Privacy Policy

The barooka.id website is run by PT Barooka Global Indonesia ("Barooka", "we" or "us"), a wholesale distributor of natural products. For the personal data described here, we act as the personal data controller under Law No. 27 of 2022 on Personal Data Protection (the "PDP Law").

This policy covers the whole barooka.id website, including the cart and checkout, and communication about your orders. Orders are also subject to our Terms & Conditions.

Details you enter at checkout

• Buyer details: name, WhatsApp number, email (optional) and company name (optional).
• Shipping address: address, district, city or regency, province, postal code and notes (optional).
• Order contents: products and quantities, the shipping service you choose, and the shipping fee and total charged.

Location pin (optional)

You can add a location pin (latitude and longitude) so couriers can find your address more easily, in either of these ways:

• Pasting a Google Maps link. The coordinates are read from the link. If it is a short link, our server opens it only to read the coordinates and collects nothing else.
• Using your device location. Your browser asks for your permission first. Your location is read once, when you press "Current location", and is not tracked continuously.

To fill in the address fields automatically, your browser sends these coordinates directly to the OpenStreetMap Nominatim service.

Technical data

Like any website, the servers that deliver this site receive technical data from your browser, such as your IP address, browser and device type, the pages requested and the time of access. We use it to display the site, keep it secure and deal with faults.

Your IP address is also used to limit how many orders, shipping quotes and Google Maps link lookups can be requested in a short time, so the system cannot be abused. In our order system, IP addresses kept for this purpose are deleted automatically after one day.

Communication with us

If you contact us by WhatsApp, email or phone, we receive the content of your messages and the contact details you send.

What we do not ask for

We do not ask for your card number, PIN or payment password. You enter payment details directly on the Xendit page, not on our site. The site also has no accounts, so we do not store any account passwords.

• To process your order: record it, create the payment link and issue the invoice.
• To calculate shipping, book the courier and deliver the goods to your address.
• To contact you about your order, for example confirmations, shipping fee differences, delivery schedules, tracking numbers or complaints.
• To prevent abuse, such as fake orders or excessive automated requests, and to keep the site secure.
• To meet legal obligations, including transaction records, bookkeeping and tax.
• To understand how the site is used and how products sell, in aggregate (for example, which products are viewed and bought most), so we can improve it (see Cookies and browser storage).

We do not sell your personal data. If we ever want to send you offers unrelated to your orders, we will ask for your consent first, and you can stop receiving them at any time.

Under the PDP Law, we process personal data on the following bases:

• Performance of a contract: your buyer details, address and order contents are needed to process and deliver your order.
• Consent: for optional data you choose to give, such as your device location. You can withdraw your consent at any time.
• Legal obligation: keeping transaction and bookkeeping records.
• Legitimate interests: site security, abuse prevention, and aggregate visit and sales statistics.

We share only the data needed to run your order and this site, with the following parties:

• store.barooka.id: Barooka's own order system, which records orders, calculates shipping and creates payment links.
• Ventera Nexus: a shared payment and shipping service run by PT Ventera, which passes payment and shipping requests on to the providers below.
• Xendit: our payment processor. Xendit receives the billing details of your order and processes the payment details you enter on its page under its own privacy policy. On the Xendit payment page, the merchant name is shown as "Ventera AI".
• Biteship and Sentral Cargo: shipping quotes, pickup and delivery. Both receive your name, phone number, address, postal code and parcel weight.
• OpenStreetMap Nominatim: if you use a location pin, your browser sends its coordinates to this service to fill in your address automatically.
• Google Maps: when you paste a short Google Maps link, our server opens it only to read the coordinates. The map on our Contact page is also loaded from Google Maps.
• Google Analytics: visit and sales statistics for the site (see Cookies and browser storage).
• Email and WhatsApp: order notifications for our store team and order communication with you. Order emails are sent from support@ventera.ai. WhatsApp messages are also processed by WhatsApp under its own policy.
• Vercel and Cloudflare: the hosting and network providers that deliver this site and protect it from attacks.

We may also disclose data when required by law or requested by a competent authority in accordance with the applicable regulations.

Some of these providers may process data outside Indonesia. When they do, we only use providers that apply adequate data protection, in line with the PDP Law's rules on transferring personal data.

• Your cart is stored in your browser's localStorage (product codes and quantities only) so it is not lost when you move between pages. It is emptied automatically when you proceed to payment, and you can delete it at any time in your browser settings.
• An unfinished payment link is stored in sessionStorage for up to 24 hours, so you can resume payment if you return to the checkout page. It is removed when you close the browser tab.
• Google Analytics sets first-party cookies (such as _ga) to count visits in aggregate: pages viewed, where visits come from, device and browser type, and approximate location (city or country). For sales statistics, shopping steps (products viewed, cart contents, checkout and clicks to WhatsApp) and paid orders (order number, products, quantities, order value and shipping fee) are also recorded and linked to that cookie. We do not send your name, phone number, email or address to Google Analytics.
• The map on our Contact page is loaded from Google Maps, which may set its own cookies under Google's policy.

We do not use marketing or advertising cookies. You can delete or block cookies and site storage in your browser settings. If browser storage is blocked, the cart still works, but it is emptied when the page is reloaded.

• Order and transaction data is kept for as long as needed to process your order, handle complaints and meet the legal requirements for keeping transaction, bookkeeping and tax records.
• IP addresses used to limit orders are deleted automatically after one day.
• WhatsApp and email conversations are kept for as long as needed to serve you and follow up on your orders.
• Data in your browser (cart and payment link) stays on your own device, and you can delete it at any time.

When the retention period ends, data is deleted or anonymised so it can no longer be used to identify you.

Our site and order system use encrypted connections (HTTPS). Access to order data is limited to the people and services that need it to process orders. We will never ask for your password, PIN or OTP code by WhatsApp, email or phone.

No system is completely secure. If a personal data protection failure affects you, we will notify you and the competent authority in accordance with the PDP Law.

Under the PDP Law, you have the right to:

• Access the personal data we hold about you and obtain a copy.
• Correct data that is inaccurate or incomplete.
• Request deletion of your personal data. Data we are required by law to keep, such as transaction and bookkeeping records, is kept until its mandatory retention period ends.
• Withdraw consent you have given, for example for using your device location. Withdrawing consent does not affect processing carried out before it.
• Object to the processing of your personal data.

Send your request to business@barooka.id or WhatsApp +62 85647486700, including your order number if you have one. We may ask you to verify your identity before acting on a request, and we will respond within the time limits set by the PDP Law.

If you are not satisfied with our response, you may lodge a complaint with the competent authority in accordance with the applicable regulations.

This site is intended for adult buyers and businesses. We do not knowingly collect personal data from children. If you are a parent or guardian and learn that your child has sent us data, please contact us so we can delete it.

We may update this policy when our services, providers or the law change. The latest version is always available on this page with its effective date. For significant changes, we will also post a notice on this site.

For questions about this policy or to exercise your rights, contact PT Barooka Global Indonesia:

• Email: business@barooka.id
• WhatsApp: +62 85647486700
• Address: AD Premier 9th Floor, Jl. TB Simatupang No. 5, Ragunan, Pasar Minggu, Jakarta Selatan 12550, Indonesia