Privacy Policy

PT Coco Total Essential Oil Indonesia ("we", "us", "our") respects the privacy of our business partners, customers, and website visitors. This Privacy Policy explains how we collect, use, store, and protect personal data in the context of our B2B wholesale and export operations. It applies to data collected through our website, email correspondence, purchase orders, and direct business communications.

By using our website or engaging in business with us, you acknowledge that you have read and understood this Privacy Policy.

We collect and process the following categories of information:

• Business Contact Information: name, job title, company name, business email, business phone, and business address of representatives who communicate with us.
• Order & Transaction Data: purchase orders, delivery addresses, shipping instructions, payment details, invoices, and correspondence related to transactions.
• Communications: emails, messages, and notes from inquiries, quotations, and customer support interactions.
• Technical Data: IP address, browser type, and pages visited on our website (collected via standard server logs for security and analytics).

We do not intentionally collect personal data from consumers or individuals outside a professional business context.

We use the information we collect for the following legitimate business purposes:

• To process, fulfill, and ship orders.
• To communicate quotations, order confirmations, shipping updates, and invoices.
• To maintain business records and comply with accounting, tax, and customs regulations.
• To ensure website security and prevent fraud.
• To improve our products, services, and customer experience.

We do not use your business contact data for unsolicited marketing or sell your information to third parties.

We process personal data on the following legal bases:

• Performance of a Contract: processing necessary to fulfill purchase orders and delivery agreements.
• Legal Obligation: compliance with tax, customs, export control, and anti-bribery regulations.
• Legitimate Interests: business record-keeping, fraud prevention, and network security.
• Consent: where required by applicable law (e.g., for certain communications).

We share data only with trusted service providers and authorities as necessary to conduct our business:

• Logistics Partners: shipping companies, freight forwarders, and customs brokers to facilitate delivery.
• Financial Institutions: banks and payment processors to handle transactions.
• Regulatory Authorities: tax, customs, and export-control agencies where required by law.
• Professional Advisors: auditors, legal counsel, and insurers under confidentiality obligations.

We do not sell, rent, or trade personal data to third parties for their marketing purposes.

We retain business contact and transaction data for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, regulatory, tax, and accounting requirements. Typically, this means retaining records for the duration of our business relationship plus applicable statutory retention periods (e.g., 10 years for tax and customs purposes in Indonesia).

We implement commercially reasonable administrative, technical, and physical safeguards to protect personal data against unauthorized access, alteration, disclosure, or destruction. This includes encrypted communication channels, access controls, and secure storage systems. However, no method of transmission over the internet or electronic storage is completely secure; we cannot guarantee absolute security.

Our website uses minimal cookies and standard server logs to ensure functionality and analyze aggregate traffic patterns. We do not use tracking cookies for behavioral advertising. You may disable cookies through your browser settings, though some website features may be affected.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your data where legally permissible.
• Object to or restrict certain processing activities.
• Request data portability in a structured, machine-readable format.

To exercise these rights, contact us using the details in Section 11. We will respond within the timeframe required by applicable law.

As an export-oriented business headquartered in Indonesia, we transfer and store data internationally. When we share data with partners or service providers outside Indonesia, we ensure appropriate safeguards are in place, such as contractual clauses or reliance on adequacy decisions, to protect your data in accordance with this Privacy Policy.

Our website and services are directed at business customers and professionals. We do not knowingly collect personal data from individuals under 16 years of age. If you believe we have inadvertently collected such data, please contact us so we can delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated version will be posted on this page with a revised "Last updated" date. We encourage you to review this page periodically.

Questions or requests regarding this Privacy Policy should be directed to: