This Privacy Policy explains how PT BarberBox Indonesia ("BarberBox.id", "we", "us", or "our") collects, uses, discloses, and safeguards your information when you visit our website at https://www.barberbox.id/, subscribe to our monthly box, purchase products from our store, or otherwise engage with our services (collectively, the "Services").
We are committed to protecting your personal data in accordance with Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP), Indonesian Law No. 11 of 2008 on Electronic Information and Transactions (UU ITE), and — where applicable to visitors from the European Union — the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).
1. Information We Collect
1.1 Information you provide directly
When you create an account, subscribe to a plan, place an order, or contact us, we collect:
- Identity data: full name, username, date of birth (used only to confirm you are at least 18 years old);
- Contact data: email address, phone number, WhatsApp number;
- Delivery data: shipping address, billing address, delivery preferences;
- Payment data: we do not store full credit card numbers. Payment is processed by PCI-DSS-compliant third-party processors (Midtrans, Xendit). We retain only the last 4 digits and card brand for transaction records;
- Preference data: responses to your grooming preference quiz (hair type, skin sensitivity, brand preferences, owned equipment);
- Communication data: the contents of messages you send to us via our contact form, email, WhatsApp, or live chat;
- Account data: account credentials (passwords are stored as one-way salted hashes), subscription history, order history, ratings and reviews you submit.
1.2 Information collected automatically
When you visit our Website, we and our service providers automatically collect:
- Device and usage data: IP address, browser type and version, operating system, screen resolution, referring URL, pages visited, time spent on pages, click paths, and similar metrics;
- Cookies and similar technologies: session cookies, preference cookies, analytics cookies, and — only with your consent — advertising cookies (see Section 5 below);
- Server logs: standard log information recorded by our web server, including request timestamps and request headers, retained for up to 90 days for security and troubleshooting purposes.
1.3 Information from third parties
We may receive limited information about you from:
- Payment processors (Midtrans, Xendit) confirming transaction outcomes;
- Couriers (JNE, SiCepat, AnterAja, Pos Indonesia) providing delivery status updates;
- Social media platforms if you sign in via social accounts (we currently support Google sign-in);
- Marketing partners assisting with subscriber acquisition (only with your consent).
2. How We Use Your Information
We use your personal data for the following lawful purposes under UU PDP Article 20:
- To provide our Services: processing subscriptions, fulfilling orders, delivering Boxes, and providing customer support;
- To communicate with you: sending order confirmations, shipping notifications, preference surveys, and responding to your enquiries;
- To personalise your subscription: using your preference data to curate Boxes that match your stated needs;
- To process payments: verifying payment methods, preventing fraud, and reconciling transactions;
- To improve our Services: analysing usage data to identify trends, improve our Website, and develop new product offerings;
- To send marketing communications: with your separate opt-in consent, sending newsletters, promotional offers, and product announcements. You may unsubscribe at any time via the link in each email;
- To display advertising: we and our advertising partners (including Google AdSense) use cookies and similar technologies to show you relevant ads based on your visit to our Website and other websites. See Section 5 for details;
- To comply with legal obligations: responding to lawful requests from Indonesian authorities, tax filings, and audit requirements;
- To protect our rights: investigating and preventing fraud, unauthorised transactions, and abuse of our Services.
3. Legal Basis for Processing (GDPR)
For visitors from the European Union, our legal bases for processing under Article 6 of the GDPR are:
- Contractual necessity: processing your data to fulfil our subscription agreement with you;
- Legal obligation: processing required to comply with Indonesian tax, accounting, and consumer protection law;
- Legitimate interests: using anonymised usage data to improve our Services, prevent fraud, and maintain security — provided these interests are not overridden by your rights;
- Consent: for marketing communications, advertising cookies, and other optional processing where you have given explicit consent. You may withdraw consent at any time without affecting the lawfulness of processing already carried out.
4. How We Share Your Information
BarberBox.id does not sell your personal data. We share your data only with the following categories of recipients, under written contracts that require confidentiality and compliance with UU PDP:
- Service providers: payment processors (Midtrans, Xendit), courier partners (JNE, SiCepat, AnterAja, Pos Indonesia), email service providers, and cloud hosting (Cloudflare, Amazon Web Services Singapore region);
- Advertising partners: Google AdSense and other advertising networks, for the purpose of displaying relevant ads on our Website. See Section 5 for details;
- Marketing partners: only when we have your separate consent for a specific co-marketing campaign;
- Indonesian authorities: when required by law, court order, or a lawful request from law enforcement or regulatory authorities;
- Business transfers: in the event of a merger, acquisition, or sale of all or part of our business, your data may be transferred as a business asset — subject to the same protections in these Terms.
5. Cookies & Advertising Technologies
5.1 Types of cookies we use
- Essential cookies: required for the Website to function (login, cart, security). These cannot be disabled;
- Preference cookies: remember your language and display preferences;
- Analytics cookies: help us understand how visitors use our Website (anonymous, aggregated data);
- Advertising cookies: used by Google AdSense and similar partners to display relevant ads.
5.2 Google AdSense & Third-Party Advertising
We use Google AdSense to display advertisements on our Website. Google, as a third-party vendor, uses cookies (including the DoubleClick DART cookie) to serve ads to you based on your visit to this site and other sites on the Internet.
