Privacy Policy
Introduction
PT. ART WORKSHOP BALI ("3D Lab Bali", "we", "us") is a 3D printing service company located at Perum Gading Kencana No. SH-10, Jimbaran, Bali 80361, Indonesia. We respect your privacy and are committed to protecting personal data you provide when using https://3dlab.co.id or contacting us via WhatsApp, phone, email, or Google Business Profile.
This policy explains what data we collect, how we use it, which third parties may receive it, and your rights under Indonesian Law No. 27 of 2022 on Personal Data Protection ("PDP Law").
Data We Collect
Data you provide directly:
- Name, phone/WhatsApp number, email address
- Message content and service requests (including design-file attachments such as STL, OBJ, 3MF, STEP)
- Project details and product descriptions
Data collected automatically when you visit the site:
- IP address (stored as a hash, not plaintext)
- Browser, operating system, and device type (also hashed)
- Referrer URL
- Date, time, and pages visited
- Ad click identifiers: `gclid`, `gbraid`, `wbraid` (from Google Ads)
Data collected via WhatsApp:
- Conversation history (stored in our Chatwoot CRM)
- Sender's phone number
- Conversation status and labels
Data generated through business processes:
- Deal/quote status and value
- Order history and invoices (for accounting purposes)
How We Use Data
We use your data to:
- Provide quotes and 3D printing/scanning/modeling services you request
- Communicate with you via WhatsApp, phone, or email
- Measure the effectiveness of our Google Ads campaigns (conversion attribution)
- Process payments and meet tax/accounting obligations via Jurnal.id
- Improve our services and website
- Comply with legal obligations
Legal Basis
We process your data based on:
- Your consent — when you message us via WhatsApp, submit a form, or continue using the site after reviewing this policy.
- Contract performance - to fulfill orders/services you request.
- Our legitimate interests - ad measurement, fraud prevention, service improvement.
- Legal obligations - tax and accounting record retention.
Third Parties That Receive Data
We share data with the following service providers as needed for operations:
- Wix.com — website hosting. Accesses: form submissions.
- Google LLC — Ads, analytics, Business Profile, Search Console. Accesses: click identifiers (gclid/gbraid/wbraid), hashed phone numbers, site interaction data.
Cookies and Tracking Identifiers
https://3dlab.co.id uses:
- Functional cookies - to maintain sessions and preferences (provided by Wix).
- Google Analytics and Google Tag Manager - to understand site usage.
- Ad click identifiers (gclid, gbraid, wbraid) - stored in your browser's localStorage for up to 90 days, used to attribute ad clicks to inquiries you send us. These identifiers do not contain directly identifiable personal data; they are random strings created by Google.
You can clear cookies/localStorage at any time via your browser settings. Doing so will stop ad attribution tracking.
Retention Periods
We keep your data for the following periods:
- Lead/contact data (name, phone, WhatsApp messages) — 2 years from last contact.
- Ad click identifiers (gclid/gbraid/wbraid) — 90 days.
- IP / User Agent hashes — 90 days.
- Transaction / accounting data — 10 years (per Indonesian Tax Law).
- WhatsApp history in Chatwoot — 2 years.
Your Rights Under PDP Law
Your Rights Under PDP Law
As a Data Subject, you have the right to:
- Access — request a copy of personal data we hold about you.
- Correction — correct inaccurate data.
- Deletion — request deletion of your data (except data we must retain for legal obligations).
- Withdraw consent — at any time, for consent-based processing.
- Restrict processing — request that processing stop for specific purposes.
- Data portability — receive your data in a machine-readable format.
- Object** to specific processing, including ad tracking.
- Lodge a complaint with the Indonesian Personal Data Protection Authority.
To exercise your rights, email hello@3dlab.co.id with subject "Personal Data Request". We will respond within 30 working days.
Data Security
We apply reasonable technical and organizational security measures, including:
- HTTPS/TLS encryption for site communication.
- Hashing of IP and User Agent (not stored in plaintext).
- Access to CRM systems limited to authorized employees.
- Third-party API keys and credentials stored in a vault with restricted access.
No system is 100% secure. If a data breach occurs, we will notify you and the relevant authorities as required by the PDP Law.
Children
Our services are intended for adults. We do not knowingly collect data from children under 17 without parental consent.
Cross-Border Data Transfer
Some of our service providers (Google, Wix) may process your data outside Indonesia. We ensure such transfers are conducted with adequate protections in line with the PDP Law, including standard contractual clauses with those providers.
Changes to This Policy
We may update this policy from time to time. Significant changes will be announced on this page with a new update date. Continued use of the site after changes means you accept the updated policy.
For questions about this policy or your data: