Privacy notice

Last updated 8 November 2026

1. 1Who is responsible

   • marlmarl.id is responsible for the personal data you give us when you order.
   • Office address: Wisma Bumiputera Lt. 18-02, Jl. Jend. Sudirman Kav. 75, Setiabudi, Jakarta Selatan 12910
   • Contact: Instagram @marlmarl.id · WhatsApp +62 817-0230-599

2. 2What we collect

   • Your name and WhatsApp number; the recipient's name and phone number if you send to someone else; the delivery address; your note; the name on the sending account and the transfer receipt, if you give them; and whether you'd like news of new arrivals.
   • If we owe you a refund: the bank, account number and account holder you send us, used only to transfer it.
   • If you order or ask through Instagram or WhatsApp: your Instagram username or WhatsApp number, and the messages you send, including the name, phone number and address for your order.
   • We don't ask for your email, ID number or card details.
   • To stop abuse, we keep a scrambled code made from your internet address for up to 7 days.
   • Your basket, an unsent checkout form, links to your recent orders and your language choice are kept only in your own browser. We use no advertising or tracking cookies.

3. 3Why we use it (Law 27/2022 on Personal Data Protection)

   • To deliver your order and help you with it (our contract with you).
   • To keep the bookkeeping records the law requires (a legal obligation).
   • To keep the shop safe from abuse (a legitimate interest).
   • To send you news of new arrivals on WhatsApp, only if you tick the box (your consent, which you can withdraw at any time).

4. 4Who sees it

   • Our team.
   • The courier delivering your order receives the recipient's name, phone number and address.
   • Our order system is hosted by Supabase and Vercel, on servers in Singapore.
   • Instagram and WhatsApp (Meta) handle the messages you send us there.
   • We never sell your data.

5. 5How long we keep it

   • Records of paid orders (what you bought, the amount, your name and the payment) for 10 years, as tax law requires for bookkeeping. Delivery details are hidden from your order page 30 days after delivery.
   • Orders that are never paid: your details are deleted 30 days after the order is cancelled.
   • Transfer receipts: 90 days after payment, or 30 days after an unpaid order is cancelled.
   • The scrambled internet-address code for up to 7 days.
   • Your consent to news until you withdraw it.

6. 6Your rights

   • You can ask to see, correct or update your data, ask us to delete or stop using it where the law allows, withdraw your consent, and get a copy.
   • Message us on Instagram or WhatsApp; we act on your request within 72 hours. If your data is misused, you also have the right to take legal action and claim compensation under Law 27/2022.

7. 7Your order link

   • Your order page has a private link: anyone with the link can see the order, so please don't share it. If you think someone else has it, message us and we'll replace it with a new one.
   • If your data were ever exposed, we would tell you within 72 hours.

8. 8Children

   • We don't ask for children's details.

9. 9Changes

   • We may update this notice; the date above shows the current version.