Legal notice, terms & privacy

Draft prepared for legal review — to be checked by Indonesian and EU-qualified counsel before publication. Items shown as [to be added] are still open.

Version: draft 0.1 · Last updated: 15 October 2026 · Operator: PT Eko Vitaris International, Malang, Indonesia

Contents

  1. Legal notice and disclaimer
  2. Imprint
  3. Booking terms and cancellation
  4. Safety and waiver
  5. Privacy notice (UU PDP and GDPR)
  6. Cookie and local-storage policy
  7. Data retention schedule
  8. Community guidelines and user content
  9. Accessibility and complaints

1. Legal notice and disclaimer

This website is operated by PT Eko Vitaris International (“we”, “us”), the company behind the brands Sulawesi Earth Trails and ESMI (Eco Sustainable Mining Initiative). Full company details are in the Imprint. By using this website you accept this legal notice. If you do not agree, please do not use the website.

1.1 Prototype status

This website is a prototype. Content, functions, routes, prices and features are still being developed and tested. Some functions are demonstrations only and may not work, may change or may be removed without notice. Nothing on this website is an offer that you can accept by yourself; it is an invitation to send us a request.

1.2 Prices and availability are indicative

  • All prices, durations, itineraries, group sizes, inclusions and availability shown on the website are indicative and non-binding.
  • A booking becomes binding only when we confirm it to you in writing (by email or WhatsApp message) with the final price, date and inclusions, and you accept that confirmation as described in the Booking terms.
  • Prices are shown in US dollars (USD) for convenience. Where Indonesian law requires payment in Indonesian Rupiah (IDR), we invoice in IDR at the rate stated in the confirmation.
  • Obvious errors in prices or descriptions do not bind us. If we find such an error after you have sent a request, we tell you before any confirmation.

1.3 No rights can be derived from website content

The website is for general information. No rights or claims can be derived from its content, from automatic translations or from demonstrations, except where we have expressly confirmed something to you in writing or where mandatory law provides otherwise. Automatic translations are offered for convenience only; the English text prevails unless mandatory law says otherwise.

1.4 Information without warranty

We prepare the content with care, but we give it “as is” and without any warranty, express or implied, that it is complete, accurate, current or fit for a particular purpose. Historical, geological, cultural and nature information is simplified for visitors and may contain errors or competing interpretations.

1.5 Images, dramatisations and historical characters

  • Some images, maps, 3D views and videos are artist’s impressions, reconstructions, composites or dramatisations. They show the atmosphere of a place or period and may differ from what you will see.
  • The historical characters in the “Talk to the past” feature and on the stop pages are fictionalised. Their words are dramatised from historical sources and generated by automated conversational and speech services. They are not real statements of any person, living or dead, and are not historical evidence. Answers may be inaccurate, incomplete or anachronistic.
  • Songs, stories and translations may be adapted for the tour.

1.6 Volcano, weather and wildlife information is not a safety guarantee

Volcano status, weather forecasts, maps, terrain views and wildlife information on the website come partly from third parties (such as PVMBG/MAGMA Indonesia and Open-Meteo) and may be delayed, incomplete or wrong. They are for general orientation only. They are not a safety assessment and do not replace official warnings, local instructions or the decision of your guide on the day. Wildlife sightings cannot be guaranteed.

1.7 Gold, minerals and measurements

  • Gold panning and ore activities are educational and recreational experiences. We do not guarantee that you will find gold or minerals, nor any quantity, purity, weight or value.
  • Gold flakes, souvenirs and samples have no guaranteed market value. They are not an investment product.
  • XRF (X-ray fluorescence) readings shown on the website or in demonstrations are illustrative. They are not certified assays and must not be used for trade, valuation or legal purposes.
  • Cooperatives and local miners who host visits are independent third parties. Nothing on this website states or implies that we, ESMI or any host holds a particular mining licence or permit, or that any site is endorsed by a government authority.
  • Rules on taking gold out of Indonesia and bringing it into other countries are currently being checked. We do not guarantee that a souvenir may be exported or imported. You are responsible for customs declarations at departure and on arrival.

