Privacy Policy

1. Who is responsible

PT HIGH TIDE BALI is an Indonesian company, NIB 1606230133733. Our registered address is Jalan Beranda Hijau II No. 17, Desa/Kelurahan Jimbaran, Kec. Kuta Selatan, Kab. Badung, Provinsi Bali, Kode Pos: 80361, Indonesia. In this policy, "HTB Maju", "we" and "us" refer to this legal entity.

We act as the controller for information we use to manage our own inquiries and business relationships. If we process personal information on behalf of an authorized brand, seller, team or creator, our role and instructions are governed by the relevant service agreement and applicable law. Contact our privacy contact at [email protected].

2. Information we handle and where it comes from

• Inquiries: your name, email address, brand / team / creator name or handle, service interest, message and any follow-up details you choose to send.
• Relationship information: where a collaboration proceeds, relevant business contacts, agreed briefs, permissions, contracts, campaign communications and commercial records. Additional information needed for an engagement will be explained when requested.
• Technical requests: an online hosting, delivery or security provider may process IP addresses, request times, requested URLs, browser or device information and security events to deliver and protect the website. This is separate from inquiry content.
• External font delivery: the main website requests fonts from Google Fonts. Google receives ordinary connection metadata, including your IP address, browser request information and potentially a referrer subject to browser and website controls.

The contact form does not transmit its contents to a website backend, save them in browser storage or create an account. Selecting "Prepare email" opens a draft in your chosen email application. We receive the inquiry only if you send it or otherwise contact us. The website does not connect to the TikTok Shop API or collect TikTok passwords, access tokens, buyer records or payment-card details.

Please share only information needed for your request. Do not send passwords, authentication codes, payment-card details, sensitive personal information or another person's private information without authority.

3. Purposes and legal grounds

We use relevant information to respond to inquiries, assess collaboration opportunities, discuss or perform agreed services, manage permissions and business records, protect our communications and website, and comply with applicable legal obligations or handle disputes.

Depending on the context and applicable Indonesian data protection law, we rely on your consent, steps requested before entering a contract or performance of a contract, legal obligations, or legitimate interests in secure operations and appropriate business administration after considering your rights. When consent is required, we request it separately and explain the purpose. Consent to an inquiry response is not consent to unrelated marketing or TikTok account access.

Providing inquiry information is voluntary, but we may be unable to respond or arrange a collaboration without sufficient contact and request details. We do not use this website to make solely automated decisions producing legal or similarly significant effects about you.

4. TikTok Shop information and authorization

No TikTok Shop API integration is currently active on this website. A technology roadmap is not a statement that an application is approved or that we already hold platform data. The following restrictions apply if an authorized TikTok Shop-related engagement is activated:

• Before accessing account or partner information, we require the relevant lawful written approval and explicit account authorization, a service agreement and the necessary platform permissions. Browsing this website or sending an inquiry grants no such access.
• Before collection begins, the engagement-specific notice must identify actual data categories, approved API scopes, purposes, recipients and retention arrangements. Depending on the approved service, these may concern creator profiles, product or sample coordination, campaign performance or commission information. This policy does not authorize access to every category.
• We process only the information needed for the authorized service, within the applicable TikTok Shop Partner Center and Developer Terms, platform restrictions, the service agreement and lawful instructions.
• We do not sell or trade partner data, aggregate it for our own purposes, build unauthorized profiles, or use it for unrelated advertising, unsolicited bulk messaging or other unauthorized purposes.
• Sharing partner data with a third party requires the end user's express permission and any other necessary lawful authorization. Approved processors must be bound by appropriate confidentiality, security and purpose restrictions.
• When approval is revoked, we stop accessing and using the affected partner data immediately. We also stop future retrieval, remove access credentials under our control and arrange deletion of information no longer lawfully required, subject to applicable platform obligations.

You can revoke an available platform authorization through the relevant TikTok Shop authorization settings and contact us using section 10. Revoking access does not automatically erase information independently held by TikTok or other parties. Where we act as a processor, we assist the responsible end user with lawful requests rather than making independent use of their data.

