Privacy Policy – KretekSource

Privacy Policy for KretekSource

Last Updated: June 30, 2025

We are delighted that you have shown interest in our enterprise. Data protection is a matter of the highest priority for the management of KretekSource. We value your privacy and are committed to protecting your personal data in line with the highest international standards.

Our Policy in Short

We know legal documents can be dense. Here is our commitment to you in plain language:

  • We collect the necessary data to process your orders and improve our service to you (e.g., name, address, email).
  • We will never sell your personal data to third parties.
  • We employ robust technical measures to secure your data to the best of our ability.
  • You have the right to access, amend, or request the deletion of your data at any time.
  • Our site uses cookies for essential functionality, such as the shopping cart, and to enhance your user experience.

For full details, please read our comprehensive policy below.

Complete Privacy Policy

The use of the KretekSource internet pages is possible without any indication of personal data; however, if a data subject wants to use our special services via our website, the processing of personal data could become necessary. If the processing of personal data is necessary and there is no statutory basis for such processing, we generally obtain consent from the data subject.

The processing of personal data, such as the name, address, e-mail address, or telephone number of a data subject shall always be in line with the General Data Protection Regulation (GDPR), and in accordance with other country-specific data protection regulations applicable to KretekSource. By means of this data protection declaration, our enterprise would like to inform the general public of the nature, scope, and purpose of the personal data we collect, use and process. Furthermore, data subjects are informed, by means of this data protection declaration, of the rights to which they are entitled.

As the controller, KretekSource has implemented numerous technical and organizational measures to ensure the most complete protection of personal data processed through this website. However, Internet-based data transmissions may in principle have security gaps, so absolute protection may not be guaranteed. For this reason, every data subject is free to transfer personal data to us via alternative means, e.g., by telephone.

1. Definitions

The data protection declaration of KretekSource is based on the terms used by the European legislator for the adoption of the General Data Protection Regulation (GDPR). In this data protection declaration, we use, inter alia, the following terms:

  • a) Personal data: Any information relating to an identified or identifiable natural person (“data subject”).
  • b) Data subject: Any identified or identifiable natural person whose personal data is processed by the controller.
  • c) Processing: Any operation performed on personal data, such as collection, storage, use, or erasure.
  • d) Restriction of processing: The marking of stored personal data with the aim of limiting their processing in the future.
  • e) Profiling: Any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person.
  • f) Pseudonymisation: The processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information.
  • g) Controller or controller responsible for the processing: The natural or legal person (in this case, KretekSource) which determines the purposes and means of the processing of personal data.
  • h) Processor: A natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
  • i) Recipient: A natural or legal person, public authority, agency or another body, to which the personal data are disclosed.
  • j) Third party: A natural or legal person, public authority, agency or body other than the data subject, controller, or processor.
  • k) Consent: Any freely given, specific, informed, and unambiguous indication of the data subject’s wishes, signifying agreement to the processing of personal data.

2. Name and Address of the Controller

Controller for the purposes of the General Data Protection Regulation (GDPR), other data protection laws applicable in Member states of the European Union and other provisions related to data protection is:

KretekSource
Jetis, Pancuranmas, Secang
56100 Magelang
Indonesia
Phone: +6282135956242
Email: [email protected]
Website: https://kreteksource.com

3. Name and Address of the Data Protection Officer

The Data Protection Officer of the controller is:

Mr. Yudha Pratama
KretekSource
Jetis, Pancuranmas, Secang
56100 Magelang
Indonesia
Phone: +6282135956242
Email: [email protected]
Website: https://kreteksource.com

Any data subject may, at any time, contact our Data Protection Officer directly with all questions and suggestions concerning data protection.

4. Cookies

The Internet pages of KretekSource use cookies. Cookies are text files that are stored in a computer system via an Internet browser. Through the use of cookies, KretekSource can provide the users of this website with more user-friendly services that would not be possible without the cookie setting. The purpose of this recognition is to make it easier for users to utilize our website. A user does not have to enter access data each time the website is accessed, because this is taken over by the website, and the cookie is thus stored on the user’s computer system. Another example is the cookie of a shopping cart in an online shop. The data subject may, at any time, prevent the setting of cookies through our website by means of a corresponding setting of the Internet browser used, and may thus permanently deny the setting of cookies.

5. Collection of general data and information

The website of KretekSource collects a series of general data and information when a data subject or automated system calls up the website. This general data and information are stored in the server log files. When using these general data and information, KretekSource does not draw any conclusions about the data subject. Rather, this information is needed to (1) deliver the content of our website correctly, (2) optimize the content of our website as well as its advertisement, (3) ensure the long-term viability of our information technology systems and website technology, and (4) provide law enforcement authorities with the information necessary for criminal prosecution in case of a cyber-attack. Therefore, KretekSource analyzes anonymously collected data and information statistically, with the aim of increasing the data protection and data security of our enterprise.

6. Registration on our website

The data subject has the possibility to register on the website of the controller with the indication of personal data. The personal data entered by the data subject are collected and stored exclusively for internal use by the controller, and for his own purposes. The controller may request transfer to one or more processors (e.g. a parcel service) that also uses personal data for an internal purpose which is attributable to the controller. By registering on the website of the controller, the IP address—assigned by the Internet service provider (ISP) and used by the data subject—date, and time of the registration are also stored. This data is not passed on to third parties unless there is a statutory obligation to pass on the data, or if the transfer serves the aim of criminal prosecution.

