This policy explains how Toko Mang Asep collects and uses your personal data.
1. Data controller
[business / owner name], [address]. Contact for personal data matters: [email] or WhatsApp 0852-2285-9966.
2. Data we collect
- When you order: name, WhatsApp number, email, delivery address, order notes, and order contents.
- When you pay: transaction status and reference from Midtrans. Your card or payment account details are processed by Midtrans and are not stored by us.
- When you contact us: the content of messages you send via WhatsApp or the contact form.
- Technical: cookies and browser storage described below.
3. How we use it
- To process, pack, ship, and track your order.
- To send order confirmation emails and related notices.
- To handle warranty claims, questions, and complaints.
- To meet legal obligations such as bookkeeping and taxes.
Our legal bases are performing the transaction with you, legal obligations, and your consent when ordering.
4. Who we share it with
Only as needed, with the following service providers who process data for the purposes above:
- Midtrans (payments).
- Couriers / Biteship (shipping: name, phone number, and delivery address).
- SMTP2GO (email delivery).
- Cloudflare Turnstile (anti-bot check when placing an order; processes your IP address and browser data).
- [hosting/server provider] (data storage).
We do not sell your personal data or use it for third-party advertising. [State any providers located abroad]
5. Cookies and browser storage
- Order cookie (HttpOnly): keeps access to your order page, valid for [60] days.
- Browser storage (localStorage): your shopping cart contents, on your device only.
- We currently use no advertising cookies or analytics trackers. [Update if added later]
6. Security
Data is sent over HTTPS, admin access is protected, and order links use random tokens with a limited lifetime. No system is entirely risk-free; if a breach affecting you occurs, we will notify you as required by applicable rules.
7. Retention
Order data is kept for [number] years for warranty, bookkeeping, and tax purposes, then deleted or anonymised.
8. Your rights
You may request access to, correction of, or deletion of your personal data, withdraw consent, and object to processing, unless this conflicts with our legal obligations. Contact us using the details in section 1; we will respond within [number] business days.
9. Children
This site is not intended for children under 18 without a parent or guardian.
10. Changes to this policy
This policy may be updated. The version in force when you place your order is recorded on your order.