1.8 Limitation of liability

To the extent permitted by Indonesian law and other mandatory law:

  • We are not liable for loss or damage arising from the use of this website or from reliance on its content, including interruptions, errors, viruses or loss of data, unless caused by our intent (kesengajaan) or gross negligence (kelalaian berat).
  • For services we actually provide to you under a confirmed booking, our liability is set out in the Booking terms.
  • Nothing in this legal notice limits or excludes liability for death or personal injury caused by our fault, for intent or gross negligence, or any liability that cannot be limited under Law No. 8 of 1999 on Consumer Protection (UU 8/1999), in particular Article 18 on standard clauses, or under mandatory consumer law of your country of residence.

1.9 Third-party links and services

The website links to and loads content from third parties (for example WhatsApp, map and terrain tiles, weather data, historical image libraries and code libraries). We have no control over their content, availability or privacy practices and are not responsible for them. A link is not an endorsement. The third parties we use are listed in the Cookie policy and the Privacy notice.

1.10 Intellectual property and copyright

  • Texts, design, logos, photographs, videos, illustrations, 3D models, audio, software and the selection and arrangement of content are protected by Law No. 28 of 2014 on Copyright (UU 28/2014) and international treaties. Unless stated otherwise, they belong to PT Eko Vitaris International or its licensors.
  • You may view the website and print or save pages for personal, non-commercial use. Any other reproduction, distribution, adaptation or commercial use requires our prior written permission.
  • Historical maps and images are reproduced from the collections of Leiden University Libraries via their IIIF service. Where these works are in the public domain, they are credited to Leiden University Libraries and remain free for others to use under the library’s own terms. Our own additions (annotations, overlays, colourisation, translations) remain protected.
  • Map imagery: Esri World Imagery (source: Esri, Maxar, Earthstar Geographics and the GIS user community). Terrain data: Terrain Tiles on AWS Open Data. Weather data: Open-Meteo.com (CC BY 4.0). Open-source libraries (MapLibre GL JS, three.js, OpenSeadragon) are used under their respective open-source licences.
  • If you believe content on this website infringes your rights, contact us at guido@esmi.earth. We review notices promptly and remove content where required.

1.11 Trademarks

“Sulawesi Earth Trails”, “ESMI”, “Eco Sustainable Mining Initiative” and the related logos are trade names and brands of PT Eko Vitaris International. Registration status with the Directorate General of Intellectual Property (DJKI): [to be added]. Other names and logos belong to their respective owners. You may not use our brands without written permission.

1.12 User-generated content

If you post or upload content (for example votes, comments, photos, finds or sightings), the licence and rules in Community guidelines and user content apply.

1.13 Changes

We may change this website and these legal pages at any time, for example to reflect new services, legal requirements or the launch of the app. The version published on the website applies to website use. For a confirmed booking, the terms that applied on the date of our confirmation apply, unless a change is required by law or is in your favour.

1.14 Severability

If any provision is held invalid or unenforceable, the remaining provisions stay in force. The invalid provision is replaced by a valid provision that comes closest to its purpose, as far as the law allows.

1.15 Governing law and competent court

  • These legal pages and any contract with us are governed by the laws of the Republic of Indonesia.
  • We first try to settle disputes amicably (musyawarah). Failing that, the District Court of Malang (Pengadilan Negeri Malang) has jurisdiction.
  • Consumers may also use the Consumer Dispute Settlement Body (BPSK) or other forums available under UU 8/1999.
  • If you are a consumer resident in the European Union or European Economic Area, this choice of law does not deprive you of the protection of mandatory provisions of the law of your country of residence. You may also bring proceedings in the courts of your country of residence where the applicable law allows this.

2. Imprint

OperatorPT Eko Vitaris International (limited liability company under Indonesian law)
Registered addressGedong Ijen, Jl. Terusan Ijen No. 28, Kota Malang, Jawa Timur, Indonesia
Deed approval (Ministry of Law)AHU-00419.AH.02.01.TAHUN 2026
DirectorGuido Lassally
Business identification number (NIB)[to be added]
Tax number (NPWP)[to be added]
Tourism business registration (KBLI / TDUP)[to be added]
Electronic system operator registration (PSE)[to be added]
BrandsSulawesi Earth Trails; ESMI (Eco Sustainable Mining Initiative)
Emailguido@esmi.earth
WhatsApp+31 6 1683 8463
Responsible for contentGuido Lassally, address as above
Website hosting[to be added]

3. Booking terms and cancellation

These terms apply to all expeditions, private tours and extras offered by PT Eko Vitaris International under the Sulawesi Earth Trails brand. They form part of every booking together with our written confirmation. If the confirmation differs from these terms, the confirmation prevails. An Indonesian-language version is available on request and prevails where Indonesian law requires.

