Version 1.0 · Effective 24 September 2026

This policy explains how Kopi Rider collects and uses your personal data, in line with Indonesia’s Personal Data Protection Law (Law No. 27 of 2022) and, where it applies, the EU General Data Protection Regulation (GDPR).

1. Who we are

Kopi Rider is responsible for your personal data (the “data controller”). Kopi Rider is registered in Indonesia (business identification number available on request). Privacy contact: info@kopirider.com.

2. What we collect

2.1 Booking requests: your name and WhatsApp number, and the details of your event — date, type of event, number of guests, package and location.

2.2 Messages: what you send us on WhatsApp, Instagram or TikTok, including conversations with our WhatsApp booking assistant.

2.3 Bookings and payments: your quote, invoices and payment status. Online payments are processed by Midtrans; we do not receive or store your full card details. When you pay at the truck, the payment goes through our point-of-sale system (Moka).

2.4 Allergies and dietary needs: only if you tell us, so we can serve you safely.

2.5 Photos and video: images from events and around the truck (see section 7).

2.6 Website use: technical data such as your device, browser and IP address, and — only if you accept them — analytics and marketing cookies (see our Cookie Policy).

3. Why we use your data, and our legal basis

• To answer your request and prepare a quote — steps you ask us to take before a contract.
• To manage your booking and take payment — performance of our contract with you.
• To handle allergy and dietary information — your explicit consent, which you give when you share it with us.
• To send you news and offers — your consent, which you can withdraw at any time.
• To publish photos or video in which you can be recognised — your written consent.
• To keep accounting and tax records — our legal obligations.
• To keep our website secure and improve our service — our legitimate interests, balanced against your rights.

4. Who we share your data with

We share only what is needed, with:

• Midtrans — to process online payments;
• Moka — our point-of-sale system, for payments at the truck;
• Meta (WhatsApp and Instagram) — when you contact us there, and to run our WhatsApp booking assistant;
• TikTok — when you contact us there;
• our hosting provider — who hosts our website;
• our website developer — to maintain the website;
• partner restaurants and bakeries — only your name, event date and dietary needs, when they prepare food for your booking;
• authorities — when the law requires it.

We never sell your personal data.

5. Transfers outside Indonesia

Some of these providers store or process data outside Indonesia. When we transfer your data abroad, we do so as Indonesian law requires — for example to countries or recipients with an equal or higher level of protection, under appropriate safeguards such as contract clauses, or with your consent.

6. Our WhatsApp booking assistant

The first part of a WhatsApp conversation may be handled by an automated assistant that checks our available dates and answers booking questions. It is a booking assistant only, and you can ask for a person at any time. It does not make decisions with legal or similarly significant effects for you — a member of our team confirms every booking.

7. Photos and video

We only publish photos or video in which you can be recognised if you have given written consent — for example by ticking the photo box on our booking form or signing a consent form at the event. You can withdraw consent for future use at any time. We will then stop using the images, but we may not be able to remove copies that others have already shared.

8. How long we keep your data

• Requests that do not become bookings: kept for up to 12 months, then deleted. A request only becomes a booking when the 50% deposit is paid.
• Booking and payment records: as long as Indonesian tax and accounting law requires.
• Allergy and dietary requests: kept with your booking records.
• News and offers: until you unsubscribe.
• Photos and video with consent: until you withdraw consent.
• WhatsApp conversations: for as long as we use WhatsApp for our business.

9. Your rights

You have the right to: know how your data is used; get a copy of it; have it corrected or completed; have it deleted; withdraw your consent; object to or limit how we use it; receive it in a commonly used format; and complain. To use these rights, email info@kopirider.com or use the WhatsApp button on our website. We reply within the time limits set by Indonesian law — for requests to access your data, within 3 × 24 hours. Withdrawing consent does not affect what we did before you withdrew it.

10. Security

We protect your data with reasonable technical and organisational measures, including secure (HTTPS) connections, access controls and trusted providers.

11. If something goes wrong

If a data breach affects your personal data, we will inform you and the relevant authority in writing within 3 × 24 hours, as Indonesian law requires.

12. Children

Bookings are made by adults. We do not knowingly collect personal data from children without the involvement of a parent or guardian.

13. Changes to this policy

We may update this policy. The current version is always on this page, with its effective date.

14. Contact and complaints

Questions or complaints: info@kopirider.com. You can also contact the Indonesian authority responsible for personal data protection. If you live in the European Union, you can also complain to your local data protection authority.