Privacy policy

Last updated · 13.11.2026

This policy explains what personal data FRAG (frag.id, operated by PT WANGI KURASI PRATAMA) collects, why we use it, who helps us process it and the choices you have. It follows Indonesia’s Personal Data Protection Law (UU No. 27/2022, “UU PDP”).

1. Who is responsible

The controller of your personal data is PT WANGI KURASI PRATAMA (FRAG), based in Kabupaten Garut, West Java. Its business number and registered address are on Seller information. The Director of PT WANGI KURASI PRATAMA is responsible for personal data protection. For anything about your data: privasi@frag.id or WhatsApp 0877-7556-4040.

2. What we collect

• —Order details — name, email, phone and delivery address you enter at checkout. If you leave checkout before paying, we keep what you entered for 30 days and may send you one reminder about your bag (section 5).
• —Payment — handled by Xendit, our payment provider. We never see or store your card number; we keep the method, amount and Xendit’s payment reference with your order.
• —Account — the email you sign in with, the addresses you save, your perfume collection and the scent profile built from it, your member number, points and affiliate code.
• —At the FRAG booth — what you buy and, if you earn or use points at the counter, your account (found by your account QR, phone or email).
• —Advisor requests — what you send through “Contact an advisor”: name, email, perfumes you wear, budget and message.
• —Customer service — your messages on WhatsApp or by email, photos or videos you send about a claim, and a bank account in your name when a refund has to go by transfer.
• —Newsletter and back-in-stock alerts — your email, and when and where you signed up.
• —Usage data — pages viewed, device and approximate location, collected by analytics and advertising tools only if you allow Analytics or Marketing cookies. Separately, FRAG counts page views anonymously in its own database: the page, the day, phone / tablet / computer and the site you came from — no cookie, nothing that identifies you.
• —We never ask for a copy of your ID card, a password, PIN or OTP.

3. Why we use it

• Deliver and support your order

  Basis: Contract

  Data: Order details

• Run your account, points, affiliate link and collection

  Basis: Contract

  Data: Account data, orders

• Answer advisor requests, send alerts you asked for

  Basis: Your request

  Data: Email, message

• Handle questions, claims, exchanges and refunds

  Basis: Contract and legal obligation

  Data: Messages, claim photos, bank account when needed

• One reminder about a checkout you didn’t finish

  Basis: Legitimate interest

  Data: Email, items in your bag

• Keep the site and accounts safe from fraud and bots

  Basis: Legitimate interest

  Data: IP address, device, sign-in records

• Newsletter and other promotions

  Basis: Consent — unsubscribe any time

  Data: Email

• Understand how the shop is used

  Basis: Consent — Analytics

  Data: Usage data

• Measure our ads, show FRAG ads elsewhere

  Basis: Consent — Marketing

  Data: Usage data, hashed email at purchase

• Tax and legal duties

  Basis: Legal obligation

  Data: Order records

Promotions are only sent with your consent. The one checkout reminder in section 5 is the exception, because it is about a purchase you started yourself.

4. Analytics and advertising

We use the services below to measure visits and our advertising. None of them loads before you choose in “Cookies”, and you can change your choice at any time from the link at the bottom of every page.

• Google Analytics 4

  Provider: Google

  What it does: Counts visits, pages and purchases (aggregated reports)

  Needs: Analytics

• Cloudflare Web Analytics

  Provider: Cloudflare

  What it does: Cookieless page counts

  Needs: Analytics

• Meta Pixel + Conversions API

  Provider: Meta

  What it does: Measures ads on Facebook and Instagram; builds ad audiences

  Needs: Marketing

• TikTok Pixel + Events API

  Provider: TikTok

  What it does: Measures ads on TikTok; builds ad audiences

  Needs: Marketing

When you buy after allowing Marketing, a hashed (unreadable) version of your email and the order value may be sent to Meta and TikTok so they can tell us which ads worked. Cookie names and durations are listed in our Cookie policy.