3.1 Products

ProductDurationIndicative price
Treasure Hunt1 day from ManadoUSD 129 per person
Gold & Fire Trail2 days from ManadoUSD 395 per person
Earth Expedition3 days from ManadoUSD 595 per person
Private & exclusiveOn requestFrom USD 990 per person per day
Film crew (extra)Per departureUSD 490 per group
Photographer (extra)Per departureUSD 190 per group
Jewellery (extra)Made to orderPrice on request

Inclusions (transport, meals, camping equipment, entrance and ranger fees) are stated in the confirmation.

3.2 Request and confirmation

  • You send a booking request through the website form, which opens WhatsApp or your email program with your details. A request is not yet a booking.
  • We reply with a written confirmation stating the product, date, pickup point, number of participants, extras, total price, payment terms and any special conditions.
  • The contract is concluded when you accept the confirmation and pay the deposit (or the full price, where required). Electronic confirmations are valid agreements under Law No. 11 of 2008 on Electronic Information and Transactions as amended (UU ITE) and Government Regulation No. 71 of 2019 (PP 71/2019).
  • The person who makes the booking (lead guest) confirms that they are at least 18 years old and authorised to book for all participants, and passes these terms to them.

3.3 Deposit, balance and payment methods

  • Deposit: 30% of the total price, due on acceptance of the confirmation. The booking is secured once the deposit is received.
  • Balance: 70%, due no later than 3 days before departure. For bookings made less than 7 days before departure, the full price is due on acceptance.
  • Payment methods: online payment through our payment provider Xendit (planned; methods such as cards, bank transfer, virtual accounts and e-wallets, as offered at checkout) and bank transfer to our company account. Other methods only if confirmed in writing.
  • Currency: prices are shown in USD. Where required by Law No. 7 of 2011 on Currency and Bank Indonesia rules, we invoice and collect in IDR at the rate stated in the confirmation. Bank and card fees charged by your own bank are for your account.
  • If the balance is not paid on time, we remind you and may cancel the booking after a reasonable deadline; the cancellation fees in 3.4 then apply.

3.4 Cancellation by you

Please cancel in writing (email or WhatsApp). The date we receive your message counts. The following fees apply, as a percentage of the total price of the cancelled booking:

Time of cancellation before departureCancellation feeRefund
More than 7 daysNone100%
7 to 3 days30% (the deposit)70% of amounts paid above the fee
Less than 3 days, up to 24 hours60%40% of the total price
Less than 24 hours, or no-show100%None
  • You may prove that our actual costs or losses were lower than the fee; we then charge only the lower amount.
  • One change of date or a replacement participant is free if requested at least 48 hours before departure, subject to availability.
  • Private and exclusive tours and made-to-order jewellery may have different cancellation terms because of third-party costs. These are stated in the confirmation. Personalised jewellery cannot be cancelled once production has started.
  • If you leave an expedition early, unused services are not refunded unless we can save costs.
  • Refunds are made to the original payment method within 14 days.
  • EU right of withdrawal: under EU consumer law (Directive 2011/83/EU, Article 16(l)) there is no 14-day withdrawal right for leisure services booked for a specific date. Our cancellation scale applies instead.

3.5 Changes and cancellation by us

  • Your safety comes first. We may change the route, timing or programme, or cancel a departure, if the official volcano status (PVMBG/MAGMA), weather, river conditions, local events, access permission, health or other safety reasons require it.
  • If we change an essential part of the programme before departure, or cancel, you choose between an alternative of equal value (or a lower-priced alternative with a refund of the difference), a new date, or a full refund of all amounts paid.
  • If a change is necessary during the expedition, the guide decides on a safe alternative on the spot. If an essential part cannot be replaced, we refund a fair proportion of the price.
  • We may cancel a departure if the minimum group size stated in the confirmation is not reached, by informing you at least 72 hours before departure. You then receive a full refund or a new date.
  • Unless caused by our fault, we do not reimburse indirect costs such as flights, hotels or visas. We therefore recommend flexible travel arrangements and travel insurance.

