1. Data Controller
PT ICED PACKS PACKAGING (trading as IcedPacks), NIB 3006260054071, Gang Pamarhadi No. 100/88A, Kel. Jamika, Kec. Bojongloa Kaler, Bandung 40232, Jawa Barat, Indonesia, is the data controller. All requests and questions about personal data go to [email protected] or WhatsApp +62 821 2374 755.
2. Personal Data We Process
We process only the data needed to run your account and orders:
- Account data — your email address and, optionally, a display name, company name, phone/WhatsApp number and delivery address. Collected when you register, request a quotation or order.
- Authentication data — your password is stored as a salted bcrypt hash; a session cookie keeps you signed in.
- Order data — products, specifications, the artwork you upload, status, currency, amounts and the notes attached to your orders.
- Payment data — the proof of payment you upload, transaction references and — for payments through a payment service provider — the status and transaction identifier that provider sends us. We never store your card number or PIN; that data is processed directly by the bank or the licensed payment service provider.
- Messages — conversations through in-site messaging, email or WhatsApp between you and our team.
- Server logs — your IP address is held transiently for security and abuse prevention; it is not stored long-term and is not used for tracking.
- Language and country preference — your language choice is kept in your browser's local storage; one cookie holding a country code (not an IP address) is used to show the matching language.
3. Purposes and Legal Basis of Processing
We process your personal data for the following purposes and on the following bases (Article 20 of the PDP Law; for EU residents, Article 6 GDPR):
- Performance of a contract — managing your account, quotations, orders, payments, production, shipping and after-sales service.
- Legal obligation — bookkeeping, tax and company-record retention under Indonesian law.
- Legitimate interest — system security, fraud and abuse prevention, and anonymous aggregate analytics that contain no personal data (section 10).
- Consent — for any processing not covered above, such as a newsletter or optional cookies (we use neither today). Consent can be withdrawn at any time.
We make no automated decisions with legal effect on you and do no profiling.
4. Who Receives the Data
We do not sell your personal data and do not share it with anyone for marketing. Data is shared only as far as needed to fulfil your order, with the following categories of recipients:
- Infrastructure providers — hosting and backups (our servers) and the transactional email delivery service.
- Payment — our bank (Bank Mandiri) and, where you choose it, the licensed payment service provider that processes your transaction; they receive only the data needed to process and reconcile the payment.
- Shipping — the carrier (Pos Indonesia/EMS, DHL Express, a domestic courier or an air-cargo forwarder) receives the recipient's name, address and phone number to deliver the parcel and, for international shipments, the customs documents.
- Legal obligations — competent authorities, where required by law or by a valid order.
Every recipient is bound by confidentiality and processes the data for that purpose only. Beyond these categories your data is shared with no one.
5. Retention Periods
- Account data is kept while the account is active; an account inactive for a long period may be deleted after notice.
- Order, invoice and payment data is kept for 10 (ten) years under Indonesian company-record and tax retention obligations.
- Messages and correspondence are kept for 5 (five) years for dispute resolution.
- The artwork you upload is kept as long as its order data so that re-orders remain possible; you may request earlier deletion.
- Server logs are deleted automatically after a short period.
When a retention period ends, the data is permanently deleted or destroyed.
6. Storage Location and International Transfers
Our production servers and backups are located in Germany (European Union), with a hosting provider subject to the GDPR. Your personal data is therefore transferred outside Indonesia to a country whose level of personal data protection is equal to or higher than Indonesia's, as Article 56 of the PDP Law requires. For EU residents, data is not transferred outside the EU/EEA except to carriers for delivery to your own country and to our office in Indonesia for order fulfilment.
7. Your Rights as a Data Subject
Under Articles 5 to 13 of the PDP Law (and Articles 15–22 GDPR for EU residents) you have the right to:
- be informed of the controller's identity, the legal basis, the purposes and the retention period of the processing;
- access and obtain a copy of your personal data;
- update, complete or correct inaccurate data;
- end the processing of, delete or destroy your data, as far as this does not conflict with an applicable retention obligation;
- withdraw consent you have given;
- object to automated decision-making and suspend or restrict processing;
- receive your data in a machine-readable format (portability);
- bring a claim and receive compensation for a breach in the processing of your personal data.
Requests go to [email protected]. We provide access and a copy of your data within 3 × 24 hours of receiving a complete request, and answer other requests within 30 (thirty) days at most. To protect your data we may ask you to verify your identity. You also have the right to lodge a complaint with the authority competent for personal data protection in Indonesia; EU residents may complain to their national data protection authority.
8. Data Security
We apply reasonable technical and organisational measures to protect your personal data: encrypted traffic (HTTPS), hashed passwords, role-based access restrictions, encrypted backups and security monitoring. Should a personal data breach affecting you occur, we notify you and the competent authority in writing within 3 × 24 hours of becoming aware of it, as Article 46 of the PDP Law requires.
9. Cookies and Local Storage
We use two tiers. Mandatory: one session cookie (to keep you signed in), one country-code cookie for language selection, and your browser's local storage to remember your language and cookie choices; our anonymous analytics set no cookie at all (section 10). Optional: any cookie beyond that (for example marketing or third-party cookies) would run only with your consent — we use none today. There are no advertising cookies and no third-party tracking.
10. Anonymous Analytics
We record anonymous, aggregate analytics to see which products and pages draw interest and to run and improve the site. These analytics are entirely first-party — built and hosted by us, never sold or shared with advertisers or data brokers. For each page view we store only the page path, a category, the date and an approximate location at country and region level — no IP address, no device fingerprint and no user identity. Because they contain no personal data, these analytics run without consent on the basis of our legitimate interest.
11. Minors
Our service is not directed at children under 18 (eighteen), and we do not knowingly collect children's personal data. If you learn that a child has given us data, contact us so that it can be deleted.
12. Changes to This Policy and Contact
We may update this Privacy Policy; the applicable version is the one published on this page with the version number and date below. Material changes are notified by email to account holders. Questions, requests and complaints: [email protected] · WhatsApp +62 821 2374 755 · PT ICED PACKS PACKAGING, Gang Pamarhadi No. 100/88A, Kel. Jamika, Kec. Bojongloa Kaler, Bandung 40232, Jawa Barat, Indonesia.
