1. Who We Are
Tosan Aji is operated by [legal company name], [address], [company number]. We are the controller of your personal data. Contact: info@tosanaji.id.
2. Data We Collect
- Contact and service requests: name, email, phone/WhatsApp, your message and any files you attach.
- Orders: name, billing and shipping address, email, phone, order details. Payment details are handled by our payment provider.
- Accounts: login details and order history, if you create an account.
- Newsletter: your email address, only if you subscribe.
- Technical data: basic server logs (such as IP address and browser) kept for security.
3. Why We Use Your Data
- To answer your questions and handle service requests (our legitimate interest, or steps before a contract).
- To process and deliver orders and provide customer service (performance of a contract).
- To meet legal obligations such as tax and accounting.
- To send our newsletter (your consent, which you can withdraw at any time).
- To keep the website secure and prevent spam and fraud (legitimate interest).
4. Cookies
We use only cookies that are necessary for the website to work, such as the shopping cart and login. We do not use advertising or tracking cookies. If this changes, we will ask for your consent first.
5. Sharing Your Data
We share data only where needed: with our hosting provider, payment providers, shipping carriers, and email service, under agreements that protect your data. Verified sellers or empus receive the details needed to fulfil your request. We never sell your data.
6. International Transfers
Because we work with empus and sellers in Indonesia, some data may be transferred outside the European Economic Area. In that case we use appropriate safeguards such as the European Commission’s standard contractual clauses.
7. How Long We Keep Data
Messages and service requests: up to 2 years after our last contact. Order and invoice data: as long as tax law requires ([7] years). Newsletter: until you unsubscribe.
8. Your Rights
You have the right to access, correct, or delete your data, to restrict or object to processing, to data portability, and to withdraw consent. To use these rights, contact us. You may also complain to your data protection authority.
9. Security
We use HTTPS, keep software up to date, restrict access to personal data, and store uploaded files in a protected location.
10. Changes
We may update this policy. The “Last updated” date at the top shows the latest version.
