Privacy policy.

“Nusa Estates” is the trading name used throughout this website to refer to PT Nusa Estate Group, a boutique developer of design-led residences in Bali. For the purposes of Indonesia’s Personal Data Protection Law (Law No. 27 of 2022, “UU PDP”) and other applicable data protection law, PT Nusa Estate Group is the controller of the personal data described in this policy.

Our data protection contact is Bruno Stefan Horst, Direktur. Questions, requests, or reports can be sent at any time to info@nusaestates.com.

When you submit our contact form, we collect the details you provide: your name, email address, phone number, country, area of interest, and any note or message you add. Every field beyond name, email, and message is optional.

When you visit our contact page, we make a best-effort guess at your approximate country from your IP address, using a third-party lookup service, solely to pre-fill the country and phone-code fields for convenience. This lookup happens in your browser, is not logged on our servers, and you can change or clear the suggested value before submitting. If you do submit the form, whatever country value is showing at that point (suggested or edited) is saved as part of your enquiry, as described below.

If you use our chat concierge, you are talking to an AI assistant, not a person. Your messages are sent to our AI provider to generate a reply and are stored against a random session identifier generated when you open the chat - not against your name or email, unless you choose to type them into the conversation yourself. Please do not share passwords, identity numbers or financial details in the chat. No decision with legal or similar effect about you is made automatically.

If you message us on WhatsApp or book a call through Calendly, those services process your messages and booking details under their own terms and privacy policies.

Like virtually every website, standard technical information (such as your IP address, browser type, and the pages you request) is automatically logged by our hosting infrastructure as part of ordinary server operation and security monitoring. This happens regardless of whether you submit a form, and is not something we separately compile or use to identify you.

If we create an investor portal account for you, we also process: your name, email address and a securely hashed password; your holdings, instalment and payment records; the documents we issue to you; messages you send us through the portal; and the verification documents you upload, such as a passport or ID, proof of address and a source-of-funds note.

Identity documents and personal financial information are specific personal data under UU PDP. We ask for them only to verify you as an investor and to meet our legal obligations, including anti-money-laundering rules. We do not use them for marketing and do not share them except with our professional advisers, notaries and authorities where the law requires.

When you sign a document in the portal we record the name you type, the date and time, your IP address and your browser details, as evidence of your signature.

We use the information you submit to respond to your enquiry, send the documents or introductions you requested, and maintain a record of our conversation with you. For investors, we also use the data to create and run the portal, verify identity, record signatures and payments, issue statements and reports, and meet legal and regulatory obligations. We do not use it for advertising, and we do not add you to any marketing or mailing list unless you separately ask us to.

Where data protection law requires a legal basis, we rely on: your consent (given when you tick the consent box and submit a form, and for the verification documents you choose to upload); performance of a contract or steps you ask for before entering one (for investor accounts); compliance with legal obligations (such as anti-money-laundering checks and record-keeping); and our legitimate interest in responding to enquiries directed to us. You can withdraw consent at any time by emailing us; this does not affect anything already done, but we may be unable to continue an investor relationship without the documents the law requires.

We do not sell personal data, and we do not share it with third parties for their own marketing purposes. A small number of service providers process data on our behalf, strictly to deliver the site and respond to you:

• Supabase: hosts the database that stores form submissions and chat transcripts.
• Resend, via our hosting platform’s connector: delivers our email correspondence, including your confirmation email.
• Anthropic: provides the language model behind our chat concierge.
• Calendly: if you book a discovery call, schedules it and receives the name, email, and any details you provide to do so.
• ipwho.is: a best-effort IP-to-country lookup used only to pre-fill the country and phone-code fields described above.
• Google Fonts: serves the typefaces used on this site.
• Lovable: our hosting platform, which may provide technical error monitoring for the site itself.
• WhatsApp (Meta): if you choose to message us there, it carries and stores the conversation under its own terms.
• Notaries, lawyers, accountants and authorities: where needed to complete an investment or where the law requires us to disclose information.

We may also disclose information where required by law, or to protect our rights, safety, or the safety of others.

Some of the providers above process data outside Indonesia and outside the country you are in, including in the United States and the European Union. We transfer personal data abroad only where the destination offers a level of protection at least equal to UU PDP, or where binding safeguards such as contractual data-protection terms are in place, and with your consent where the law requires it. We are in the process of reviewing each provider’s data-processing terms against the PDP implementing regulation (Government Regulation 33 of 2026), which takes effect on 16 January 2027.

This site uses four cookies, all strictly necessary for the site to work - none are used for advertising, analytics, or tracking. We don’t run Google Analytics, ad pixels, or any third-party tracking script.

• nusa_gate - remembers that you’ve entered the site password. Expires after 30 days.
• nusa_investor_session - keeps you signed in to the investor portal. Expires after 30 days.
• nusa_admin_session - keeps our team signed in to the admin area. Expires after 7 days.
• nusa_csrf - a short-lived security token that protects login forms from forgery. Expires after 10 minutes.

Separately from the above, this site stores a few small, non-identifying preferences directly in your browser, which never reach our servers: your chosen display currency and your light/dark theme preference. If you have previously entered your name and email to download a project PDF, those details are also saved locally so the site does not ask again - used only to personalise the confidentiality watermark on PDFs generated in your own browser, and never transmitted to us.

We review stored enquiries at least once a year and delete those we no longer need, ordinarily within 24 months of our last contact, or sooner if you ask us to. Chat transcripts are kept for up to 12 months to help us improve the concierge’s answers and are not linked back to an individual unless you typed identifying details into the chat yourself.

For investors, account and signature records are kept for the life of the relationship and afterwards for as long as the law requires or we need them to defend a claim. Identity and verification documents are kept for at least five years after the relationship ends, as anti-money-laundering rules require, and then deleted.

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, to restrict or object to certain processing, to withdraw consent, and to lodge a complaint with your local data protection authority. To exercise any of these, write to info@nusaestates.com and we will respond personally. We respond within the periods set by UU PDP (generally three days for access, withdrawal of consent and similar requests) and in any case within 30 days. If you are in the European Economic Area or the United Kingdom, your rights include those under the GDPR or UK GDPR. If you are not satisfied with our answer, you may complain to the Indonesian authority that supervises personal data protection (currently the Ministry of Communication and Digital Affairs, Komdigi, until the PDP Agency is established) or to your local authority.

We take reasonable technical and organisational measures to protect the information you share with us. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal data breach occurs that is likely to pose a risk to you, we will notify you and the relevant authority in writing within 3 x 24 hours, as UU PDP requires, and tell you what happened and what to do.

This site is directed at adults considering a private real estate investment. It is not directed at, and we do not knowingly collect data from, children.

We may update this policy from time to time. Any changes will be posted on this page with a revised date at the top.