5. Email

We send all our email through Resend: order and payment messages, sign-in codes, advisor replies, back-in-stock alerts and the newsletter. Your subscription and preferences are kept in our own database — we don’t use a separate marketing platform. Newsletter emails may count opens and clicks so we can see what is useful; every newsletter has a one-click unsubscribe, and you can pick topics at frag.id/email/preferences.

If you type your email at checkout and leave without paying, we may send you one reminder about the items in your bag, about 3 hours later. We send it on the basis of legitimate interest (UU PDP Article 20(2)(f)), because it is about a purchase you started yourself. It has no discount code and no other products. We send at most one per address per week, and its one-click unsubscribe stops all our marketing email. Emails about your orders still reach you.

6. Who we share it with

• —Xendit — processes your payment (virtual account, QRIS, e-wallet, card). Card details go straight to Xendit.
• —Couriers (JNE, J&T Express) — name, phone and address to deliver your order.
• —RajaOngkir (Komerce) — calculates shipping at checkout from your delivery area and the parcel’s weight. It doesn’t receive your name, phone or street address.
• —Cloudflare — hosts frag.id and the FRAG database (products, orders, accounts and requests), checks forms for bots (Turnstile) and keeps them secure.
• —Resend — sends our email (orders, sign-in codes, newsletter).
• —WhatsApp (Meta) — your phone number and our chat, when you contact customer service or arrange a pick-up.
• —Scento — when you add a perfume from outside our catalogue to your collection, the name you type is looked up there. Scento doesn’t receive your personal data.
• —Google, Meta, TikTok — analytics and advertising, only with your consent.

We don’t sell, rent or trade your personal data, and we don’t put it into third-party AI services. We only use providers bound by contract to protect it, and we give data to authorities only when the law requires it.

7. Where it is stored

The FRAG database runs on Cloudflare in Osaka, Japan, and the site is served from Cloudflare’s global network. Resend sends our email from the United States. Xendit processes payments in Indonesia. WhatsApp, Google, Meta and TikTok process data outside Indonesia; Google, Meta and TikTok only if you allow Analytics or Marketing. Transfers abroad follow UU PDP Article 56, under contracts that bind each provider to protect your data.

8. How long we keep it

• —Orders and invoices — 10 years, as Indonesian tax law requires.
• —Account, saved addresses, collection and points — while your account is active, or until you ask us to delete it. Order records stay for the 10 years above.
• —A checkout you didn’t finish — 30 days.
• —Customer service chats and emails, and advisor requests — 2 years after the last message. Claim photos and videos — 2 years after the case is closed.
• —Back-in-stock alerts — until the email is sent, or 6 months.
• —Newsletter — until you unsubscribe.
• —Analytics — 14 months in Google Analytics.

After that we delete the data or make it anonymous.

9. Your rights

You can ask to see, correct or delete your data, get a copy, withdraw consent, pause or limit processing, or object to it, including to decisions made automatically. Email privasi@frag.id or WhatsApp 0877-7556-4040. We reply within 3 × 24 hours as UU PDP requires, weekends and holidays included. Withdrawing consent doesn’t affect what happened before.

We check a request against the email or phone number on your account or order, or with a sign-in code. We never ask for your ID card. Order records we must keep for tax can’t be deleted before their 10 years are over; we tell you which data stays and why.

Perfume recommendations from your collection are a preference profile. We don’t make automated decisions about you that have legal or similar effects.

10. Security and data breaches

Only people who need your data for their work can see it, and your card details never reach FRAG. If a breach affects your data, we tell you and the personal data protection authority in writing within 3 × 24 hours: what was exposed, when and how, what we did and what you can do.

11. Age

12. Contact, complaints and changes

PT WANGI KURASI PRATAMA (FRAG) · Kabupaten Garut, West Java · privasi@frag.id. If you’re not satisfied with our answer, you can complain to the personal data protection authority under UU PDP. We announce changes to this policy at least 14 days before they take effect, on this page with a new date and by email to customers with an account or an open order.