This policy explains what personal data PESO collects through pesobali.com, why we collect it, who we share it with, how long we keep it, and what you can ask us to do with it. It is written to meet Law No. 27 of 2022 on Personal Data Protection (Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi, the “PDP Law”) and Government Regulation No. 71 of 2019 on the Implementation of Electronic Systems and Transactions.
1. Who we are
PESO is an all-day restaurant and cocktail lounge preparing to open in Bingin, Uluwatu. For the purposes of the PDP Law we are the Personal Data Controller (Pengendali Data Pribadi) for the data described here.
- Trading name: PESO Bali
- Address: Jl. Buana Sari, Pecatu, Kec. Kuta Sel., Kabupaten Badung, Bali 80361, Indonesia
- Contact for privacy matters: contact@pesobali.com
2. What we collect
Data you give us
- Mailing list signup: your first name, last name and email address.
- Email and enquiries: anything you choose to send us at contact@pesobali.com, including your name, email address and the content of your message.
Data collected automatically
- Technical data: IP address, approximate location derived from it, browser and device type, operating system, and referring website.
- Usage data: pages viewed, time on page, links clicked, and how you arrived at the site.
- Cookies and similar identifiers set by the analytics and advertising tools listed in section 4.
We do not ask for and do not knowingly collect any of the categories the PDP Law treats as specific personal data, such as health information, biometric data, genetic data, financial account data, religious beliefs, political views, sexual orientation or criminal records. Please do not send these to us.
3. Why we use it, and our legal basis
Article 20 of the PDP Law requires us to name a lawful basis for every purpose.
| What we do | Data used | Legal basis |
|---|---|---|
| Send you email updates about the opening | Name, email address | Your consent, given when you join the list. You may withdraw it at any time. |
| Reply to your enquiry | Name, email, message content | Your consent, and our legitimate interest in answering people who contact us. |
| Measure how the site is used and improve it | Technical and usage data | Our legitimate interest in running and improving the site. |
| Measure and target our advertising | Technical and usage data, cookie identifiers | Our legitimate interest in reaching a relevant audience. You can opt out as described in section 5. |
| Keep the site secure and prevent spam and abuse | Technical data | Our legitimate interest in protecting the site, and our legal obligations. |
We do not sell your personal data, and we do not use it to make automated decisions that produce legal or similarly significant effects.
4. Who we share it with
We do not sell or rent your data. We do use service providers who process personal data on our behalf as Personal Data Processors (Prosesor Data Pribadi). Each is bound to use the data only for the purpose we set.
| Provider | What it does | Where it processes data |
|---|---|---|
| Klaviyo | Stores our mailing list and sends our emails | United States |
| Google (Analytics, Tag Manager) | Website analytics and tag delivery | United States and other countries |
| Meta Platforms (Pixel, Conversions API) | Advertising measurement and audiences | United States and Ireland |
| Cloudflare | Hosting, content delivery, security | Global network, including Singapore and the United States |
| Hostinger | Our contact@pesobali.com email | European Union |
We may also disclose personal data where we are required to by Indonesian law, by a court, or by a competent authority, or where it is necessary to establish, exercise or defend a legal claim.
5. Cookies and tracking
The site uses cookies and similar identifiers for two things: understanding how the site is used, and measuring our advertising. You can control them in several ways.
- In your browser: block or delete cookies through your browser settings. The site will still work.
- Google Analytics: install the Google Analytics Opt-out Browser Add-on.
- Meta: adjust your ad preferences in your Facebook or Instagram settings.
6. Sending data outside Indonesia
Several of the providers in section 4 process data outside Indonesia. Article 56 of the PDP Law permits this where the receiving country provides a level of protection at least equivalent to the PDP Law, or where there are adequate and binding safeguards in place, or where you have consented to the transfer.
We rely on the contractual data protection terms these providers offer, including standard contractual clauses where they are available. By joining our mailing list you also consent to your name and email address being stored and processed by Klaviyo in the United States for that purpose.
7. How long we keep it
- Mailing list data: until you unsubscribe or ask us to delete it, and then removed from our active list promptly. We may keep a minimal record of the unsubscribe itself so we do not email you again by mistake.
- Email correspondence: up to two years after our last exchange, unless we need to keep it longer for a legal reason.
- Analytics and advertising data: held by the providers above under their own retention settings, generally between two and 14 months.
When data is no longer needed for the purpose it was collected for, we delete or anonymise it.
8. Your rights
Under Articles 5 to 15 of the PDP Law you have the right to:
- Be told who is processing your data, why, and on what basis.
- Access your personal data and receive a copy of it.
- Have inaccurate or incomplete data corrected or updated.
- Have your personal data erased or destroyed.
- Withdraw your consent at any time, which stops any processing that relied on it.
- Object to processing, and to object to decisions made solely by automated means.
- Delay or restrict processing in the circumstances the PDP Law allows.
- Receive your data in a structured, commonly used format and have it transferred to another controller, where technically possible.
- Bring a claim and seek compensation for a breach of your data protection rights.
To exercise any of these, email contact@pesobali.com. We will respond within three days of receiving your request, as required by the PDP Law, and we may ask you to confirm your identity first. For our emails, the fastest route is the unsubscribe link at the bottom of any message.
9. Keeping it safe
We use HTTPS across the whole site, we keep access to the mailing list limited to the people who need it, and we rely on providers who maintain recognised security standards. No system is perfectly secure, but we take reasonable and proportionate steps to protect your data against loss, misuse and unauthorised access.
10. If something goes wrong
If a personal data breach occurs, Article 46 of the PDP Law requires us to notify the affected individuals and the relevant authority within 3 x 24 hours of becoming aware of it. Our notice will describe what data was involved, when and how it happened, and what we are doing about it.
11. Children
This site and our mailing list are intended for people aged 18 and over. We do not knowingly collect personal data from children. Under the PDP Law, processing a child's data requires the consent of a parent or guardian. If you believe a child has given us their details, email us and we will delete them.
12. Changes to this policy
We will update this page as PESO opens and as our tools change, and the date at the top will always show the current version. If a change materially affects how we use data you have already given us, we will tell you by email before it takes effect.
13. Contact and complaints
For any question about this policy or about your data, email contact@pesobali.com.
If you are not satisfied with our response, you may raise the matter with the Indonesian authority responsible for personal data protection. At the time of writing, oversight sits with the Ministry of Communication and Digital Affairs (Kementerian Komunikasi dan Digital) pending the establishment of the dedicated supervisory body provided for in the PDP Law.