3.6 Force majeure

Neither party is liable for failure to perform because of events beyond reasonable control, including volcanic activity, earthquakes, tsunamis, floods, extreme weather, epidemics, government measures, closure of areas or roads, strikes, civil unrest and failure of public infrastructure (keadaan memaksa, Articles 1244–1245 of the Indonesian Civil Code). If a departure cannot take place for such a reason, you receive a new date or a refund of amounts paid, minus only costs that we have demonstrably and irrecoverably incurred for you, unless mandatory law gives you a full refund.

3.7 Minimum age

  • Treasure Hunt (1 day): from 6 years, accompanied by a parent or guardian.
  • Gold & Fire Trail and Earth Expedition (with camping and crater walks): from 8 years, accompanied by a parent or guardian.
  • Minors (under 18) always need the written consent of a parent or guardian, who remains responsible for supervising them.

3.8 Health requirements

  • Activities include hiking on uneven and steep ground, heat and humidity, river work, volcanic gases and nights in tents. You need a reasonable level of fitness.
  • Before confirmation you must tell us about any medical condition, pregnancy, allergy, mobility limit or medication that may affect your safety, in particular heart, lung or respiratory conditions (including asthma), because volcanic gases can be harmful.
  • We may refuse or exclude a participant whose health would put themselves or others at risk. If this is based on information you did not give us, the cancellation fees apply.
  • You are responsible for your own vaccinations, malaria and dengue precautions and personal medication.

3.9 Conduct

  • Follow the instructions of the guide, rangers and hosts at all times.
  • Respect local communities, customs, private land and protected areas. Do not take plants, animals, rocks or artefacts except a souvenir given to you by us.
  • No alcohol or drugs during activities. No drones without permission.
  • The guide may exclude any participant who endangers themselves or others, disturbs the group or breaks the law. No refund is due in that case.
  • You are liable for damage you cause intentionally or negligently.

3.10 Insurance

We strongly recommend comprehensive travel insurance covering medical treatment, emergency evacuation and repatriation, adventure activities (hiking near volcanoes, river activities) and cancellation. Evacuation from remote areas can be expensive and is not included in the price. Our own insurance cover: [to be added].

3.11 Our liability

  • We perform our services with the care of a professional tour operator and are liable for damage caused by our fault or the fault of our guides and subcontractors, in accordance with UU 8/1999 and Indonesian civil law.
  • We are not liable where damage results from your own fault, from a failure to follow instructions, from a third party not involved in our services, or from unforeseeable or unavoidable events.
  • For damage other than death or personal injury, and except for intent or gross negligence, our liability is limited to the total price of the booking, as far as the law allows.
  • Nothing in these terms excludes liability that cannot be excluded under mandatory law.

3.12 Travellers from the EU and EEA

Where a booking combines two or more types of travel service (for example transport and overnight accommodation) and EU Directive (EU) 2015/2302 on package travel applies to it, you have the rights set out in that Directive. We then give you the standard information form, a contact point during the trip and any insolvency protection required by law before you are bound. Whether and how the Directive applies to our expeditions is still under review.

3.13 Complaints

  • If something is not right during the expedition, tell your guide immediately so that we can fix it on the spot.
  • You can send a written complaint to guido@esmi.earth within 30 days after the end of the expedition. A later complaint is still considered, but a late report can make it harder for us to investigate.
  • We confirm receipt within 3 working days and give a substantive reply within 14 days.
  • If we cannot agree, you can contact the Consumer Dispute Settlement Body (BPSK) or the courts (see 1.15). Consumers in the EU can get free advice from the European Consumer Centres Network (ECC-Net).

4. Safety and waiver

4.1 Our safety commitments

  • Every departure starts with a safety briefing. Guides carry a first-aid kit and a phone, and know the nearest medical facilities.
  • Each morning of a volcano activity we check the official volcano status of PVMBG (MAGMA Indonesia) and follow its recommendations and exclusion zones. At alert level III (Siaga) or IV (Awas), and whenever the recommendations say so, we do not enter the affected area.
  • We cancel or change activities in heavy rain, flood risk, thunderstorms or poor visibility.
  • Guests never handle mercury, cyanide or other processing chemicals. Gold panning at ESMI’s installation uses mercury-free methods only.
  • Ore crushing is done with protective glasses, gloves and, where needed, hearing protection.
  • The XRF analyser is operated only by trained ESMI staff. It emits X-rays only while measuring. Never point it at people, and keep the distance the operator tells you.
  • Wild camping takes place only on land where we have the owner’s written permission.
  • Wildlife viewing is always with a local ranger: no feeding, no flash, at least 5 metres distance, no touching.
  • Children are supervised by their parent or guardian at all times and never stand near a furnace, crusher or open pit.

