Privacy Policy

PT Elindo Buana Prakasa ("Elindo", "we", "us", "our") operates elindo.co.id. This Privacy Policy explains what personal data we collect when you browse, register or buy from us, why we collect it, who we share it with and the rights you have over it.

We act as the data controller for the personal data described here and process it in accordance with Law No. 27 of 2022 on Personal Data Protection (UU PDP) and its implementing regulations.

We collect only what we need to run the store and fulfil your orders:

• Account data: full name, email, phone or WhatsApp number, company name if you give one, and password (stored only as a one-way hash).
• Order data: items purchased, order number, order history, delivery address, delivery contact, notes you add to an order and invoice details.
• Tax data: your company NPWP, when you provide it, so we can issue a faktur pajak in your company's name.
• Payment data: bank transfer reference and proof of payment you send us, the amount and date. If a card gateway is used in future, we receive only the payment status, amount, method type and a transaction reference. We never see or store full card numbers, CVV codes or bank credentials.
• Device and log data: IP address, browser and device type, pages visited and timestamps, collected automatically to keep the site secure and to investigate payment disputes.
• Communications: messages you send us by email, WhatsApp or contact forms, including quote requests.

We use personal data to:

• Create and manage your account and authenticate you when you sign in
• Process orders, take payment, arrange delivery and provide after-sales support
• Issue invoices, delivery orders and tax documents, and keep the accounting records the law requires
• Respond to quote requests and questions about products or orders
• Send transactional emails such as order confirmations, payment receipts and delivery updates
• Detect and prevent fraud, abuse and unauthorised access, and keep evidence to resolve payment disputes and chargebacks
• Improve the website, product range and service based on how the site is used
• Meet legal obligations, including tax, accounting and lawful requests from authorities

We do not sell personal data and we do not send marketing messages unless you ask for them. You can withdraw from any marketing at any time.

Under UU PDP we rely on the following bases:

• Performance of a contract: processing needed to fulfil your order and operate your account
• Legal obligation: tax, accounting and record-keeping requirements under Indonesian law
• Legitimate interests: securing the site, preventing fraud, defending payment disputes and improving our service, balanced against your rights
• Consent: where you opt in to optional communications, or where the law requires consent for a specific use

We share personal data only with providers that help us run the store, and only what each provider needs:

• Banks and, if enabled later, a licensed payment gateway, to receive payments and handle refunds
• Couriers and freight partners, to deliver your goods: name, phone, address and order reference
• Hosting and database providers: Vercel (application hosting) and Supabase (database and authentication), which store data on our behalf under contract
• Email delivery provider, to send transactional emails about your account and orders
• Manufacturers or authorised service centres, when you make a warranty claim on a product we supplied
• Professional advisers, auditors and authorities where the law requires or allows it

Some of these providers store or process data outside Indonesia. Where that happens we rely on the provider's contractual commitments and security certifications, consistent with the cross-border transfer requirements of UU PDP.

Account data is kept while your account is active and deleted or anonymised within 90 days of a verified deletion request, except where we must keep it longer.

Order, invoice and payment records are kept for at least 10 years to meet Indonesian tax and accounting requirements and to defend legal claims.

Device and log data used for security and dispute evidence is kept for up to 24 months, then deleted or aggregated.

All traffic to the site is encrypted with TLS. Passwords are hashed, database access is restricted by row-level security so each customer can read only their own records, and administrative access is limited to authorised staff with individual credentials.

We do not collect payment card data. Bank transfer proofs are stored with the order record.

No system is perfectly secure. If we discover a breach that affects your personal data we will notify you and the relevant authority as UU PDP requires, within 3 x 24 hours of becoming aware of it.

Under UU PDP you have the right to:

• Access the personal data we hold about you and know how it is used
• Correct inaccurate or incomplete data (you can edit most account details yourself under My account)
• Request deletion of your data, subject to records we must keep by law
• Withdraw consent where processing is based on consent
• Object to or restrict processing in certain circumstances
• Receive a copy of your data in a commonly used format
• Lodge a complaint with the Indonesian personal data protection authority

To exercise any of these rights, email admin.elindobp@gmail.com from the address on your account. We respond within 3 business days and complete verified requests within 30 days.

We use strictly necessary cookies to keep you signed in, remember your cart and protect forms from abuse. These cannot be switched off without breaking the site.

We may use privacy-respecting analytics to understand which pages are used. Where analytics cookies are not strictly necessary we ask for your consent before setting them. You can clear or block cookies in your browser settings at any time.

Elindo is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with data, contact us and we will delete it.

We may update this policy when our services, providers or the law change. The effective date at the top shows the current version. For material changes we will notify registered customers by email or a notice on the site before the change takes effect.

Data controller: PT Elindo Buana Prakasa

18 Office Park, 12th Floor Unit A & H, Jl. TB Simatupang No. 18, Kebagusan, Pasar Minggu, Jakarta Selatan 12520, Indonesia

Privacy and data requests: admin.elindobp@gmail.com. Phone / WhatsApp: +62 851-2107-8181.