employees, and representatives from any claims, liabilities, damages, losses, or expenses (including reasonable legal fees) arising from your use of the Site, breach of these Terms, or violation of any law or third-party rights.
19. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time. The “Last Updated” date above reflects the latest version. Material changes will be communicated via our website or other appropriate means.
19. CONTACT US
Data Protection Officer – Mulia Group
Email: dataprivacy@themulia.com
Please include:
- Your full name
- Your preferred contact details
- Nature of your request
- Supporting documents (if applicable)
Privacy for Mobile Application Users
Mulia Hotels is committed to protecting your personal information, including how we manage data through our official mobile application ("the App"). This section outlines how your information is collected, used, and protected when you use the App.
1. Data Collection & Use
When using the Mulia Hotels App, certain personal information may be collected to enhance your experience and facilitate services:
- We collect valid identification (ID) photos as part of the check-in process.
- While we do not actively collect biometric data, the App may utilise your device’s built-in biometric features (e.g., facial recognition or fingerprint) to provide secure access to the App. Mulia Hotels does not store or access this biometric information.
2. Data Storage & Deletion
All ID and personal data collected via the App is managed and stored by OKKAMI, our third-party technology partner.
- Guest ID photos are retained securely and deleted upon request.
- In addition, we are in the process of implementing an automatic deletion protocol, whereby ID photos will be permanently deleted after 30 days in accordance with GDPR compliance.
For more information, please review OKKAMI’s data handling practices:
3. Data Hosting Location
All guest data is stored in accordance with regulations and hosted within Indonesia.
4. Payments via the App
Payments made through the App are processed securely using the same trusted payment gateway as our website.
5. Age Restrictions
To register or make a reservation through the App, users must be at least 17 years old. While there is no restriction for downloading the App, only eligible users may create a booking.
6. Data Protection Officer
If you have any questions or would like to make a request related to your personal data, please contact our Data Protection Officer at:
Email: dataprivacy@themulia.com
