Privacy Policy

At HAELZA ("we," "our," or "us"), we are committed to protecting your privacy and ensuring the security of your personal information in accordance with Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP) and other applicable regulations. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website haelza.com and use our services.

By accessing or using our services, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our services.

This Privacy Policy is prepared in compliance with Indonesian regulations including Law No. 27 of 2022 (UU Perlindungan Data Pribadi), Government Regulation No. 71 of 2019or electronic systems, and Government Regulation No. 80 of 2019 on e-commerce.

1. Information We Collect

1.1 Personal Information

We may collect personal information that you voluntarily provide to us when you:

• Register for an account
• Place an order or make a purchase
• Subscribe to our newsletter
• Contact us for customer support
• Participate in promotions, surveys, or contests

This information may include:

• Full name
• Email address
• Phone number
• Shipping and billing address
• Payment information (processed securely through third-party payment processors)

1.2 Automatically Collected Information

When you access our website, we automatically collect certain information, including:

• IP address and device identifiers
• Browser type and version
• Operating system
• Pages visited and time spent on pages
• Referring website addresses
• Date and time of access

1.3 Cookies and Tracking Technologies

We use cookies, web beacons, and similar tracking technologies to collect information about your browsing activities. For more details, please see our Cookie Policy.

2. Legal Basis for Processing

In accordance with UU PDP, we process your personal data based on the following lawful grounds:

• Consent: When you have given explicit consent for processing, such as subscribing to our newsletter or agreeing to marketing communications
• Contract Fulfillment: When processing is necessary to fulfill our contract with you, such as processing your orders and delivering products
• Legal Obligation: When we are required by law to process your data, such as for tax and accounting purposes
• Legitimate Interest: When processing is necessary for our legitimate business interests, such as fraud prevention and website security, provided these interests do not override your rights

We only collect personal data that is relevant, adequate, and limited to what is necessary for the purposes for which it is processed (data minimization principle).

3. How We Use Your Information

We use the information we collect for various purposes, including:

• Order Processing: To process and fulfill your orders, manage payments, and arrange shipping
• Customer Service: To respond to your inquiries, provide support, and address concerns
• Account Management: To create and manage your account, authenticate access, and provide personalized experiences
• Marketing Communications: To send promotional materials, newsletters, and updates about our products (with your explicit consent)
• Website Improvement: To analyze usage patterns and improve our website functionality and user experience
• Legal Compliance: To comply with legal obligations, prevent fraud, and protect our rights

4. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. However, we may share your information with:

• Service Providers: Third-party vendors who assist in operating our website, processing payments (Midtrans), shipping orders (Biteship, JNE, SiCepat, etc.), and providing customer service
• Business Partners: Partners who help us deliver marketing campaigns and analyze website performance
• Legal Requirements: When required by law, court order, or government regulation
• Business Transfers: In connection with any merger, acquisition, or sale of company assets

All third-party service providers are contractually obligated to protect your personal data in accordance with applicable Indonesian data protection laws.

5. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encrypted data transmission (SSL/TLS), secure servers, access controls, and regular security assessments. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Order and transaction data may be retained for up to 5 years for accounting, tax, and legal compliance purposes. Upon your request or when data is no longer needed, we will securely delete or anonymize your personal data.

7. Your Rights

Under Indonesian UU PDP, you have the following rights regarding your personal information:

• Right to Information: Request information about who is processing your data, the purpose, and the legal basis
• Right to Access: Request a copy of the personal information we hold about you, free of charge
• Right to Correction: Request correction, completion, or update of inaccurate or incomplete information
• Right to Deletion: Request deletion or destruction of your personal information (subject to legal requirements)
• Right to Restrict: Request delay or restriction of processing of your personal data
• Right to Object: Object to processing for direct marketing purposes or automated decision-making
• Right to Withdraw Consent: Withdraw your consent at any time for processing based on consent
• Right to Data Portability: Request a copy of your data in a structured, commonly used, machine-readable format
• Right to Complain: Lodge a complaint with the relevant data protection authority

To exercise these rights, please contact us at [email protected]. We will respond to your request within 3x24 hours as required by Indonesian law.

If your rights are violated, you may be entitled to compensation in accordance with applicable laws.

8. Consent and Withdrawal

We obtain your consent for data processing through:

• Explicit opt-in checkboxes during account registration and checkout
• Separate consent for newsletter subscriptions and marketing communications
• Cookie consent banner when you first visit our website

How to Withdraw Consent

You have the right to withdraw your consent at any time. To withdraw consent:

• For marketing emails: Click the 'unsubscribe' link in any marketing email
• For account data: Contact us at [email protected] with your request
• For cookies: Adjust your browser settings or use our cookie preference center

Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Some data processing necessary for contract fulfillment may continue even after consent withdrawal.

9. Data Breach Notification

In the event of a personal data breach that may harm you or violate your rights, we will:

• Notify the relevant Indonesian data protection authority (Lembaga Pelindung Data Pribadi) within 72 hours of becoming aware of the breach
• Notify affected individuals within 14 days of becoming aware of the breach
• Provide information about the nature of the breach, potential consequences, and measures taken to address it
• Take immediate steps to mitigate any potential damage and prevent future breaches

We maintain incident response procedures to ensure timely detection, investigation, and reporting of any data breaches.

10. Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 18, we will take steps to delete that information as quickly as possible. Parents or guardians who believe their child has provided personal information should contact us at [email protected].

11. International Data Transfers

Your information may be transferred to and processed in countries other than Indonesia. We ensure that such transfers comply with UU PDP requirements by:

• Transferring data only to countries with equivalent or superior data protection standards
• Implementing appropriate and legally binding safeguards, such as standard contractual clauses
• Obtaining your explicit consent when required for cross-border transfers

Our service providers may process data in:

• Singapore (Google Cloud Southeast Asia - analytics and infrastructure)
• United States (payment processing partners)

We ensure that appropriate safeguards are in place to protect your information in accordance with this Privacy Policy and applicable Indonesian data protection laws.

12. Consumer Protection

As an e-commerce business operating in Indonesia, we comply with consumer protection regulations under Law No. 8 of 1999 and PP 80/2019. You have the right to:

• Receive clear and accurate information about our products and services
• Safe and secure transactions when shopping on our platform
• File complaints through our customer service channels
• Seek redress for any issues with your purchases
• Have your personal data protected in accordance with applicable laws

13. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of these external sites. We encourage you to read the privacy policies of any third-party websites you visit.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will notify you of any material changes by posting the new Privacy Policy on this page with an updated "Last Updated" date and/or by email notification for significant changes. We encourage you to review this Privacy Policy periodically.

15. Governing Law and Dispute Resolution

This Privacy Policy is governed by and construed in accordance with the laws of the Republic of Indonesia, including but not limited to Law No. 27 of 2022 on Personal Data Protection (UU PDP).

Any disputes arising from this Privacy Policy or our data practices shall first be resolved through good-faith negotiation. If negotiation fails, the dispute shall be referred to the Indonesian National Arbitration Board (BANI) in Jakarta, Indonesia, in accordance with its rules and procedures.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: