Your information,
treated with care.

01

Overview

Atman Spa & Wellness Kerobokan ("Atman Spa", "we", "us" or "our") is responsible for the personal data described in this policy. We process personal data in accordance with applicable Indonesian law, including Law No. 27 of 2022 concerning Personal Data Protection.

This policy applies to our Kerobokan website, email subscription forms, online advertising and booking conversations started through our WhatsApp links. When you use a third-party service such as WhatsApp, Google, Meta or Sender.net, that provider's own privacy terms also apply.

02

Personal data we collect

Information you provide

• Booking and enquiry details: your name, telephone number, WhatsApp profile information visible to us, requested treatment and duration, preferred appointment date and time, and the content of your messages.
• Information needed for your treatment: health, allergy, pregnancy, accessibility or preference information that you choose to provide and that is reasonably necessary to deliver a safe service.
• Email subscriptions: your first name, email address, consent status, subscription source and interactions with emails such as delivery, opens, clicks and unsubscribes.
• Feedback and correspondence: information included when you email, message or otherwise communicate with us.

Information collected automatically

• Browser and device type, operating system, referring page, pages viewed, approximate location, session activity, timestamps and advertising or cookie identifiers.
• IP address and security signals processed by our hosting, security and measurement providers. Analytics providers may use an IP address to derive approximate location before applying their own storage controls.

Please avoid sending sensitive health information through WhatsApp unless it is relevant to your treatment. You may instead provide necessary details directly to our therapist or staff.

03

How and why we use personal data

Providing information for a booking is voluntary, but we may not be able to arrange or safely deliver a requested treatment without the necessary details. Marketing consent is not required to make a booking.

04

Cookies, analytics and advertising

Our website may use cookies, pixels and similar technologies. Essential technologies support page delivery, security and basic functionality. Non-essential analytics and advertising trackers should load only after you make a choice through the cookie notice.

You can accept or reject non-essential trackers through the cookie notice when available. You can also restrict cookies in your browser. Blocking some technologies may affect measurement but should not prevent access to essential website content.

05

Who may process your data

We do not sell your personal data. We may share or allow access to information only where necessary with:

• Atman Spa staff and authorised service providers who need it to answer enquiries, manage appointments and provide treatments.
• Sender.net for subscription forms, subscriber records, email delivery, automation and engagement reporting.
• WhatsApp and Meta when you choose to start a WhatsApp conversation, and for Meta advertising tools if enabled with consent.
• Google for Analytics and Google Ads measurement if enabled with consent.
• Cloudflare and hosting providers for website delivery, availability and security.
• Professional advisers, regulators or authorities where disclosure is required by law or reasonably necessary to protect legal rights.

These providers process information under their own terms or under agreements with us, depending on the service and their role.

06

International data transfers

Some service providers may process or store personal data outside Indonesia. Where personal data is transferred internationally, we take reasonable steps to use providers with appropriate safeguards, rely on binding contractual protections where available, and obtain consent when required by applicable law.

07

How long we keep data

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected:

• Booking enquiries and messages are kept while we handle the enquiry and for a reasonable period afterward for service follow-up and dispute handling.
• Completed booking, payment and accounting records are kept for the period required by applicable business, tax and accounting law.
• Email subscription data is kept until you unsubscribe, we close the list, or the information is no longer needed. We may retain a minimal suppression record so that we respect an unsubscribe request.
• Analytics, advertising and security data follow the retention settings configured in the relevant provider and are periodically reviewed.

We may retain information longer where required by law, necessary to resolve a dispute or needed to protect legal rights. When no longer required, information is deleted, anonymised or securely destroyed.

08

Your privacy rights

Subject to applicable law and any permitted limitations, you may ask us to:

• explain how and why your personal data is processed;
• give you access to or a copy of your personal data;
• complete, update or correct inaccurate personal data;
• stop, restrict, delete or destroy certain personal data;
• withdraw consent, including marketing consent;
• object to a decision based solely on automated processing that has a legal or similarly significant effect;
• provide eligible data in a commonly used electronic format or transfer it where technically possible; and
• address a complaint or alleged violation of your personal-data rights.

Withdrawing consent does not affect processing that took place before withdrawal. Some information may need to be retained where another lawful basis or legal obligation applies. We may ask for reasonable information to verify your identity before responding.

09

Security and children

We use reasonable organisational and technical measures to protect personal data against accidental loss, misuse, unauthorised access, alteration and disclosure. No internet transmission or storage system is completely secure, so please use care when deciding what information to send online.

Our website and marketing forms are not directed to children. A parent or legal guardian should contact us when arranging a treatment or providing personal data for someone under 18.

10

Contact and policy updates

For questions, withdrawal of consent or a request concerning your personal data, contact:

We may update this policy when our services, providers or legal obligations change. The current version and its latest revision date will be published on this page.