Home / Privacy policy
Privacy policy
How we collect, use and protect your personal data. Last updated: 24 October 2026.
La Gelato respects the privacy of every visitor and customer. This policy explains how personal data is processed on la-gelato.com, in accordance with Law No. 27 of 2022 on Personal Data Protection (UU PDP).
1. Data controller
| Item | Information |
|---|---|
| Operator | SIE YULYANI RN |
| Business status | MSME (micro, small and medium enterprise) |
| Address | Sanggrahan, RT.003/RW.023, Medan, Caturharjo Village, Sleman District, Sleman Regency, Special Region of Yogyakarta 55515, Indonesia |
| contact@lagelatoacademy.com | |
| +62 819 9590 6784 |
2. Data we collect
2.1. Data you give us
- Identity and contact details: name, phone or WhatsApp number, email address
- Order data: delivery and billing address, products ordered, quantities, order notes, shipping method
- Business information (optional): business name and type, city
- Customer account (required to buy): your order history is kept in it
- Communications: WhatsApp messages, emails or forms you send us
2.2. Data collected automatically
- Technical data: IP address, device type, browser, language
- Usage data: pages viewed and links clicked, for analytics only if you accept analytics cookies
- Cookies: see our Cookie policy
2.3. Data we do not keep
- Payment data: online payments are processed by the payment service provider shown at checkout. We do not store your card numbers, bank account details or banking passwords.
- Sensitive data: we do not collect health, biometric, belief or other sensitive data.
3. Purposes
- Processing and shipping orders, including calculating shipping costs and checking the delivery area for 5 L gelato pans
- Communication: order confirmations, questions, customer support
- Customer account: keeping your order history
- Marketing, only with your consent: news about products and promotions
- Improving the website: visit statistics, only with consent to analytics cookies
- Legal compliance: tax and accounting obligations
4. Legal bases
| Purpose | Legal basis (Article 20 UU PDP) |
|---|---|
| Fulfilling orders | Performance of the contract with you |
| Marketing | Your explicit consent, which you can withdraw at any time |
| Keeping tax and accounting records | Legal obligation |
| Visit statistics | Your consent through the cookie settings |
5. Sharing data with third parties
We do not sell your personal data. We only share what is needed with:
- Hostinger (website hosting) and our email service provider (order confirmations)
- The payment service provider (name, amount, order reference) when you pay
- Couriers (name, address, phone number) to deliver your order
- WhatsApp (Meta) if you contact us on WhatsApp
- Google (Google Analytics), only if you accept analytics cookies
- Competent authorities, where required by Indonesian law
6. Transfers outside Indonesia
Some of our service providers are located outside Indonesia (hosting, email, analytics, communication). In line with Article 56 UU PDP, we choose providers that apply an equivalent or higher level of data protection.
7. Retention and security
| Type of data | Retention period |
|---|---|
| Customer account data | While the account is active + 5 years after deletion |
| Transaction data (orders, invoices) | 10 years (Indonesian tax obligations) |
| Marketing data | Until you withdraw your consent |
| Cookies and technical data | 24 months at most |
We apply reasonable security measures: HTTPS encryption, restricted access, regular backups and regular security updates. In the event of a data breach with a significant impact, we inform you and the relevant authorities within 3×24 hours of becoming aware of it (Article 46 UU PDP).
8. Your rights
Under Articles 5–15 UU PDP, you have the right to access your data, correct it, request its deletion (except data we must keep by law), receive it in a structured format, restrict or object to certain processing (especially marketing), withdraw your consent at any time, and not be subject to fully automated decisions.
Send your request to contact@lagelatoacademy.com or WhatsApp +62 819 9590 6784. We reply within 3×24 working hours and fulfil requests within 30 days. You may also lodge a complaint with the Ministry of Communication and Digital Affairs (Komdigi) or the competent personal data protection authority.
9. Children
Our services are not intended for children under 18, and we do not knowingly collect their data.
10. Changes
We may update this policy. The “Last updated” date above shows the latest change.
11. Governing law
This policy is governed by the laws of the Republic of Indonesia, in particular Law No. 27 of 2022 (UU PDP), Law No. 11 of 2008 (UU ITE) as amended by Law No. 19 of 2016, and Law No. 8 of 1999 on Consumer Protection. Disputes are settled amicably, or before the Sleman District Court.
This policy is written in Indonesian as the official language. In case of any difference in interpretation with the English version, the Indonesian version prevails.