Privacy Policy

1. Data we collect

• Order data: your name, phone number, email address (if provided), delivery address and map location, delivery notes, the items ordered and the order total.
• Account data, if you create an account: name, email address, password (stored only as a cryptographic hash), saved addresses and order history.
• Payment data: the amount, currency, payment status and the identifier returned by the payment provider. Card numbers and other payment credentials are entered on the provider's side and never reach our servers.
• Loyalty data, if you join the loyalty programme: your Telegram identifier and the number of purchases counted towards a reward.
• Technical data: IP address, browser type, pages viewed and cookies needed for the cart and the session to work.

We do not knowingly collect data from persons under the legal age for buying tobacco products, and we do not collect sensitive personal data such as health, religion or biometric data.

2. Why we use it

• To accept, prepare, confirm and deliver your order, and to contact you about it.
• To calculate the delivery price from the road distance between our shop and your address.
• To process your payment and to handle refunds and chargebacks.
• To meet the age-verification requirement that applies to online sale of tobacco products in Indonesia.
• To keep accounting and tax records as required by Indonesian law.
• To run the loyalty programme, if you have joined it.
• To detect and prevent fraud and abuse of the Website.

3. Legal basis

We process your data to perform the sales contract with you, to comply with our legal obligations (tax records and age restrictions on tobacco), and, for the loyalty programme and optional messages, on the basis of your consent, which you may withdraw at any time.

4. Who we share data with

• Our shop staff and couriers in Bali, who receive the name, phone number, address and contents of the order in order to deliver it. Order details are passed to our Canggu shop through WhatsApp.
• The licensed Indonesian payment provider that processes your online payment.
• Google Maps Platform, used for address suggestions and for calculating the road distance for the delivery price.
• Our hosting and infrastructure providers, which store the website data on our behalf.
• The Telegram loyalty bot, if you have joined the loyalty programme.
• Government authorities, when disclosure is required by Indonesian law.

We do not sell your personal data and we do not share it with third parties for their own advertising.

5. How long we keep it

• Order and payment records: for as long as required by Indonesian accounting and tax rules.
• Account data: until you ask us to delete the account.
• Loyalty data: until you leave the programme.
• Technical logs: normally a short period, sufficient for security and troubleshooting.

6. Your rights

You may ask us to give you access to your data, correct it, delete it, restrict its use, withdraw a consent you have given, or provide it in a portable form. Contact us and we will answer within a reasonable period.

Requests: tokohookahbali@gmail.com or WhatsApp +62 811 3960 5463.

7. Cookies

The Website uses cookies that are necessary for it to work: keeping your cart, your session and your region. You can delete cookies in your browser, but parts of the Website — the cart and checkout in particular — may then stop working correctly.

8. Security

The Website is served over an encrypted HTTPS connection with a valid TLS certificate. Access to order data is limited to the staff who need it for their work. Payment credentials are handled entirely by the payment provider.

9. Changes to this policy

We may update this policy. The current version is always published on this page, with the date of the last update at the top.

10. Contact

• Data controller: CV Global Raya Trading
• Address: Jalan Canggu Padang Linjong No. 53A, Desa Canggu, Kec. Kuta Utara, Kab. Badung, Bali, Indonesia
• Email: tokohookahbali@gmail.com
• WhatsApp: +62 811 3960 5463