mamiekids

Privacy Policy

Updated 19 October 2026

Effective date: 19 October 2026

This Privacy Policy explains how ("mamiekids", "we", "us") collects, uses, stores, shares and protects your personal data when you visit the mamiekids website, create an account, shop with us or contact us. We process personal data in accordance with Indonesian Law No. 27 of 2022 on Personal Data Protection (the "PDP Law") and other applicable Indonesian laws and regulations.

By using our website, you confirm that you have read and understood this Privacy Policy. Where processing requires your consent, such as promotional messages, we will ask for it separately.

This English version is provided for convenience. If there is any inconsistency, the Indonesian version prevails.

1. Data We Collect

Data you give us

  • Account data: full name, email address, password (stored as a one-way hash that we cannot read), and the WhatsApp number you verify.

  • Order and delivery data: recipient name, phone number, full address (province, city/regency, district, postal code, address details), order notes, items purchased and transaction history.

  • Reviews: ratings, review text and product photos you upload (up to 3 photos per review).

  • Communications: messages you send us by WhatsApp, email or forms, including cancellation requests and claims about items received.

  • Preferences: wishlist, back-in-stock requests, and whether you opt in to promotional messages.

Data from third parties

  • Sign in with Google: if you sign in with Google, we receive your name, email address and profile photo from Google. We never receive your Google password.

  • Payment provider: Midtrans sends us the payment status, the payment method used and the transaction reference. We do not receive or store your card number, CVV, PIN, or e-wallet/bank credentials.

  • Couriers: tracking numbers (resi) and delivery status.

Data collected automatically

  • Technical data: IP address, device and browser type, operating system, language and access times.

  • Usage data: pages viewed, products viewed or added to cart, cart contents, and how you arrived at the site (for example, an ad link).

  • Cookies and similar technologies: see section 7.

2. How and Why We Use Your Data

  • Processing and delivering orders — calculating shipping, taking payment, packing, shipping and keeping you updated on order status. Basis: performance of a contract.

  • Running your account — sign-up, sign-in, WhatsApp number verification by one-time code (OTP), address book, wishlist and order history. Basis: performance of a contract.

  • Transactional WhatsApp messages — order, payment, shipping and delivery confirmations, review requests, and back-in-stock alerts you asked for. Basis: performance of a contract and your request.

  • Cart reminders and promotions by WhatsApp — reminders about items left in your cart, vouchers and promotional news. Basis: your consent. You can opt out at any time in Account > Notifications or by replying to our message.

  • Customer service — answering questions and handling cancellations, complaints and replacements. Basis: performance of a contract and legitimate interests.

  • Analytics and service improvement — understanding how the site is used, fixing errors and improving the site and catalog. Basis: legitimate interests.

  • Ad measurement — measuring how well our ads on Google and Meta (Facebook/Instagram) perform. Basis: legitimate interests and/or your consent.

  • Security and fraud prevention — rate-limiting sign-in and OTP attempts, detecting suspicious transactions and protecting accounts. Basis: legitimate interests and legal obligations.

  • Legal compliance — bookkeeping, tax and responding to lawful requests from authorities. Basis: legal obligation.

We do not sell your personal data to anyone.

3. Who We Share Your Data With

We share only what is necessary with the following parties, who are bound to keep your data confidential and secure:

  • Payment provider: Midtrans (PT Midtrans), to process payments by virtual account, QRIS, e-wallet and card.

  • Technology infrastructure: our website host and our database, authentication and file-storage provider.

  • Messaging: the WhatsApp gateway service we use to send notifications over the WhatsApp network.

  • Analytics and advertising: Google (Google Analytics, Sign in with Google) and Meta Platforms (Meta Pixel and Conversions API). Data sent for ad measurement is limited to event data (for example, purchases and order value) and, where sent, contact details in hashed form.

  • Authorities: where required by law, a court order or an official request from law enforcement.

  • Business transfers: in a merger, acquisition or transfer of business, data may pass to the successor, who remains bound by this Privacy Policy, and we will notify you.

Public reviews: reviews and photos you submit appear on product pages with your name partly masked (for example "S***i"). Please do not include personal data in review text or photos.

4. Transfers Outside Indonesia

Some of our service providers (for example hosting, database, analytics and advertising) may store or process data on servers outside Indonesia. When this happens, we make sure the transfer complies with Article 56 of the PDP Law: to providers with an equal or higher level of data protection, or under adequate contractual safeguards.

5. How Long We Keep Data

  • Account data: for as long as your account is active. After you ask us to delete your account, account data is deleted or anonymised within 30 days, except data we are legally required to keep.

  • Transaction and order data: 10 years, as required by corporate-records and tax laws.

  • Cart data and OTP codes: guest cart data is removed after inactivity; OTP codes expire after 5 minutes and cannot be reused.

  • Technical and security logs: generally up to 12 months.

  • Analytics data: per the analytics provider's retention period, up to 14 months.

6. Security

We use reasonable technical and organisational measures to protect your data, including encrypted connections (HTTPS), hashed password storage, role-based access limited to authorised staff, rate limits on sign-in and OTP attempts, and payments handled directly by a licensed payment provider.

No system is entirely risk-free. If a personal data breach affects you, we will notify you and the relevant authority within 3 x 24 hours of becoming aware of it, as required by Article 46 of the PDP Law. Keep your password and OTP codes private; we will never ask for your OTP, password or PIN by phone or chat.

7. Cookies and Similar Technologies

Cookies are small files stored in your browser. We use:

  • Essential cookies: to keep you signed in, hold your cart, remember your language and keep the site secure. The site cannot work properly without them.

  • Analytics cookies: Google Analytics, to understand how visitors use the site.

  • Advertising cookies: Meta Pixel, to measure ad performance and show more relevant ads.

You can delete or block cookies in your browser settings. If you block essential cookies, features such as sign-in and the cart may not work. You can also manage ad preferences in your Google and Meta account settings.

8. Your Rights

Under the PDP Law, you have the right to:

  • be informed about how your personal data is processed;

  • access and obtain a copy of your personal data;

  • correct or update inaccurate data — most of which you can do yourself on the Profile and Addresses pages;

  • request deletion of your data or closure of your account;

  • withdraw consent you have given, including for promotional messages;

  • restrict or suspend processing;

  • object to decisions based solely on automated processing;

  • receive your personal data in a commonly used, machine-readable format;

  • file an objection and claim compensation for unlawful processing of your personal data, as provided by law.

To exercise these rights, contact us using the details in section 11. We may ask you to verify your identity first, and we will respond within 3 x 24 hours as required by the PDP Law. Withdrawing consent does not affect processing carried out before the withdrawal, and data we are legally required to keep (such as transaction records) cannot be deleted before its retention period ends.

9. Children's Data

mamiekids sells products for children, but our service is intended for adults (aged 18 or over, or married). Minors may not create an account or shop without the consent and supervision of a parent or guardian. We do not knowingly collect children's personal data. If you believe a child has given us data without a parent's or guardian's consent, contact us and we will delete it. Please avoid uploading review photos in which a child's face is clearly visible.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The date of the latest update is shown at the top of this page. For material changes, we will notify you on the site, by email or by WhatsApp before they take effect. By continuing to use our services after the changes take effect, you are deemed to have understood the updated policy.

11. Contact Us

For questions, personal data requests or complaints, contact:

If you are not satisfied with our response, you may lodge a complaint with the competent personal data protection authority in Indonesia.