BODYPACK PRIVACY AND PERSONAL DATA PROTECTION POLICY

Draft for the Bodypack international website | Last updated: 27 August 2026

1. Introduction

PT Dua Puluh Tiga, conducting its business activities under the brand Bodypack, respects and is committed to protecting the privacy and Personal Data of customers, website users, store visitors, partners, and other parties who interact with Bodypack.

This Privacy and Personal Data Protection Policy ("Policy") explains how Bodypack collects, obtains, uses, records, stores, updates, analyzes, discloses, transfers, deletes, and/or destroys Personal Data.

In this Policy, the following terms shall have the meanings defined below:

“Bodypack”, “we”, “us”, or “our” means PT Dua Puluh Tiga;
“You” or “your” means the individual whose Personal Data is processed by Bodypack;
“Personal Data” means data about an identified or identifiable individual, whether directly or indirectly, individually or in combination with other information;
“Processing” means any operation or set of operations performed on Personal Data, including collection, recording, storage, usage, analysis, disclosure, transfer, deletion, and destruction; and
“Personal Data Controller” means the party that determines the purposes and exercises control over the Processing of Personal Data.

By using the website, creating an account, conducting transactions, contacting customer service, visiting physical stores, participating in Bodypack programs, or providing Personal Data through any Bodypack channel, you acknowledge and understand that your Personal Data will be processed as described in this Policy.

This Policy is not intended to limit or diminish your statutory rights under applicable laws and regulations.

2. Identity of the Personal Data Controller

For the Processing activities described in this Policy, the Personal Data Controller is:

PT Dua Puluh Tiga

Jl. Kopo Bihbul Raya No. 68 Sayati, Kecamatan Margahayu, Kabupaten Bandung Jawa Barat 40228, Indonesia Email: connect@bodypack.com WhatsApp: +62 811-1182-6362 Operational Hours: Monday–Friday, 09:00–17:00 WIB

3. Scope of the Policy

This Policy applies to all Personal Data processed through:

the official Bodypack website;
customer account management and online checkout pages;
Bodypack physical retail stores and in-store operations;
Customer Service interactions via email, WhatsApp, telephone, or other channels;
transactions conducted on the website, physical stores, e-commerce marketplaces, or other sales channels;
promotional programs, vouchers, giveaways, surveys, events, or community activities;
product return, exchange, repair:;
corporate orders and business-to-business (B2B) transactions;
Bodypack social media accounts and digital marketing campaigns;
online and offline forms;
Closed-Circuit Television (CCTV) recordings at specified physical locations; and
any other interaction between you and Bodypack.

When you complete transactions through third-party marketplaces or external platforms, those platform operators may act as independent Personal Data Controllers governed by their respective privacy policies.

4. Personal Data We Collect

The specific types of Personal Data we collect depend upon the nature and scope of your interaction with Bodypack.

4.1 Identity and Contact Data

This category includes:

full name and preferred name/alias;
email address and telephone / WhatsApp number;
billing address and shipping address (including street name/number, city, province/state, and postal code);
gender and date of birth; and
other relevant contact information.

4.2 Account Data

If you register an account with us, we may collect:

username, registered email address, and phone number;
passwords stored in a secured and encrypted format;
account preferences, login history, account status, and activity logs.

You remain strictly responsible for maintaining the confidentiality of your account credentials, passwords, and One-Time Password (OTP) security codes.

4.3 Transaction and Purchase Data

Transaction records may include:

order numbers, details of purchased items (quantity, size, color, variant);
transaction values, discounts applied, or promotional vouchers utilized;
date, time, and location of transactions, along with purchase history;
return or exchange records, payment status, payment method, payment reference numbers, and proof of purchase.

4.4 Payment Data

Payments are processed through authorized financial entities, banks, payment gateways (including Midtrans and Xendit), e-wallet providers, or paylater services.

Bodypack generally receives only essential payment confirmation metadata, such as payment status, payment method, payer name, masked card/account details, and transaction reference numbers.

Bodypack does NOT collect or store sensitive authentication data such as PINs, OTP codes, CVV/CVC numbers, or full payment card numbers. All such information must be entered directly into authorized payment service systems.

4.5 Delivery and Fulfillment Data

Fulfillment data includes recipient name, contact number, destination address, selected store pickup location, scheduled delivery times, delivery notes, consignment tracking numbers, shipment status, proof of delivery, and operational communications with courier partners.

