Privacy Policy
Last updated: 22/09/2026
This policy explains what personal data we collect through theuntravelist.com, why we collect it, who we share it with, and what rights you have.
Who we are
The Untravelist is a brand and editorial platform. It is not itself a registered legal entity. The website is operated jointly by two companies:
- PT Authentic Travel Indonesia, trading as h·ati h·ati, established in Indonesia
- Giulia Grimaldi Mauro, established in Greece
Registered details for both companies are in the Legal notice section of our legal notices page.
Under data protection law these two companies are joint controllers for personal data collected through this website. This means they decide together what data is collected and why.
The arrangement between us
We share responsibility as follows.
Both companies decide together what personal data this website collects, which tools are used to collect it, and how long it is kept. Both companies have access to newsletter subscriptions and enquiry submissions.
Where you make an enquiry about a specific journey or service, the operator handling that enquiry is responsible for how your information is used in responding to you and in providing any service you go on to engage them for.
You may exercise your data protection rights against either company. Whichever one you contact will handle your request, and both are responsible for making sure it is dealt with. The easiest route is hello@theuntravelist.com, and we will route it internally.
What we collect and why
Newsletter and resource downloads
When you subscribe to our newsletter or request a downloadable resource, we collect your email address and, where you provide it, your first name. We also record which page or placement you subscribed from, which resource you requested, and any campaign tracking values present in the link you arrived through.
We use this to send you the newsletter and to deliver the resource you asked for. We also use the source information to understand which parts of the site lead people to subscribe.
Enquiries
When you submit an enquiry form, we collect the contact details and trip information the form asks for. The questions change from time to time, and the form itself always shows you what is being asked.
The form also records context about where the enquiry came from, including the journey or destination you were looking at, which operator it is routed to, the page you came from, and any campaign tracking values in the link you arrived through. This is not information you type in. It exists so the operator can respond to you properly and so we understand which content leads to enquiries.
We use all of this to respond to you and to discuss whether we can help with what you are planning.
Analytics
We use Plausible Analytics to understand how the website is used. Plausible does not use cookies and does not collect or store personal data about individual visitors. It does not follow people across websites or build profiles. The reports we see are aggregate counts of page views, referrers and countries.
Technical and security data
Our hosting and network providers process technical information, including IP addresses, in order to serve the website, keep it available and protect it from abuse.
Our legal bases
Sending you the newsletter and delivering resources. We rely on your consent, under Article 6(1)(a).
Responding to your enquiry and discussing a possible engagement. We rely on steps taken at your request before entering a contract, under Article 6(1)(b).
Understanding aggregate website usage. We rely on our legitimate interest in knowing how our publication is read, under Article 6(1)(f).
Keeping the website running and secure. We rely on our legitimate interest in operating a functioning, secure website, under Article 6(1)(f).
Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect anything we did before you withdrew it.
Where we rely on legitimate interests, you have a right to object. See Your rights below.
Who we share it with
We use the following providers. Each of them processes personal data on our instructions under a data processing agreement.
Webflow hosts the website and its content management system. It processes data in the United States.
Kit sends the newsletter and delivers resources. It processes data in the United States.
Tally runs the enquiry forms. It processes data in the European Union.
Plausible provides website analytics. It processes data in the European Union.
Cloudflare provides domain management and network security. It processes data across its global network.
We do not sell personal data, and we do not share it with anyone other than the providers listed above and the operator handling your enquiry.
Sending data outside Europe
Some of our providers process data in the United States. Webflow is certified under the EU-US Data Privacy Framework, and its data processing agreement also includes the EU Standard Contractual Clauses and the UK International Data Transfer Agreement. Kit relies on the Standard Contractual Clauses and the UK International Data Transfer Agreement, both included in its data processing agreement.
PT Authentic Travel Indonesia is established in Indonesia, which is outside the European Economic Area and has not been the subject of an adequacy decision by the European Commission. Where you submit an enquiry that is handled by PT Authentic Travel Indonesia, your information is transferred to Indonesia because that is necessary to respond to the request you have made. Other personal data collected through this website, including newsletter subscriptions, is accessible to both operating companies under contractual safeguards agreed between them. You can ask us for more detail about how we protect information transferred outside Europe using the contact details below.
How long we keep it
Newsletter subscription. We keep this until you unsubscribe. We review the list periodically and remove subscribers who have stopped engaging.
Enquiry submissions. We keep these for 12 months from your last contact with us.
Aggregate analytics. We keep this indefinitely, since it contains no personal data.
Where you engage an operator, that operator keeps a record of the work under its own retention policy, which it will give you as part of your agreement.
Your rights
You have the right to ask us for a copy of the personal data we hold about you, to have inaccurate data corrected, to have your data deleted, to restrict how we use it, to receive it in a portable format, and to object to processing we carry out on the basis of legitimate interests.
Where we rely on your consent, you can withdraw it at any time. Every newsletter includes an unsubscribe link. Where you have submitted an enquiry, you can withdraw your consent at any time by contacting the operator handling it or by contacting us. Withdrawing consent means we stop processing your enquiry, which will end any conversation in progress.
Unsubscribing and deletion are different. Unsubscribing stops the emails and keeps a record that you opted out, which prevents you being added again by accident. If you want your data deleted entirely rather than only unsubscribed, tell us and we will do that.
To exercise any of these rights, contact hello@theuntravelist.com. We will respond within one month. If your request is complex we may need up to two further months, and we will tell you if that applies.
If you are unhappy with how we have handled your data, you can complain to a data protection supervisory authority. You can complain to the authority in the country where you live or work. You can also complain to the Hellenic Data Protection Authority at dpa.gr, which supervises our Greek operating entity.
Cookies
This website does not use cookies for analytics, advertising or tracking. Plausible, our analytics provider, is cookieless.
Changes to this policy
We may update this policy. The version published on this page is the version that applies. The date at the top shows when it was last changed.
Contact us
For anything relating to this policy or your personal data, contact hello@theuntravelist.com.
You may also contact either joint controller directly using the details in the Legal notice section of our legal notices page.