Privacy Policy · Pumiland

This Privacy Policy explains what data pumiland.com and pumimart.com ("Pumiland", "we") collect, what it is used for, and what your rights are. We handle personal data in line with Indonesia's Personal Data Protection Law (Law No. 27 of 2022, "UU PDP").

1. Data we collect

When you create an account:

your name and email;
your password, stored as a scrambled hash that even we cannot read;
if you sign in with Google: your name, email, profile photo, and Google account ID. We never receive your Google password.

When you use the sites:

login sessions: IP address, browser or device type, and last active time, to keep your account secure;
visit statistics: pages viewed and the site you came from (for example Instagram or Google). To count visitors we use a random code made from your IP and browser that changes every day. Your real IP address is not stored in these statistics, and we don't use third-party trackers. If you are logged in, the visit is also recorded with your account.

When you fill in a form:

your email for Letters from Pumi (newsletter);
your email and message in the feedback box;
your name, email, portfolio link, and message when applying as a creator;
later, order data: products bought, total price, and payment status. Card or bank details are handled directly by the payment provider and are not stored by us.

2. How we use it

To create and keep your account, including signing in across Pumiland and Pumimart.
To send important emails: verification links, password resets, order confirmations, and notices for members (such as new rules or selling guidelines). These are sent even if you unsubscribe from Letters from Pumi.
To send Letters from Pumi if you are subscribed.
To process orders and downloads.
To reply to feedback and creator applications.
To understand which pages visitors like, so we can make the sites better.
To prevent abuse, such as spam and attempts to break into accounts.

We do not sell your personal data, and we don't share it for advertising.

3. Cookies

We only use cookies the sites need to work:

login cookies (pumiland_sid, pumimart_sid) and sessions (PUMILAND_PHPSESS, PUMIMART_PHPSESS);
your language choice (pumi_lang).

The sites also store a few small preferences in your browser, such as whether background music is on or off. We use no advertising or tracking cookies.

4. Other parties involved

Hosting provider (Jagoan Hosting): the servers where the sites and database are stored. The servers are in Singapore, so your data may be stored outside Indonesia with equivalent protection.
Google: only if you choose to sign in with Google.
Payment providers: only when you pay for an order.
Authorities, when required by law.

5. How long we keep data

Account data is kept while your account exists, including while it is turned off (your shop and listings are hidden, but the data stays intact). Deletion requests are carried out 14 days after you confirm them by email; until then the account is turned off and you can still cancel. After deletion, your profile, sign-in methods, newsletter subscription and listings are removed. What we keep: your full transaction history (required for bookkeeping and tax), feedback you sent through the suggestion box, and visit statistics.
Sign-ups that are never verified may be deleted.
Newsletter emails are kept until you unsubscribe.
Visit statistics records are deleted automatically after about 13 months.

6. Your rights

Under UU PDP you have the right to:

see and request a copy of your personal data;
correct wrong data (you can change your name yourself on the Account page);
unsubscribe from Letters from Pumi at any time;
turn your account off temporarily, or delete your account and data yourself from the Account page (confirmed through a link sent to your email);
withdraw your consent to data processing.

Send your request to halo@pumiland.com from your registered email. We will reply within 3 x 24 hours.

7. Security

Our sites use HTTPS. Passwords are stored as hashes, and database access is restricted. No system is 100% secure. If a data breach affects you, we will notify you as required by UU PDP.

8. Children

Users under 18 should use our services with a parent's or guardian's consent. We do not knowingly collect data from children under 13. If you are a parent and believe your child's data is in our system, contact us and we will delete it.

9. Changes to this policy

This policy may be updated. The date of the last update is shown at the top of the page. If the changes are important, we will let you know through the sites or by email.

10. Contact us

Privacy questions: halo@pumiland.com.