4.2 Risks you should know

Nature and adventure travel carries inherent risks that cannot be fully removed even with good care, including:

  • slips, falls and injuries on steep, wet, loose or volcanic ground;
  • volcanic gases (such as sulphur dioxide and hydrogen sulphide), sudden changes in volcanic activity, hot ground and ash;
  • heat, sun, dehydration, heavy rain and rapidly rising rivers;
  • insects, snakes and other animals; mosquito-borne diseases such as dengue and malaria;
  • possible contamination from historic or third-party mining in soil and water (do not drink untreated water, wash your hands before eating);
  • road travel in rural areas and limited mobile coverage;
  • long distances to hospitals and specialist care.

4.3 Your declaration (waiver)

Before departure every participant (or the parent or guardian for a minor) signs a short written declaration in which they confirm that:

  • they have read this safety information and attended the briefing;
  • they understand and accept the inherent risks described above;
  • they have disclosed all relevant health information and are fit to take part;
  • they will follow the instructions of the guide and rangers and will not leave the group without permission;
  • they take part at their own risk for risks that remain despite our proper care, and for the consequences of ignoring instructions;
  • they agree that, in an emergency, the guide may arrange first aid and transport to medical care at the participant’s own cost (to be claimed from their insurance).

Important: this declaration does not exclude or limit our liability for damage caused by our fault, negligence or intent, or any liability that cannot be excluded under UU 8/1999 or other mandatory law. It only records that you were informed and accept the inherent risks of the activities.

4.4 Emergencies

In Indonesia, call 112 for general emergencies. Your guide will inform you of local emergency numbers and the nearest hospital for your route.

5. Privacy notice (UU PDP 27/2022 and GDPR)

This notice explains how we process personal data under Law No. 27 of 2022 on Personal Data Protection (UU PDP), PP 71/2019 and, where it applies to you, the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).

5.1 Controller

The controller is PT Eko Vitaris International, Gedong Ijen, Jl. Terusan Ijen No. 28, Kota Malang, Jawa Timur, Indonesia. Contact for all privacy matters: guido@esmi.earth or WhatsApp +31 6 1683 8463. Data protection officer: [to be added, if required]. EU representative under Article 27 GDPR: [to be added, if required].

5.2 What we process, why, on what basis and for how long

DataPurposeLegal basis (UU PDP Art. 20 / GDPR Art. 6)RetentionRecipients
Booking request: name, pickup hotel, dates, group size, extras, phone number or email, your messageAnswering your request and preparing an offerSteps at your request before a contract (UU PDP Art. 20(2)(b); GDPR 6(1)(b))2 years after last contactMeta Platforms (WhatsApp) or our email provider [to be added]
Booking details: participants, ages, emergency contact, dietary wishes, pickup, extrasPerforming the expeditionContract (Art. 20(2)(b); 6(1)(b))2 years after the expeditionGuides, drivers, rangers and hosts as needed for your trip
Health information you give us (conditions, allergies, medication)Your safety and emergency careExplicit consent (UU PDP Art. 20(2)(a), specific data under Art. 4(2); GDPR 9(2)(a)) and vital interests in an emergencyDeleted 30 days after the expedition, unless needed for an incidentYour guide; medical services in an emergency
Payment and invoice data (amounts, dates, transaction IDs; no full card numbers stored by us)Payment, accounting, taxContract and legal obligation (Art. 20(2)(b)(c); 6(1)(b)(c))10 years (Indonesian tax law)Xendit (payment provider), our bank, accountant, tax authorities
Signed safety declaration, incident reportsSafety records, defending or establishing legal claimsLegal obligation and legitimate interest (Art. 20(2)(c)(f); 6(1)(c)(f))5 years after the expeditionInsurers and advisers if a claim arises
Community join: first name, email, votesCommunity updates, voting on new routes and featuresConsent (Art. 20(2)(a); 6(1)(a)), which you can withdraw at any timeUntil you leave or delete your account, plus 30 daysEmail/newsletter provider [to be added]
“Talk to the past”: the questions you type or speak and the generated answersProviding the conversation you start, in text and speechPerforming the service you request (Art. 20(2)(b); 6(1)(b))Not stored by us after the answer is delivered; processors’ retention see 5.3Automated conversational and speech services provided by third-party processors (Surplus Intelligence via an API gateway; a text-to-speech provider [to be added])
Feedback answers in the conversation featureImproving the tour and the charactersLegitimate interest (Art. 20(2)(f); 6(1)(f))12 months, then deleted; anonymised as soon as possibleHosting provider [to be added]
Correspondence, complaints, access requestsAnswering you and handling complaintsContract, legal obligation, legitimate interest2 years after closing the matterEmail and messaging providers
Photos and videos made by our film crew or photographerDelivering the ordered media to you; marketing only with consentContract; consent for publication (Art. 20(2)(a)(b); 6(1)(a)(b))Delivered files: 12 months; marketing use until consent is withdrawnFilm crew and photographer; file-transfer provider
Technical data: IP address, browser type, time of requestDelivering and securing the websiteLegitimate interest (Art. 20(2)(f); 6(1)(f))Server logs up to 30 days [to be confirmed with host]Hosting provider; third-party resources listed in the Cookie policy
Camera image on QR stop pagesAugmented reality view on your deviceYour action; processed only on your deviceNot stored, not uploadedNone