7. Subscription to our newsletters

On the website of KretekSource, users are given the opportunity to subscribe to our enterprise’s newsletter. KretekSource informs its customers and business partners regularly by means of a newsletter about enterprise offers. The personal data collected as part of a registration for the newsletter will only be used to send our newsletter. The subscription to our newsletter may be terminated by the data subject at any time. For the purpose of revocation of consent, a corresponding link is found in each newsletter.

8. Newsletter-Tracking

The newsletter of KretekSource may contain so-called tracking pixels to allow a statistical analysis of the success or failure of online marketing campaigns. Based on the embedded tracking pixel, KretekSource may see if and when an e-mail was opened by a data subject, and which links in the e-mail were called up. Such personal data are stored and analyzed by the controller in order to optimize the shipping of the newsletter. These personal data will not be passed on to third parties.

9. Routine erasure and blocking of personal data

The data controller shall process and store the personal data of the data subject only for the period necessary to achieve the purpose of storage, or as far as this is granted by the European legislator or other legislators in laws or regulations to which the controller is subject to. If the storage purpose is not applicable, or if a storage period prescribed by the European legislator or another competent legislator expires, the personal data are routinely blocked or erased in accordance with legal requirements.

10. Rights of the data subject

Each data subject shall have the right granted by the European legislator to:

  • Obtain from the controller the confirmation as to whether or not personal data concerning him or her are being processed (Right of confirmation).
  • Obtain from the controller free information about his or her personal data stored at any time and a copy of this information (Right of access).
  • Obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her (Right to rectification).
  • Obtain from the controller the erasure of personal data concerning him or her without undue delay where specific grounds apply (Right to erasure / Right to be forgotten).
  • Obtain from the controller restriction of processing where specific conditions are met (Right of restriction of processing).
  • Receive the personal data concerning him or her, which was provided to a controller, in a structured, commonly used and machine-readable format (Right to data portability).
  • Object, on grounds relating to his or her particular situation, at any time, to processing of personal data concerning him or her (Right to object).
  • Not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her, or similarly significantly affects him or her (Automated individual decision-making, including profiling).
  • Withdraw his or her consent to processing of his or her personal data at any time (Right to withdraw data protection consent).

If a data subject wishes to avail himself of these rights, he or she may, at any time, contact any employee of the controller.

11. Data protection provisions about the application and use of Facebook

On this website, the controller has integrated components of Facebook. The operating company of Facebook is Facebook, Inc., 1 Hacker Way, Menlo Park, CA 94025, United States. If a person lives outside of the United States or Canada, the controller is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Facebook may receive information about your visit to our website if you are logged into Facebook at the same time. If such a transmission of information to Facebook is not desirable for the data subject, then he or she may prevent this by logging off from their Facebook account before a call-up to our website is made. The data protection guideline published by Facebook, which is available at https://facebook.com/about/privacy/, provides further information.

12. Data protection provisions about the application and use of Google Analytics (with anonymization function)

On this website, the controller has integrated the component of Google Analytics (with the anonymizer function). The operator of the Google Analytics component is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, United States. The purpose of the Google Analytics component is to analyze the traffic on our website. Google uses the collected data and information to evaluate the use of our website and to provide online reports. For the web analytics through Google Analytics the controller uses the application “_gat. _anonymizeIp” to abridge and anonymize the IP address. Further information and the applicable data protection provisions of Google may be retrieved under https://www.google.com/intl/en/policies/privacy/.

13. Data protection provisions about the application and use of Twitter

On this website, the controller has integrated components of Twitter. The operating company of Twitter is Twitter, Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, UNITED STATES. With each call-up to one of our pages with a Twitter component, Twitter gains knowledge of what specific sub-page was visited. If you are logged in on Twitter at the same time, this information may be associated with your Twitter account. If you wish to prevent this, you may log off from your Twitter account before calling up our website. The applicable data protection provisions of Twitter may be accessed under https://twitter.com/privacy?lang=en.

14. Legal basis for the processing

Art. 6(1) lit. a GDPR serves as the legal basis for processing operations for which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the data subject is party, as is the case, for example, when processing operations are necessary for the supply of goods or to provide any other service, the processing is based on Article 6(1) lit. b GDPR. The same applies to such processing operations which are necessary for carrying out pre-contractual measures, for example in the case of inquiries concerning our products or services. Is our company subject to a legal obligation by which processing of personal data is required, such as for the fulfillment of tax obligations, the processing is based on Art. 6(1) lit. c GDPR. In rare cases, the processing of personal data may be necessary to protect the vital interests of the data subject or of another natural person. Finally, processing operations could be based on Article 6(1) lit. f GDPR. This legal basis is used for processing operations which are not covered by any of the abovementioned legal grounds, if processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

15. The legitimate interests pursued by the controller or by a third party

Where the processing of personal data is based on Article 6(1) lit. f GDPR our legitimate interest is to carry out our business in favor of the well-being of all our employees and the shareholders.

16. Period for which the personal data will be stored

The criteria used to determine the period of storage of personal data is the respective statutory retention period. After expiration of that period, the corresponding data is routinely deleted, as long as it is no longer necessary for the fulfillment of the contract or the initiation of a contract.

17. Provision of personal data as statutory or contractual requirement; Requirement necessary to enter into a contract; Obligation of the data subject to provide the personal data; possible consequences of failure to provide such data

We clarify that the provision of personal data is partly required by law (e.g. tax regulations) or can also result from contractual provisions (e.g. information on the contractual partner). Sometimes it may be necessary to conclude a contract that the data subject provides us with personal data, which must subsequently be processed by us. The data subject is, for example, obliged to provide us with personal data when our company signs a contract with him or her. The non-provision of the personal data would have the consequence that the contract with the data subject could not be concluded.

18. Existence of automated decision-making

As a responsible company, we do not use automatic decision-making or profiling.