If you supply Personal Data of a third-party recipient, you confirm that you possess a lawful basis to share such data with Bodypack.

4.6 Customer Service, Return, and Warranty Data

This includes communication records, order references, recorded customer inquiries or complaints, product photographs/videos, packaging labels, proof of purchase, return shipment addresses, technical inspection findings, repair records, warranty claim files, and resolution logs.

4.7 Corporate Order and Business Partner Data

For corporate purchasing or commercial partnerships, we process company names, representative names and designations, corporate addresses, office contact details, Tax Identification Numbers (NPWP) or tax documentation, purchase orders, contracts, billing data, artwork/logos, and business correspondence.

4.8 Device and Technical Usage Data

When accessing our website or digital systems, we automatically collect Internet Protocol (IP) addresses, browser type and version, device identifiers, operating system details, device language, access dates/timestamps, viewed pages, referring URLs, clickstream patterns, search queries, cart additions, session identifiers, approximate location (IP-derived), crash reports, and system security logs.

Such technical data constitutes Personal Data whenever it directly or indirectly identifies an individual.

4.9 Marketing and Preference Data

We may collect communication preferences, newsletter subscriptions, engagement metrics with promotional emails, campaign responses, interest tags, voucher usage logs, event participation data, and cookie preference settings.

4.10 Social Media and User-Generated Content

When you tag, mention, message, or interact with Bodypack on social platforms, we may receive your handle, profile name, profile image, comments, direct messages, media uploads, product reviews, and public information based on your account privacy settings.

4.11 CCTV Footage

Physical stores, offices, distribution warehouses, and operational premises utilize CCTV surveillance systems for safety, loss prevention, security monitoring, incident investigation, and protection of visitors and staff.

5. Sources of Personal Data

Bodypack collects Personal Data directly from you, as well as from third parties and secondary sources including:

individuals placing orders or sending gifts on your behalf;
organizations or corporate entities designating you as a point of contact;
Bodypack retail stores, Customer Support, and official digital touchpoints;
e-commerce marketplaces, authorized sales agents, and distribution partners;
payment gateways, financial institutions, and logistics/courier providers;
analytics platforms, advertising technology networks, and social media platforms;
co-branding partners, event organizers, and other legally permissible sources.

6. Purposes of Processing Personal Data

Bodypack processes Personal Data for legitimate operational and business purposes, specifically to:

register, manage, and secure customer user accounts;
verify user identity and account information;
process, fulfill, track, and manage customer orders and inventory allocations;
verify, record, and process financial transactions;
dispatch products or facilitate in-store pickup;
send transaction-related notifications, updates, and receipts;
deliver personalized user experiences and customized recommendations;
address inquiries, resolve customer complaints, process returns, exchanges, and refunds;
administer product after-sales customer care;
execute B2B corporate sales and contractual agreements;
issue tax invoices and official accounting documentation;
detect, prevent, and investigate fraud, security breaches, unauthorized transactions, or account abuse;
maintain physical security, system integrity, and IT network operations;
conduct promotional campaigns, voucher distributions, giveaways, and community events;
deliver marketing and promotional communications in accordance with your preferences;
evaluate and optimize website functionality, marketing efficacy, and service quality;
conduct internal auditing, financial reporting, risk management, and administrative analysis;
comply with statutory tax, accounting, consumer protection, and regulatory mandates;
manage legal disputes, defend claims, and comply with lawful orders from administrative or judicial authorities.

7. Legal Grounds for Processing Personal Data

Bodypack processes Personal Data strictly based on one or more of the following lawful bases:

7.1 Performance of a Contract

Processing is necessary to fulfill a contract to which you are party, or to take pre-contractual steps at your request (e.g., fulfilling purchase orders, handling payment, shipping items, managing returns, or servicing warranty obligations). Failure to provide required data may prevent us from fulfilling our contractual duties.

7.2 Legal Obligation

Processing is necessary to comply with legal, statutory, tax, accounting, audit, consumer protection, or regulatory reporting obligations mandated by applicable laws.

7.3 Consent

We process data based on your explicit consent for specific activities, including newsletter subscriptions, direct marketing communications, voluntary survey participation, specific analytics/advertising cookies, and public display of user content. You retain the right to withdraw consent at any time.