We do not sell personal data and do not use it for advertising or profiling. We make no decisions with legal or similarly significant effects based solely on automated processing.

5.3 The conversation feature in detail

  • When you type or speak a question to a historical character, the text of your question is sent to automated conversational and speech services provided by third-party processors (currently Surplus Intelligence, reached through an API gateway, and a text-to-speech provider) to generate and voice the answer.
  • Speech recognition uses the speech engine built into your browser. Depending on your browser, the audio may be processed on the servers of the browser vendor (for example Google or Apple) under that vendor’s own privacy terms. We do not receive your audio recording.
  • Please do not share personal or sensitive information in your questions.
  • We require our processors by contract to process the data only on our instructions and not to use it to train their own models; their retention period is [to be confirmed — target: no retention or a maximum of 30 days for abuse monitoring].
  • The characters are dramatised from historical sources. Their answers are not real statements and may be wrong.

5.4 Children

The website is not directed at children. The community and conversation features are intended for users aged 16 and over. Under UU PDP (Art. 25) data of children (under 18) is processed only with the consent of a parent or guardian, and under the GDPR (Art. 8) consent for online services requires parental consent below the age set by your country (13–16). For minors on an expedition, the parent or guardian provides the necessary data and consent. If you believe a child has given us data without consent, contact us and we will delete it.

5.5 International transfers

Some of our service providers process data outside Indonesia and outside the EU/EEA (for example in the United States, Singapore or the EU). For transfers out of Indonesia we comply with Article 56 UU PDP: the recipient country must offer an equal or higher level of protection, or appropriate and binding safeguards apply (such as contractual clauses), or, failing those, we ask for your consent. Where the GDPR applies, transfers to countries without an adequacy decision (Indonesia currently has none) are based on the European Commission’s Standard Contractual Clauses or another valid mechanism under Chapter V GDPR. You can request a copy of the relevant safeguards.

5.6 Security

We take appropriate technical and organisational measures, including encrypted connections (HTTPS), access only for staff who need the data, strong authentication on our accounts, data minimisation, written processing agreements with providers, and deletion according to the retention schedule. Messages sent by WhatsApp are end-to-end encrypted in transit; email is not always encrypted. No system is completely secure.

5.7 Your rights

Subject to the conditions of the law, you have the right to:

  • be informed about the processing (UU PDP Art. 5; GDPR Art. 13–14);
  • access your data and receive a copy (UU PDP Art. 7; GDPR Art. 15);
  • correct or complete inaccurate data (UU PDP Art. 6; GDPR Art. 16);
  • have your data deleted or destroyed (UU PDP Art. 8; GDPR Art. 17);
  • withdraw consent at any time, without affecting earlier lawful processing (UU PDP Art. 9; GDPR Art. 7(3));
  • object to processing based on legitimate interest, and to decisions based solely on automated processing (UU PDP Art. 10; GDPR Art. 21–22);
  • delay or restrict processing (UU PDP Art. 11; GDPR Art. 18);
  • claim compensation for a violation (UU PDP Art. 12; GDPR Art. 82);
  • receive your data in a common, machine-readable format or have it transmitted to another controller (UU PDP Art. 13; GDPR Art. 20).

