Privacy Policy

PT. ART WORKSHOP BALI ("3D Lab Bali", "we", "us") is a 3D printing service company located at Perum Gading Kencana No. SH-10, Jimbaran, Bali 80361, Indonesia. We respect your privacy and are committed to protecting personal data you provide when using https://3dlab.co.id or contacting us via WhatsApp, phone, email, or Google Business Profile.

This policy explains what data we collect, how we use it, which third parties may receive it, and your rights under Indonesian Law No. 27 of 2022 on Personal Data Protection ("PDP Law").

Data you provide directly:

• Name, phone/WhatsApp number, email address
• Message content and service requests (including design-file attachments such as STL, OBJ, 3MF, STEP)
• Project details and product descriptions

Data from the order form on this site:

• Name, email and/or phone, description, STL file link, and any file you upload
• The page and language the form was sent from, and the time it was sent
• The result of the Cloudflare Turnstile bot check (for which Cloudflare processes your IP address and browser signals)

Data collected automatically when you visit the site:

• Pages visited, referrer URL, date and time, and device and browser type (through Google Analytics)
• Ad click identifiers: gclid, gbraid, wbraid (from Google Ads)

When you tap a WhatsApp button on this site:

• A random reference code ("Quote ID") added to your WhatsApp message
• The ad click identifiers above (if you came from a Google ad)
• A random per-tab session ID
• Your IP address and browser, as hashes only (never in plain text)

Data collected via WhatsApp:

• Conversation history (stored in our Chatwoot CRM)
• Sender's phone number
• Conversation status and labels

Data generated through business processes:

• Deal/quote status and value
• Order history and invoices (for accounting purposes)

We use your data to:

• Provide quotes and 3D printing/scanning/modeling services you request
• Communicate with you via WhatsApp, phone, or email
• Measure the effectiveness of our Google Ads campaigns (conversion attribution)
• Process payments and meet tax/accounting obligations via Jurnal.id
• Improve our services and website
• Comply with legal obligations

We process your data based on:

• Your consent — when you message us via WhatsApp, submit a form, or continue using the site after reviewing this policy.
• Contract performance - to fulfill orders/services you request.
• Our legitimate interests - ad measurement, fraud prevention, service improvement.
• Legal obligations - tax and accounting record retention.

We share data with the following service providers as needed for operations:

• Cloudflare, Inc. — website hosting, the Turnstile bot check, and storage of form submissions and uploaded files. Accesses: form content, uploaded files, IP address and browser signals (for Turnstile and security).
• Resend — sends our team the notification email for each form submission. Accesses: form content.
• Google LLC — Ads, Analytics, Tag Manager, Business Profile, Search Console, Google Workspace (email). Accesses: click identifiers (gclid/gbraid/wbraid), hashed phone numbers, site interaction data, email.
• Meta Platforms (WhatsApp) — sending and receiving WhatsApp messages. Accesses: phone number and conversation content.
• DigitalOcean — servers that run our CRM and Chatwoot. Accesses: data stored in the CRM.
• Jurnal.id — accounting and invoicing. Accesses: transaction and invoice data.

https://3dlab.co.id uses:

• Google Analytics and Google Tag Manager - Google cookies (such as _ga) to understand site usage and measure ads.
• Ad click identifiers (gclid, gbraid, wbraid) - stored in your browser's localStorage (wa_attr) for up to 90 days, used to attribute ad clicks to inquiries you send us. These identifiers are random strings created by Google and do not contain directly identifiable personal data.
• WhatsApp session ID - a random value in sessionStorage (wa_session_id), deleted automatically when you close the browser tab.
• Cloudflare Turnstile - a bot check on the order form; not used for advertising.

The site sets no advertising cookies other than Google's above. You can clear cookies/localStorage at any time via your browser settings. Doing so will stop ad attribution tracking.

We keep your data for the following periods:

• Order form submissions on the site (including uploaded files) — 24 months, then deleted automatically.
• Lead/contact data (name, phone, WhatsApp messages) — 2 years from last contact.
• Ad click identifiers (gclid/gbraid/wbraid) — 90 days.
• IP / User Agent hashes — 90 days.
• Transaction / accounting data — 10 years (per Indonesian Tax Law).
• WhatsApp history in Chatwoot — 2 years.

As a Data Subject, you have the right to:

• Access — request a copy of personal data we hold about you.
• Correction — correct inaccurate data.
• Deletion — request deletion of your data (except data we must retain for legal obligations).
• Withdraw consent — at any time, for consent-based processing.
• Restrict processing — request that processing stop for specific purposes.
• Data portability — receive your data in a machine-readable format.
• Object to specific processing, including ad tracking.
• Lodge a complaint with the Indonesian Personal Data Protection Authority.

To exercise your rights, email hello@3dlab.co.id with subject "Personal Data Request". We will respond within 30 working days.

We apply reasonable technical and organizational security measures, including:

• HTTPS/TLS encryption for site communication.
• Hashing of IP and User Agent (not stored in plaintext).
• Access to CRM systems limited to authorized employees.
• Third-party API keys and credentials stored in a vault with restricted access.

No system is 100% secure. If a data breach occurs, we will notify you and the relevant authorities as required by the PDP Law.

Our services are intended for adults. We do not knowingly collect data from children under 17 without parental consent.

Some of our service providers (Cloudflare, Resend, Google, Meta, DigitalOcean) may process your data outside Indonesia. We ensure such transfers are conducted with adequate protections in line with the PDP Law, including standard contractual clauses with those providers.

We may update this policy from time to time. Significant changes will be announced on this page with a new update date. Continued use of the site after changes means you accept the updated policy.

Last updated: 19 October 2026.

For questions about this policy or your data: hello@3dlab.co.id