- Google's use of advertising cookies enables it and its partners to serve ads to our users based on their visit to our Website and/or other sites on the Internet;
- Users may opt out of personalised advertising by visiting Google's Ads Settings;
- Users may opt out of third-party vendors' use of cookies for personalised advertising by visiting www.aboutads.info/choices;
- For information about how Google uses data when you use our Website, see "How Google uses information from sites or apps that use our services".
Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this Website or other websites. Google's use of advertising cookies allows it and its partners to serve ads based on your visit to our Website and/or other sites on the Internet.
5.3 Managing cookies
When you first visit our Website, you will see a cookie banner allowing you to accept or decline non-essential cookies. You can change your preference at any time by clearing your browser's cookies, which will display the banner again. Most web browsers also allow you to control cookies through their settings — see your browser's help documentation for instructions.
5.4 Cookie list
A current list of the specific cookies we and our partners use, including their names, purposes, providers, and retention periods, is available on request by emailing privacy@barberbox.id.
6. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy or as required by Indonesian law:
- Active accounts: retained while your account is active and for 24 months after closure;
- Transaction records: retained for 10 years in accordance with Indonesian tax law (UU KUP);
- Marketing consent records: retained until you withdraw consent, plus 12 months for audit purposes;
- Server logs: retained for 90 days;
- Cookies: see Section 5 above.
7. Data Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- TLS 1.3 encryption for all data transmitted between your browser and our servers;
- Encryption of sensitive data at rest using AES-256;
- Strict role-based access controls, with access granted only to employees who require it to perform their duties;
- Regular security assessments and penetration testing by independent third parties;
- Annual employee training on data protection under UU PDP;
- Incident response procedures designed to notify affected individuals and the Indonesian Data Protection Authority (DPA) within 72 hours of a confirmed breach, in accordance with UU PDP Article 46.
Despite our efforts, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to taking all reasonable steps to protect your data.
8. International Data Transfers
Your personal data is primarily stored in Singapore (via our cloud hosting partner AWS Singapore region) and Indonesia (via our local servers and on-premises systems). Where your data is transferred outside Indonesia — for example, to Google (United States), Cloudflare (multiple regions), or AWS (Singapore) — we ensure that the transfer complies with UU PDP Article 56 by:
- Only transferring to countries that have been recognised by the Indonesian government as providing adequate data protection, or;
- Using standard contractual clauses or other appropriate safeguards, and;
- Obtaining your separate consent where required.
For EU visitors, transfers to the United States are made under the EU-US Data Privacy Framework where applicable, or under Standard Contractual Clauses approved by the European Commission.
9. Your Rights Under UU PDP & GDPR
You have the following rights regarding your personal data. To exercise any of these rights, please contact us at privacy@barberbox.id with the subject line "Data Subject Request".
- Right of access: request a copy of the personal data we hold about you;
- Right to rectification: correct inaccurate or incomplete data;
- Right to erasure: request deletion of your personal data, subject to legal retention requirements;
- Right to restrict processing: request that we limit our processing of your data in certain circumstances;
- Right to data portability: receive your data in a structured, machine-readable format;
- Right to object: object to processing based on legitimate interests or for direct marketing;
- Right to withdraw consent: withdraw consent for processing based on your consent at any time, without affecting the lawfulness of processing already carried out;
- Right to lodge a complaint: complain to the Indonesian Data Protection Authority or your local data protection authority if you believe we have not handled your data appropriately.
We respond to all legitimate data subject requests within 30 days, in accordance with UU PDP Article 38.
10. Children's Privacy
Our Services are not directed to individuals under 18 years of age, and we do not knowingly collect personal data from children under 18. If you believe we have collected information from a person under 18, please contact us immediately at privacy@barberbox.id and we will take steps to delete that information.
11. Marketing Communications
With your explicit opt-in consent, we send marketing emails about new products, special offers, and updates. You can unsubscribe at any time by clicking the unsubscribe link in any marketing email or by contacting hello@barberbox.id. We process opt-out requests within 5 business days.
Marketing SMS and WhatsApp messages are sent only to subscribers who have explicitly opted in to receive them and may be opted out of by replying "STOP" to any message.
12. Analytics
We use Google Analytics 4 (with IP anonymisation enabled) and Cloudflare Web Analytics to understand how visitors use our Website. Both tools are configured to anonymise IP addresses and do not identify individual users. Aggregate, anonymised data may be shared with our partners for service improvement purposes.
13. Social Media Features
Our Website may include social media features (such as the Facebook Like button, Instagram embed, or Share buttons). These features may collect your IP address and the page you are visiting, and may set cookies on your device. Your interaction with these features is governed by the privacy policy of the relevant social media platform.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. We will notify subscribers of material changes by email at least 14 days before the changes take effect. The "Last updated" date at the top of this page indicates when the policy was last revised.
15. Contact Information
If you have any questions about this Privacy Policy or our data practices, please contact our Data Protection Officer:
- Attention: Data Protection Officer
- Company: PT BarberBox Indonesia
- Address: Jl. Kemang Raya No. 88, Jakarta Selatan 12730, DKI Jakarta, Indonesia
- Email: privacy@barberbox.id
- Phone: +62 21 555 0199
- NPWP: 01.234.567.8-091.000