How to exercise your rights: send a message to guido@esmi.earth or by WhatsApp. We may ask you to verify your identity. We act on requests within 3×24 hours where UU PDP requires this, and in any case within one month (extendable by two months for complex requests, with notice) as required by the GDPR. Requests are free of charge unless they are manifestly unfounded or excessive.

5.8 Data breaches

If a personal data breach occurs, we notify affected data subjects and the Indonesian personal data protection authority in writing within 3×24 hours at the latest, as required by Article 46 UU PDP, stating the data concerned, when and how the breach happened, and the measures taken. Where the GDPR applies, we also notify the competent supervisory authority within 72 hours where required (Art. 33) and inform affected persons without undue delay if the breach is likely to result in a high risk (Art. 34).

5.9 Complaint authorities

  • Indonesia: the personal data protection authority established under UU PDP (Lembaga PDP). Until it is fully operational, complaints may be addressed to the Ministry of Communication and Digital Affairs (Komdigi).
  • EU/EEA: the data protection supervisory authority of your country of residence, place of work or place of the alleged infringement; in the Netherlands, the Autoriteit Persoonsgegevens.

We appreciate the chance to resolve your concern first; please contact us.

5.10 Planned app

We plan an app with user accounts, push notifications, uploads of finds, wildlife sightings and a community feed. These functions may involve location data and photos. They are not active yet. Before launch we will update this notice, ask for any consent required (for example for push notifications and location) and describe the processing in detail.

5.11 Changes to this notice

We update this notice when our processing changes. Material changes are announced on the website and, where we have your contact details and the change affects you, by message.

6. Cookie and local-storage policy

We do not use analytics, advertising or tracking cookies, and we do not use social-media tracking pixels. The website stores a few small items in your browser (localStorage and sessionStorage) and uses a service-worker cache so that functions you choose work, including offline. These items stay on your device and are not sent to us. Under Article 5(3) of the ePrivacy Directive and PP 71/2019, storage that is strictly necessary for a service you explicitly request does not require consent; we still list everything here.

6.1 Browser storage

KeyTypePurposeDurationNecessary?
set-langlocalStorageRemembers the language you selectedUntil you clear browser dataYes (functional, set on your choice)
set-i18n2-<lang>localStorageCaches page translations so pages load faster in your languageUntil you clear browser dataYes (functional)
set-voteslocalStorageRemembers your community votes on this deviceUntil you clear browser dataYes (for the voting feature you use)
set-stampslocalStorageRemembers the stops you have collected in your trail passportUntil you clear browser dataYes (for the feature you use)
set-packlocalStorageRemembers the items you ticked on the packing listUntil you clear browser dataYes (for the feature you use)
set-song-trlocalStorageRemembers the translation language for song lyricsUntil you clear browser dataYes (functional)
set-song-tsessionStorageRemembers the playback position of the song between pagesUntil you close the tabYes (functional)
set-consentlocalStorageRecords your choice in the cookie noticeUntil you clear browser dataYes
Service-worker cacheCache StorageStores pages, images and scripts for offline use on the trailUntil updated by a new version or cleared by youYes (offline function)

You can delete these items at any time in your browser settings (site data). The website then forgets your choices.

6.2 Third-party requests that expose your IP address

To display the website, your browser connects directly to the following third parties. They receive your IP address, browser information and the requested address, and process it under their own privacy terms. We do not receive data from them about you.

ProviderWhat is loadedWhen
unpkg and jsDelivr (content delivery networks)Code libraries: MapLibre GL JS, three.js, OpenSeadragonPages with maps, 3D views or historical images
Esri (World Imagery)Satellite map tilesMap pages
Amazon Web Services (Terrain Tiles open data)Elevation data for 3D terrain3D map pages
Open-MeteoWeather forecastsPages with weather information
Leiden University Libraries (IIIF)Historical maps and imagesPages with historical maps
API gateway, Surplus Intelligence and text-to-speech providerConversation answers and voiceOnly when you use “Talk to the past”
Your browser vendor’s speech serviceSpeech recognitionOnly when you use the microphone
Meta Platforms (WhatsApp)Opens a chat with your requestOnly when you click a WhatsApp button

7. Data retention schedule

We keep personal data only as long as needed for the purpose, or as long as the law requires. After that we delete or anonymise it.

