Privacy
policy.

1. Who we are

The "controller" (Pengendali) of personal data processed through this site is Amberlyn Living, Jl. Parakan No.56, Pondok Benda, Pamulang, Tangerang Selatan 15416, Banten, Indonesia. For data-protection questions, write to sale@amberlynliving.com.

2. What data we collect

We collect only what we need to run the workshop and serve our customers. Categories:

• Contact form submissions: name, organisation (optional), email, phone (optional), reason for writing, timeline preference, message, and a record of your consent to this policy.
• Order and shipping data: full name, billing and shipping address, phone, email, payment confirmation (we never see full card numbers), order history, and any warranty or after-sales records.
• Newsletter sign-ups: email address and the quarter of sign-up.
• Workshop visit bookings: name, phone, party size, preferred date.
• Technical data from the website: IP address, browser type, language, device type, and the preference stored in our single first-party cookie (see the cookie policy).
• Saved profile (optional): if you use the Save my details on this device feature, your name, email, optional phone and optional shipping address are stored in your own browser under al_profile. This data never leaves your device — we have no server-side copy of it. The contact form and the inquiry email use it to pre-fill, but only if you press the relevant send button. You can clear it from account.html at any time, or by clearing your browser's site data.
• Inquiry cart (optional): if you use the cart, the items you've shortlisted (id, name, unit price, category, quantity) are stored in your own browser under al_cart. The data never leaves your device until you press Send inquiry, at which point your email client opens a message pre-filled with that list and the email is sent from your account, not from our server.

3. Why we use it (legal basis)

We process your data only where we have a valid legal basis under Article 6 of UU PDP No. 27/2022 (which aligns with the international standard of consent, contract, legal obligation, vital interest, public task, or legitimate interest):

Purpose	Legal basis
Responding to your enquiry or order.	Consent (you send the message / place the order) and the need to take steps at your request before entering a contract.
Shipping and delivering your order.	Performance of a contract with you.
Warranty and after-sales service.	Performance of a contract; legal obligation under consumer-protection law.
Sending the quarterly newsletter.	Consent (you ticked the newsletter box).
Keeping the website running and remembering your cookie preference.	Legitimate interest in delivering a functional service.
Tax, accounting and customs records.	Legal obligation under Indonesian tax and trade law.

4. How long we keep it

We keep personal data only as long as we need it for the purpose we collected it for, or as required by Indonesian law (typically 10 years for accounting and tax records, 5 years for consumer-contract records). Order and warranty records are kept for the duration of the warranty plus the legally required retention period. Newsletter sign-ups are kept until you unsubscribe. Contact-form drafts (in localStorage on your own device) are removed when you submit the form or clear your browser storage.

Cart contents (al_cart) and the saved profile (al_profile) are kept only in the user's browser — we have no server-side copy of either. They are removed when the user clears the cart or profile via the controls on cart.html and account.html, when the user submits an inquiry (cart only), or when the user clears their browser's site data.

5. Who we share it with

We do not sell personal data. We share it only with the parties that need it to serve you:

• Freight forwarders and couriers — so your order can be delivered. They receive name, address, phone and email.
• Payment processor — to take payment. We never see full card numbers.
• Hosting provider and email service — to keep the website and email running. They act as data processors under written contracts aligned with Articles 51–52 of UU PDP.
• Authorities — only when required by law (tax, customs, court order).

6. International transfers

Some of the parties above may be located outside Indonesia. Where we transfer your data abroad, we ensure an adequate level of protection — either because the destination has been deemed adequate by the Indonesian government, or because we have put in place the standard contractual clauses or equivalent safeguards required by UU PDP Article 56. In particular, our hosting and email services are based in Singapore and Germany; our payment processor operates globally under PCI-DSS standards.

7. Security

We protect personal data with a mix of technical and organisational measures: HTTPS encryption for the website, access controls on workshop computers, role-based access for any employee who handles customer data, secure disposal of devices at end of life, and regular review of the third parties who hold our data. No system is perfect; if we ever have a personal-data breach that is likely to result in a risk to your rights, we will notify you and the Indonesian data-protection authority in line with Article 46 of UU PDP.

8. Your rights

Under UU PDP and, where applicable, the EU GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — have inaccurate or incomplete data corrected.
• Deletion — ask us to delete your data, where we no longer have a valid reason to keep it.
• Restriction — ask us to pause processing while a question is resolved.
• Objection — object to processing based on legitimate interest.
• Portability — receive your data in a structured, commonly used format.
• Withdraw consent — at any time, where processing is based on consent.
• Lodge a complaint — with the Indonesian data-protection authority once it is operational, or with your local authority if you are based outside Indonesia.

To exercise any of these rights, write to sale@amberlynliving.com with enough information for us to identify you. We respond within 14 working days; complex requests may take up to 30 days, in which case we will tell you why.

9. Specific features

Contact form: required fields are marked with an asterisk. Drafts are stored locally in your browser under the key al_intake_draft so you can return to the form without losing your work. Drafts are removed when you submit the form or clear your browser storage.

Newsletter: only sent to people who have explicitly subscribed. Each newsletter includes an unsubscribe link; one click and you are off the list.

Embedded third-party content: this site does not embed third-party widgets, fonts loaded from external servers, or analytics scripts. The only external resource is Google Fonts, which in modern browsers does not place cookies.

10. Children's data

This site and our products are aimed at adults. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided data through this site, write to sale@amberlynliving.com and we will delete it promptly.

11. Changes and contact

We may update this policy from time to time to reflect changes in law or in how we work. The "Effective" date at the top tells you when the current version came into force. For any question about this policy, write to sale@amberlynliving.com.