7.4 Legitimate Interests

Processing is conducted to pursue legitimate business interests, provided such interests are balanced against and do not override your fundamental rights and freedoms. Examples include system security, fraud prevention, business operations, service optimization, and legal defense.

7.5 Vital Interests or Other Statutory Grounds

In exceptional circumstances, data may be processed to protect the vital life or safety interests of an individual, or pursuant to other explicit statutory provisions.

8. Mandatory and Optional Data

At the point of collection, Bodypack indicates whether requested data fields are mandatory or optional.

Failure to provide mandatory data (e.g., delivery address for an online purchase) will render Bodypack unable to process your request or complete the transaction. Optional data fields (e.g., marketing preferences or surveys) may be left blank without affecting your ability to purchase products.

9. Cookies and Tracking Technologies

Bodypack utilizes cookies, web beacons, pixels, software development kits (SDKs), and local storage technologies to ensure platform functionality, remember preferences, enhance security, analyze traffic, and deliver tailored advertising.

Cookies deployed on our platform are classified into:

• Essential Cookies: required strictly for basic website navigation, account authentication, and shopping cart functionality;
• Preference Cookies: store custom user choices such as language settings or regional preferences;
• Analytics Cookies: collect anonymous operational performance metrics to help us optimize platform usability;
• Advertising / Marketing Cookies: track interactions across web properties to deliver relevant ad content.

Non-essential analytics and advertising cookies are activated based on user choices or consent where mandated. You may adjust your browser or device cookie settings at any time; however, disabling essential cookies may impact site performance.

10. Marketing Communications

Subject to your explicit consent, Bodypack may send promotional updates regarding new product launches, exclusive discounts, event invitations, customer surveys, and curated content.

You may opt out of marketing communications at any time by clicking the 'Unsubscribe' link embedded in our emails, replying with opt-out keywords, modifying your account settings, or contacting Customer Service. Opting out of marketing messages does not stop non-promotional transactional communications (e.g., order tracking or security alerts).

11. Automated Decision-Making and Profiling

Bodypack may analyze customer interaction data, purchase history, and technical metrics to segment user groups, customize product recommendations, and prevent fraudulent transactions.

We do not engage in automated decision-making or profiling that produces legal effects or similarly significant consequences for you without appropriate legal safeguards. You retain the right to object to automated processing having significant effects.

12. Disclosure and Sharing of Personal Data

Bodypack does NOT sell Personal Data. We may disclose or provide controlled access to Personal Data strictly to authorized recipients on a need-to-know basis, including:

corporate affiliates and subsidiary business units within our group;
cloud hosting, IT infrastructure, and e-commerce platform providers;
payment service providers, acquiring banks, and financial institutions;
third-party logistics providers, courier services, and fulfillment centers;
POS, ERP, CRM, OMS, and inventory management software vendors;
Customer Service and communication gateway platforms (e.g., email, SMS, WhatsApp);
analytics, marketing performance, and security auditing vendors;
professional advisers, including lawyers, auditors, tax consultants, and insurers;
regulatory bodies, law enforcement agencies, and courts as mandated by statutory process;
prospective buyers or investors in the event of a corporate restructuring or asset sale.

All data processors acting under Bodypack's instructions are bound by strict contractual confidentiality, security obligations, and explicit restrictions limiting data usage strictly to specified tasks.

13. Third-Party Marketplaces and Platforms

When purchasing Bodypack products through third-party e-commerce marketplaces, those external platforms handle your data in accordance with their independent privacy notices. Bodypack receives only necessary transaction data to fulfill orders, handle returns, and provide customer support.

14. Cross-Border Data Transfers

Certain technology vendors, cloud providers, and analytics services utilized by Bodypack operate servers located outside Indonesia. In such instances, Bodypack ensures that cross-border transfers comply with statutory protection requirements, including verifying equivalent jurisdictional protections, executing standard contractual clauses, or securing explicit data subject consent where applicable.

15. Data Retention

Bodypack retains Personal Data only for as long as necessary to fulfill the operational purposes for which it was collected, enforce contractual agreements, satisfy accounting/tax retention laws, and resolve potential disputes. Upon expiry of retention periods, data is securely erased, destroyed, or irreversibly anonymized.

