Privacy

Who we are

Discover Borneo is operated by Kers, Netherlands. Kers is responsible for the processing described here. For privacy questions or requests, contact info@discover-borneo.com.

Contact requests

When you use our contact form, we process your name, email address, subject, message and language, any page URL or title you provide, and the time of receipt and handling status. We use these details to answer questions, corrections and requests. Please do not include unnecessary sensitive information.

Our legal basis is our legitimate interest in communicating with visitors and handling their requests carefully (GDPR Article 6(1)(f)). Article 6(1)(b) applies only where processing is necessary to take steps at your request before entering into a contract.

Business submissions

A business submission can contain the business name, category, address, destination, description, email address and case details such as language, reference number, receipt time, status and review information. You may also provide a website, WhatsApp contact, social profiles and photo links.

We use this information to assess the submission and contact the sender. Our legal basis is our legitimate interest in reliable business information and careful review (Article 6(1)(f)). Submissions are not automatically published.

Claims to business listings

A claim can contain the business ID, your email address, an explanation or evidence, and case information such as a reference number, receipt time, status and verification details. We use this to check your authority to claim the listing and prevent misuse. Our legal basis is our legitimate interest in accurate authorisation and protection against false claims (Article 6(1)(f)).

How long we keep information

We aim to keep contact details and messages no longer than needed and, as a rule, to delete them within 12 months of receipt or the last relevant contact.

For business submissions and claims, we aim to delete the data within 24 months of receipt, unless it is still needed for an ongoing case, an agreement or a legal obligation. We review this retention policy periodically. These periods are our retention aims; deletion is not automatic.

Security and abuse prevention

To limit excessive form attempts, we use pseudonymous hashes derived from email and IP addresses, together with attempt counts and expiry times. These hashes remain personal data. Our form tables do not store raw IP addresses, user agents or automatically read HTTP referrers. Hosting services can still receive connection data.

The email check covers 24 hours and the IP check 15 minutes. Expired entries are cleared during subsequent form attempts, so they may remain longer if there are no new attempts. Our legal basis is our legitimate interest in security and availability (Article 6(1)(f)).

Google Analytics

Google Analytics 4 loads only with your consent (Article 6(1)(a)). It helps us understand website use through pseudonymous visitor and session identifiers, events, language, screen size and cleaned page, referrer and link information. We do not send form contents, contact details or search terms to Analytics. Google can receive connection data when its script loads. Analytics is not fully anonymous.

Google Signals, user-provided Analytics data and advertising personalisation are off. User and event data retention is set to 2 months, with reset on new activity off. This is separate from cookie lifetime; standard aggregated reports can remain available longer. You can withdraw Analytics consent through Cookie settings at the bottom of each page.

Cookies

The platform uses cookies, including security cookies, to support site operation and protection. Platform cookies can be present before you make an Analytics choice. Analytics cookies are only set after consent.

Our preference cookie remembers your Analytics choice for 180 days. You can change that choice at any time. Rejecting Analytics does not prevent you from using the site.

Maps

Maps do not load automatically. A connection to OpenStreetMap is made only when you choose to load a map. Discover Borneo does not request your GPS location: map markers come from our own content database. OpenStreetMap processes technical connection data under its own privacy policy.

Technical services

We use OpenAI / ChatGPT Sites for hosting and the platform, with Cloudflare providing infrastructure and security. Google Analytics 4 is used only after consent; OpenStreetMap / OpenStreetMap Foundation only after you choose to load a map. Hosting and security services can process connection data such as IP addresses and browser information to deliver and protect the site.

Social media and external links

Our social media icons are ordinary external links, without social feeds or social tracking scripts. You go to the external platform only when you click. External websites have their own privacy policies, which apply when you visit them.

Your rights

You can request access to, correction or deletion of your personal data, restriction of processing and, where applicable, data portability. You can object to processing based on legitimate interests and withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before it.

Contact info@discover-borneo.com to exercise your rights. You can also complain to the Dutch Autoriteit Persoonsgegevens or another competent supervisory authority.