Privacy Policy

Effective from September 5, 2026

This policy explains how TULLIP HOME SPA processes the personal data of visitors to tullipspa.com and customers of the TULLIP HOME SPA home massage service. It follows Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP), in particular the disclosure duties in Article 21.

Language note. This is a courtesy translation. The Indonesian version at tullipspa.com/kebijakan-privasi is the version that governs, and it prevails if the two ever differ.

In short

• This site has no sign up form, creates no account, and processes no payments.
• Every booking happens in a WhatsApp conversation with +62 856-0959-5291.
• This site sets no cookies at all, which is why there is no cookie consent banner here.
• You can ask for access to, correction of, or deletion of your data at any time through the channels at the end of this page.

1. Who controls your personal data

• Name: TULLIP HOME SPA
• Based in: Pondok Aren, Tangerang Selatan, Banten. This is a call out service: the therapist comes to you, and there are no premises that receive visitors. Requests about your personal data are handled through the channels in section 13.
• WhatsApp: +62 856-0959-5291

2. What personal data we process

a. What you send us when you book

When you press a booking button, WhatsApp opens with a message already drafted. What we receive is whatever you type and send in that conversation, usually your name or the name you go by, your WhatsApp number, the address of the session, the date and time you want, and the treatment and length you picked.

b. Technical data from your visit

This site uses Google Analytics to count visits, but it runs without cookies: measurement is sent without storing any identifier on your device, so this visit cannot be linked to your next one. The technical data sent along with it is your IP address, device type, browser, pages opened, and referring source. The detail is in the Cookie Policy.

c. What we do not ask for

We do not ask for specific personal data, health data for example, through this site. If you volunteer it over WhatsApp, such as a sore spot or a condition the therapist should know about, it is used only to adapt the session and for nothing else.

3. Legal basis and purpose

Under Article 20 of the UU PDP, every processing activity below has a clear legal basis.

4. Cookies and similar technology

This site sets no cookies. Analytics and advertising storage sits at denied and never moves. What is kept on your device is two functional items, your appearance choice and where your visit came from, both explained in the Cookie Policy.

5. Who may receive your data

• WhatsApp (Meta): the booking conversation channel. The conversation is also subject to the WhatsApp privacy policy.
• Cloudflare: hosting and content delivery for the site, processing technical request logs for security and availability.
• Google: measurement provider for visit counts, without cookies. Meta and TikTok are listed here because both are wired into the site but not switched on; if they ever are, a consent banner will be brought back first.
• The therapist assigned to you: receives your name, address, and the date and time of the session, only as far as needed to reach you.

We do not sell your personal data and do not trade it with anyone outside the purposes listed above.

6. Transfers outside Indonesia

The third parties above run servers outside Indonesia, so technical data may be processed there. We choose providers that publish a commitment to the applicable data protection standards, as Article 56 of the UU PDP requires.

7. How long we keep data

• Booking conversations: kept while the service relationship lasts, and afterwards for as long as needed to handle complaints or meet a legal duty. You can ask for earlier deletion.
• Cookies: none. This site sets no cookies at all, as explained in the Cookie Policy.
• Your appearance choice and visit source: stored in your own browser until you clear site data.

8. Security

The site is served entirely over HTTPS with HSTS enabled, uses a Content Security Policy that blocks scripts outside a list we control, and keeps no customer database on the site side. No system is completely safe, which is why the incident procedure is set out in section 11.

9. Your rights as a data subject

Articles 5 to 13 of the UU PDP give you the right to:

• be told who we are, on what legal basis we process, and for what purpose;
• complete, update, and correct data that is wrong;
• obtain access to and a copy of your personal data;
• end processing, and have your personal data erased or destroyed;
• withdraw consent you have given;
• object to a decision based solely on automated processing;
• postpone or restrict processing;
• sue for and receive compensation for unlawful processing;
• receive your personal data in a readable, portable form.

Send requests through the channels in section 13. For update or correction requests specifically, the UU PDP gives us at most 3 x 24 hours from receiving the request, and we will tell you the outcome. Some rights can be limited in the cases set out in Article 15 of the UU PDP, for example law enforcement.

10. Children

This service is for adults. We do not knowingly process the personal data of children. If a child sends us data without parental consent, tell us and the data will be deleted.

11. Personal data breach

If a personal data breach occurs, we give written notice within 3 x 24 hours to the affected data subjects and to the competent authority, as Article 46 of the UU PDP requires. The notice states what data was exposed, when and how it was exposed, and what we did to contain and recover from it.

12. Changes to this policy

This policy may be updated when the service or the law changes. The effective date at the top of the page always shows the current version. Under Article 21(2) of the UU PDP, changes that affect how your data is processed will be communicated before they take effect.

13. Contact and complaints

Questions, data subject requests, and complaints about personal data processing can be sent over WhatsApp +62 856-0959-5291 .

If our answer does not satisfy you, you have the right to complain to the Indonesian authority responsible for personal data protection.