CategoryRetention periodReason
Booking requests that did not lead to a booking2 years after last contactFollow-up questions, proof of communication
Booking and expedition records2 years after the expeditionService, complaints, repeat bookings
Health information30 days after the expedition (longer only if an incident occurred)Safety during the trip
Financial records (invoices, payments)10 yearsIndonesian tax law (UU KUP, Art. 28)
Signed safety declarations and incident reports5 years after the expeditionLegal claims and safety records
Conversation feedback12 months, anonymisedImproving the tour
Conversation questions and answersNot stored by usOnly needed to deliver the answer
Community membership and votesUntil account deletion or leaving, plus 30 daysMembership; backup cycle
Correspondence and complaints2 years after closingHandling and proof
Photos and videos ordered from our crew12 months after deliveryRe-delivery on request
Server logsUp to 30 daysSecurity and error tracing
Browser storage on your deviceUntil you clear itUnder your control

Where a legal claim, investigation or authority request is pending, we may keep the relevant data until it is resolved.

8. Community guidelines and user content

8.1 Who can join

The community is open to people aged 16 and over. You join with your first name and email address and can leave at any time via the link in our messages or by contacting us.

8.2 Rules

  • Be respectful. No harassment, hate speech, threats, discrimination or personal attacks.
  • Only post content you own or are allowed to share. Ask people for permission before posting photos in which they can be recognised; never post images of children without their parent’s consent.
  • Do not share other people’s personal data.
  • Do not post the exact location of nests, dens or rare species, or of sensitive or private sites, to protect wildlife and communities.
  • Do not promote mercury or cyanide use, illegal mining, poaching, or the trade in gold, wildlife or artefacts.
  • No spam, advertising, malware or misleading content.
  • No content that is prohibited under Indonesian law, including UU ITE (for example defamation, pornography, gambling or incitement), or under the law of your country.

8.3 Licence to your content

  • You keep the copyright and moral rights in your content (UU 28/2014, Art. 5).
  • By posting, you grant PT Eko Vitaris International a non-exclusive, worldwide, royalty-free licence to host, store, display, translate, adapt in format and share your content within the website, the app and the community, for as long as it is online.
  • We use your content in marketing (social media, brochures, advertising) only with your separate consent, and we credit you if you wish.
  • When you delete content or your account, the licence ends for future use; copies may remain in backups for up to 30 days and in places where others have already shared it with permission.
  • You confirm that your content does not infringe the rights of others, and you are responsible for it.

8.4 Moderation and reporting

  • We may review, hide or remove content and suspend accounts that break these rules or the law. Where reasonable we tell you why and give you the chance to respond.
  • We remove unlawful content within the deadlines required by Indonesian law once we are informed.
  • Report content to guido@esmi.earth with a link and the reason.
  • Voting results are advisory. We decide on routes and features at our discretion.

9. Accessibility and complaints

9.1 Website accessibility

We want everyone to be able to use this website. We aim to meet the Web Content Accessibility Guidelines (WCAG) 2.2 level AA, in the spirit of Law No. 8 of 2016 on Persons with Disabilities and the European Accessibility Act. Because this is a prototype, not all parts meet this standard yet. Known limitations:

  • interactive 3D maps, augmented reality and deep-zoom historical images are hard to use with a screen reader or keyboard; the key information is also given in text;
  • some automatic translations may be imprecise;
  • some videos do not yet have captions or transcripts.

9.2 Accessibility of our expeditions

Several activities take place in rough terrain. Please tell us about any access needs; we will tell you honestly what is possible and look for an adapted programme, for example in a private tour.

9.3 Contact and complaints

For accessibility problems, complaints about our services or this website, or any legal question, contact:

  • Email: guido@esmi.earth
  • WhatsApp: +31 6 1683 8463
  • Post: PT Eko Vitaris International, Gedong Ijen, Jl. Terusan Ijen No. 28, Kota Malang, Jawa Timur, Indonesia

We confirm receipt within 3 working days and reply in substance within 14 days. If you are not satisfied, see 3.13 (consumer complaints) and 5.9 (privacy complaints).

© 2026 PT Eko Vitaris International. All rights reserved, except for public-domain and openly licensed works credited above.