16. Technical and Organizational Security Measures

Bodypack implements rigorous administrative, physical, and technical safeguards to protect Personal Data against loss, unauthorized access, alteration, or disclosure. Safeguards include:

strict role-based access control policies restricting data access to authorized personnel;
data encryption standard protocols for sensitive transmissions and storage;
multi-factor authentication and robust password policies for administrative systems;
continuous operational logging, vulnerability scanning, and routine data backups;
employee data privacy training and mandatory confidentiality covenants;
rigorous vendor security risk assessments and continuous system maintenance.

While we apply industry-standard security practices, no electronic transmission or storage system is entirely immune from risk. Users are advised to safeguard their credentials and notify us immediately of any suspected account compromise.

17. Incident Management and Data Breach Notification

In the event of a confirmed or suspected Personal Data breach impacting confidentiality or integrity, Bodypack will initiate immediate containment, mitigation, and forensic investigation protocols.

Where required by applicable law (including Indonesian PDP Law), written notification will be issued within 72 hours (3 × 24 hours) to affected Data Subjects and competent regulatory authorities, outlining the nature of the breach, affected data categories, potential impact, and remedial measures undertaken.

18. Data Subject Rights

Under applicable data protection laws, you possess the following rights regarding your Personal Data:

• Right to Information: obtain details regarding data controller identity, legal basis, and processing scope;
• Right of Access & Copy: request access to and receive copies of your Personal Data;
• Right to Rectification: correct, complete, or update inaccurate or incomplete data;
• Right to Erasure / Destruction: request deletion of data no longer necessary for original purposes;
• Right to Restrict / Suspend Processing: request temporary restriction of processing under specified conditions;
• Right to Withdraw Consent: revoke previously granted consent at any time without retroactive effect;
• Right to Data Portability: receive your data in a standard, structured, machine-readable format;
• Right to Object & Redress: object to automated decision-making and seek legal remedies for statutory violations.

To exercise your rights, please submit a formal request to our Data Protection Team:

Email: connect@bodypack.com Subject: Personal Data Protection Request

Your request should include your full name, contact details, relationship with Bodypack, specific right(s) invoked, and relevant account/transaction identifiers to facilitate identity verification.

Standard statutory requests under the Indonesian PDP Law will be processed within 72 hours (3 × 24 hours) following receipt and verification of identity. If a request must be refused or restricted due to legal exemptions, a detailed written rationale will be provided.

19. Personal Data of Persons with Disabilities

Bodypack makes reasonable efforts to ensure privacy communications and consent mechanisms are accessible to persons with disabilities. Where required by law, consent may be granted directly or through a legally authorized guardian.

20. Third-Party Personal Data Provided by You

If you provide Personal Data belonging to another person (e.g., gift recipients or corporate colleagues), you guarantee that you possess explicit lawful authority to disclose such data, that the information is accurate, and that you have informed the individual of this Policy.

21. Third-Party Websites and Links

Our website may contain hyperlinks to third-party services. Bodypack does not control and is not liable for third-party privacy practices. We encourage users to review external privacy notices when navigating away from our properties.

22. Corporate Structure Changes

In the event of a merger, acquisition, corporate reorganization, asset transfer, or liquidation, Personal Data may be transferred to successor entities, subject to appropriate confidentiality safeguards and regulatory notifications.

23. Changes to this Privacy Policy

Bodypack reserves the right to amend this Policy to reflect operational, technology, legal, or regulatory modifications. Revised policies will be published on our platform with an updated effective date. Material amendments will be highlighted via advance notice or consent requests where required.

24. Governing Law and Jurisdiction

This Policy is governed by and construed in accordance with the laws of the Republic of Indonesia, including:

Law No. 27 of 2022 on Personal Data Protection (PDP Law);
Law No. 11 of 2008 on Electronic Information and Transactions (ITE Law) and amendments;
Government Regulation No. 71 of 2019 on Electronic Systems and Transactions;
Government Regulation No. 80 of 2019 on Electronic Commerce;
Law No. 8 of 1999 on Consumer Protection; and related statutory regulations.

25. Contact and Complaints

For questions, privacy inquiries, incident reports, or exercising data rights, please contact:

Bodypack Personal Data Protection Team

PT Dua Puluh Tiga Jl. Kopo Bihbul Raya No. 68, Sayati, Kecamatan Margahayu Kabupaten Bandung, Jawa Barat 40228, Indonesia Email: connect@bodypack.com WhatsApp: +62 811-1182-6362 Operational Hours: Monday–Friday, 09:00–17:00 WIB