Who we are
ONME BALI ("we", "us", "our") is the data controller for personal information collected on onmebali.com. We are registered in Bali, Indonesia at Jl. Sunset Road No. 28, Seminyak, Kec. Kuta, Kabupaten Badung, Bali 80361. You can reach our team about any privacy matter at care@onmebali.com.
What we collect
- Contact details you give us — name, phone number (WhatsApp), shipping address, email — used to fulfil an order or answer a question
- Order content — the pieces, sizes, colours, and notes you send through the cart
- Technical information — IP address, browser, device type, pages visited, broadly used to keep the site safe and measure traffic
- Shop counters — anonymous totals of how often each piece and collection is viewed, and each piece added to the bag and ordered, counted without cookies and without identifying anyone
- Advertising signals — only if you accept optional cookies: the pages you view and what you search, add to your bag or wishlist, and when you start a WhatsApp order or message us, sent to Meta through the Meta Pixel; where Meta's automatic matching applies, this can include a hashed (scrambled) copy of contact details you type on the site, such as your name, phone number or address
- Marketing consent — only if you subscribe to our newsletter; you can unsubscribe in one click from any letter
- Information you share when you visit a boutique — name and phone if you sign our concierge book, kept only for follow-up
Why we use it
- To prepare, ship, and follow up on your order — legal basis: performance of a contract
- To answer your questions on WhatsApp, email, or in store — legal basis: legitimate interest
- To keep the site safe and prevent fraud — legal basis: legitimate interest
- To send you our occasional letter — legal basis: your consent
- To measure our ads on Instagram and Facebook and show them to people who have visited the site (Meta Pixel) — legal basis: your consent, given in the cookie banner and withdrawn the same way
- To comply with Indonesian tax and consumer law (UU PDP, UU 8/1999, PP 80/2019) — legal basis: legal obligation
Who we share it with
We do not sell your data. We share only what is strictly necessary, with these partners:
- WhatsApp / Meta — when you place an order through our chat checkout, the message is delivered through Meta's infrastructure. Their privacy policy applies to that exchange. We can show you the messages we hold on our side any time you ask.
- Couriers — DHL Express, JNE, J&T or local riders, to deliver your order. They see only the name, address, and phone needed for delivery.
- Payment partners — when you pay by bank transfer or card, your bank and our acquiring bank receive the transaction details. We never store full card numbers ourselves.
- Hosting and analytics — Vercel (hosting), and a privacy-respecting analytics tool that does not use third-party cookies.
- Meta Pixel — only if you accept optional cookies. Meta Platforms receives the advertising signals above with your browser's details (IP address, browser, the _fbp cookie), and any hashed contact details described above, and may link them to your Facebook or Instagram account. Meta's privacy policy applies to what it receives; we see only aggregated ad reports.
- Authorities — only if we receive a lawful, written request.
International transfers
Some of our partners (Meta, Google, Vercel) process data outside Indonesia and outside the European Union. We rely on Standard Contractual Clauses (EU) and the safeguards required by Indonesia's Personal Data Protection Law (UU PDP) for those transfers.
How long we keep it
- Order records: 10 years (Indonesian tax and accounting law)
- Customer support correspondence: 3 years from last contact
- Newsletter subscription: until you unsubscribe
- Website analytics: aggregated only, no individual retention
- Meta Pixel cookies (_fbp, _fbc) on your device: 90 days; what Meta keeps is set by Meta's own retention policy
- Wishlist and cart on this device: stored in your browser, you can clear it any time
Your rights
Under the EU General Data Protection Regulation (GDPR), the Indonesian Personal Data Protection Law (UU PDP, in force October 2024), and similar laws, you have the right to:
- Ask what personal data we hold about you
- Correct anything that is wrong or out of date
- Ask us to delete your data (subject to the retention periods above)
- Object to processing or restrict it
- Receive a copy of your data in a portable format
- Withdraw your consent for marketing and advertising cookies at any time — "Cookie settings" in the footer
- Lodge a complaint with a supervisory authority — in the EU, your national data protection authority; in Indonesia, the Ministry of Communication and Informatics
To exercise any of these, write to care@onmebali.com with the subject "Privacy request". We respond within 30 days.
Cookies
We use only the cookies needed for the site to work. Anonymous traffic measurement and the Meta Pixel, which measures our ads, are optional and run only if you accept them in the cookie banner. See our Cookie Policy for the full list.
Children
Our pieces are for adults. We do not knowingly collect data from anyone under 18. If you believe we have, please write to us and we will remove it.
Updates to this policy
We may update this policy when the way we work changes. The date at the top will always reflect the latest version. Material changes will be announced on the home page.
“We treat your data the way we treat a letter — read, answered, and put back where it belongs.”