Menu
Promotions
About US
EN

Privacy and Cookie Policy

This Privacy Policy explains how PT Tong Garden Food Indonesia ("Tong Garden", "we", "us") collects and uses your personal data when you use our website, mobile pages, customer support and membership programme (the "Platform"). 

This Privacy Policy is a companion to, and should be read together with, our Terms and Conditions. Our company’s registration (NIB), tax ID (NPWP), registered address and general customer-service/complaint contact are set out in the Terms and Conditions and are not repeated here. 

We are the Data Controller (Pengendali Data Pribadi) for your personal data under Law No. 27 of 2022 on Personal Data Protection ("UU PDP"). 

  • Privacy contact: privacy@tonggarden.co.id · 021-38865404
  • Data Protection Officer (if the appointment threshold is met): ): Whindry & Putri/tonggarden.food.indonesia@gmail.com

1. LAWS WE FOLLOW 

We process personal data in line with Law No. 27 of 2022 on Personal Data Protection; Law No. 11 of 2008 on Electronic Information and Transactions, as amended; Government Regulation No. 71 of 2019 on Electronic System and Transaction Operation; Government Regulation No. 17 of 2025 on children’s data protection; and Law No. 8 of 1999 on Consumer Protection. This policy applies to personal data we collect in digital form, or collect offline and later digitize. 

2. WHAT WE COLLECT AND WHY 

We collect only what we need for the purposes below. 

Personal data 

Purpose 

Name, mobile number, email address 

Create and manage your account; send order and delivery updates; customer support 

Delivery and billing address 

Deliver orders; issue receipts/invoices 

Order history, cart and wishlist 

Process orders, returns and refunds; show your past orders 

Payment status and transaction reference 

Confirm payment and process refunds. Card, e-wallet, virtual account and bank details are entered directly with our payment gateway; we do not store them 

Date of birth, gender (optional) 

Birthday offers and membership benefits, only if you choose to provide them 

Membership points and rewards 

Run the loyalty programme 

Messages, calls, reviews and feedback 

Resolve complaints and improve products 

Device, browser, IP address, pages viewed, cookies 

Keep the Platform secure, prevent fraud, fix errors, and (with consent) analytics and advertising 

Marketing preferences 

Send offers by email, SMS, WhatsApp or other channels, only if you opt in 

We do not collect more data than needed for these purposes and will ask for fresh consent before using your data for any new purpose. 

3. YOUR CONSENT 

We process your personal data on the basis of your explicit, informed consent, given by a clear action such as ticking a box or tapping "I agree" and presented separately from other terms, or because processing is necessary to perform your order contract or to comply with Indonesian law. Marketing communications and non-essential cookies have their own separate opt-ins, and you can use the Platform without agreeing to them. 

You can withdraw consent at any time, as easily as you gave it, from My Account > Privacy settings or by writing to privacy@tonggarden.co.id. Withdrawal does not affect processing already done. If you withdraw consent needed for an order, we may be unable to complete it. 

4. WHO WE SHARE DATA WITH 

We do not sell your personal data. We share it only with: 

  • Service providers (Data Processors) acting on our instructions under a written contract: payment gateways, courier and logistics partners, SMS/email/WhatsApp provider, and analytics providers. 
  • Government agencies and courts, when required by Indonesian law. 

Each processor may use your data only to provide its service to us. 

5. COOKIES AND SIMILAR TECHNOLOGIES 

We use cookies to run the Platform. 

  • Essential cookies keep you logged in and remember your cart. These are always on. 
  • Analytics cookies help us understand how the Platform is used. These are on only with your consent. 

You can change your choice at any time through [Cookie settings] at the bottom of every page, or through your browser. 

6. HOW LONG WE KEEP YOUR DATA 

We keep personal data only while it is needed for its purpose, then erase or anonymize it unless the law requires us to keep it. 

Data 

Retention 

Account data 

While your account is active. If there is no activity for 3 years, we will erase it after giving you notice 

Orders and tax invoices 

10 years, to meet General Provisions and Tax Procedures Law record-keeping rules 

Marketing preferences 

Until you withdraw consent 

Support records 

2 years after the issue is closed 

Security and access logs 

1 year 

7. HOW WE PROTECT YOUR DATA 

We use reasonable security safeguards, including encryption in transit (HTTPS/TLS), encryption or masking of stored data where appropriate, role-based access controls, access logging and monitoring, and regular backups. Our processors must maintain equivalent safeguards. 

If a personal data breach occurs, we will notify the supervisory authority (currently the Ministry of Communication and Digital Affairs, Komdigi) and affected individuals within 3x24 hours (72 hours) of becoming aware, explaining what happened, the likely impact, and what you can do. Where a breach disrupts public services or significantly affects the public interest, we will also make a public notification as required by law. 

8. YOUR RIGHTS 

Under the UU PDP you can: 

  1. Access information about, and request a copy of, the personal data we hold about you. 
  2. Correct inaccurate or incomplete data. 
  3. Erase your data when it is no longer needed, or consent is withdrawn. 
  4. Port your data to another controller in a machine-readable format, where technically possible. 
  5. Withdraw consent at any time. 
  6. Object to processing, including for direct marketing. 
  7. Refuse decisions based solely on automated processing, including profiling, that produce legal effects on you. 
  8. Delay or restrict processing while a request is being verified. 
  9. Complain and seek compensation, including to the supervisory authority or through civil action, if you believe we have not complied with the UU PDP. 

To use these rights, go to My Account > Privacy or email privacy@tonggarden.co.id. We may ask you to verify your identity. We aim to respond within 30 days. 

9. MINORS 

We treat anyone under 18 years of age as a child under Government Regulation No. 17 of 2025 and require verifiable consent from a parent or legal guardian before processing a child’s personal data. We do not knowingly build behavioural profiles of children or collect detailed geolocation data from them, and default privacy settings for anyone identified as a child are set to the most protective option. Who may place an order on the Platform is set out in our Terms and Conditions. If you believe a child’s data reached us without the required consent, contact us and we will delete it. 

10. DATA STORED OUTSIDE INDONESIA 

Some service providers may store or process data outside Indonesia. Where we transfer personal data abroad, we first check that the destination has data protection at least equivalent to the UU PDP; where it does not, we put binding contractual safeguards in place, or rely on your explicit consent for that specific transfer. 

11. CHANGES TO THIS POLICY 

We may update this policy when our practices or the law change. We will post the new version here with a new "Last updated" date. For material changes, we will notify you by email or on the Platform and ask for fresh consent where required. 

12. CONTACT US 

For any complaint or question about your personal data, please contact the privacy contact above, or the customer-service contact published in our Terms and Conditions. You may also lodge a complaint with Indonesia’s personal data protection supervisory authority.