5. Recipients and international processing

Inquiry information is shared only as needed with personnel handling the relationship and providers supporting communications, hosting, security or professional advice, under appropriate restrictions. Your selected email provider, our receiving email provider also process communications under their own applicable terms. We may disclose information where legally required, to protect legal rights or respond to a lawful authority request, limited to what is necessary.

Communication, font and hosting infrastructure may process data outside Indonesia. Before arranging an overseas transfer under our control, we assess the applicable transfer requirements, including the required level of protection, binding safeguards or consent where permitted and necessary. Contact us for information about recipients and transfer safeguards relevant to your relationship. We do not sell or rent personal information.

6. Retention and deletion

We retain information only while it is needed for the stated purpose or a specific lawful obligation. Inquiry correspondence is kept while we address the request and any reasonably necessary follow-up; if no engagement results and no further lawful purpose remains, it is deleted. Engagement records are retained for the service and any applicable accounting, tax, recordkeeping or legal-claim requirements. There is no single retention period for all of these records.

For authorized platform data, the service-specific retention schedule and any shorter platform or legal limits apply. We promptly delete data we no longer need and follow applicable deletion obligations on revocation, service termination or termination of developer access. A legal retention exception is not permission for continued operational use. Any record that must be retained is restricted to the legally required purpose and period. Deletion includes working copies under our control; residual backup copies must remain restricted and be removed through the relevant backup lifecycle, subject to any stricter platform requirement.

You may request deletion at any time through section 10. We will explain any lawful reason preventing complete or immediate deletion and the scope and duration of the exception.

7. Security

We are responsible for taking reasonable technical and organizational measures appropriate to the information and processing risks. This static website has no account database or API credentials. The published site must be served over HTTPS; HTTPS protects website traffic in transit, not every downstream email or messaging system. No transmission or storage method is completely secure.

Any platform integration must meet applicable TikTok Shop security requirements before activation, including appropriate access restrictions, secure authentication, encrypted transport, protected credentials and incident procedures. This policy is not a claim of ISO 27001, SOC 2 certification or end-to-end encryption. If a personal data breach triggers notification duties, we will notify affected people, responsible clients, relevant authorities and/or the platform as required by applicable law and contractual obligations.

8. Your rights and choices

Subject to applicable law, including Indonesia's Law No. 27 of 2022 on Personal Data Protection (UU PDP), you may request information about processing, access to or copies of your data, correction or completion, cessation or restriction of processing, deletion or destruction, withdrawal of consent and portability where applicable. You may also object to qualifying automated decisions, raise a complaint and seek available remedies under applicable law.

Send a request to the contact in section 10. Please describe the information or relationship concerned and the right you wish to exercise. We may request proportionate verification to protect against unauthorized disclosure; do not send an identity document unless a secure, necessary verification method has been agreed. We respond within the applicable legal deadlines, explain any lawful refusal or limitation, and assist with requests to the responsible controller where we are only a processor. Withdrawal does not affect processing lawfully completed before withdrawal and may prevent us from continuing a service that needs the information.

This website configures no advertising pixels, behavioral analytics, non-essential cookies or local-storage tracking. Language preferences are carried in URL parameters between pages, not stored in cookies or local storage. Your browser, email application and external providers may have their own settings. Our services are directed to adults and authorized business or creator representatives, not children. If you believe a child has supplied personal information, contact us so we can assess and remove it as appropriate.

9. Changes to this policy

We update the date above when this policy changes. Material changes in data collection or purposes will be explained before the new processing begins, with additional notice or consent where required. An update does not retroactively authorize a new use of partner data.

10. Privacy requests and contact

Privacy contact - PT HIGH TIDE BALI / HTB Maju
Email: [email protected] (subject: "Privacy request" or "Data deletion request")
Registered address: Jalan Beranda Hijau II No. 17, Desa/Kelurahan Jimbaran, Kec. Kuta Selatan, Kab. Badung, Provinsi Bali, Kode Pos: 80361, Indonesia.