1. Who we are
PT Kuat Surya Raga ("KSR Group", "we", "us" or "our") is an Indonesian limited liability company based in Surabaya (NIB 2402230046303). For the personal data described in this policy, we are the personal data controller (pengendali data pribadi) under Law No. 27 of 2022 on Personal Data Protection (Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi, the "PDP Law").
Registered office: Japfa Indoland Center, Japfa Tower II Level 12, Embong Kaliasin, Genteng, Kota Surabaya, Jawa Timur, Indonesia. Email: support@ksrgroup.id. Phone and WhatsApp: +62 822-7781-8818.
2. What this policy covers
This policy applies to:
- this website, ksrgroup.id;
- the sale and customer service of BloomLab products, including orders placed through WhatsApp and through our stores on TikTok Shop, Shopee and Tokopedia;
- our business accounts on social media, messaging, advertising and marketplace platforms; and
- the in-house tools our team uses to manage those accounts through official platform APIs.
Visitors to bloomlab.id and trybloomlab.com should also read the privacy notice on those websites, which explains the cookies and analytics used there. The Bloom360 app is owned by PT Anugerah Wijaya Raga and has its own privacy policy at bloom360.id/privacy-policy.
3. Personal data we collect
Customers and people who contact us
Name, phone or WhatsApp number, email address, delivery address, order details (products, amounts, order and tracking numbers), payment status, the messages you send us, and any return or guarantee claim. Payments are handled by payment providers and marketplaces; we do not receive or store full card numbers.
Health information you choose to share
Some customers tell us about a health condition when they ask which product suits them. Health information is specific personal data under the PDP Law. We use it only to answer your question, and we ask you to share only what is needed.
Business contacts
Name, company, role, email address, phone number and our correspondence with partners, suppliers and service providers.
Visitors to ksrgroup.id
Our hosting provider processes technical data such as IP address, browser type, the page requested and the time of the request, to deliver the website and keep it secure. ksrgroup.id has no forms, does not set cookies and does not use analytics or advertising tags.
4. Data we receive from platforms and APIs
We use official platform features and APIs to run our brands' accounts and stores. Depending on the platform and the permissions the account owner grants, we may receive:
- TikTok (TikTok for Developers, TikTok API for Business and TikTok Shop): basic profile information of connected accounts, such as display name, profile picture and account identifiers; videos posted by those accounts and their details; performance metrics such as views, likes, comments and shares; comments on our content; advertising data such as campaign settings, spend and results, mostly in aggregate; and, for TikTok Shop, the product and order information needed to fulfil orders, including the buyer's name, phone number and delivery address as provided by TikTok Shop, returns and buyer messages.
- Meta (Facebook, Instagram, Threads, the WhatsApp Business Platform and Meta's advertising tools): business account and page information; the profile name and picture of people who interact with our accounts; messages, comments, replies, mentions and media; when interactions happen; and insights and advertising performance data.
- Google and YouTube (including the YouTube Data API, YouTube Analytics and Google Analytics): channel and video information, comments, performance metrics and website analytics reports, mostly in aggregate.
- Shopee, Tokopedia and other marketplaces (including the Shopee Open Platform): shop, product and order information; the buyer's name, phone number and delivery address for fulfilment; return requests; and chat messages with buyers.
- Payment and delivery providers: payment confirmations and shipment tracking status.
If you connect your own account to one of our tools, for example as a team member, creator or business partner, we receive only the information you approve on the platform's permission screen. We access platform data only through official APIs and never ask for your platform password.
5. How we use personal data
We use personal data only for the purposes below, each with a legal basis under the PDP Law.
| Purpose | What it involves | Legal basis |
|---|---|---|
| Orders and after-sales | Processing and delivering orders, returns, refunds and guarantee claims | Performance of a contract |
| Customer service | Answering questions on WhatsApp, email, social media and marketplace chat | Performance of a contract; legitimate interest |
| Brand accounts and content | Publishing posts and videos, replying to comments and messages, moderating our pages | Legitimate interest; consent where a platform requires it |
| Reporting | Reports on content, advertising and sales performance, mostly in aggregate | Legitimate interest; consent where required |
| Advertising measurement | Telling an advertising platform that an order or enquiry happened, with contact details hashed where the platform supports it, so it can report on our ads | Consent where required; legitimate interest |
| Marketing messages | Promotions and news by WhatsApp or email | Consent, which you can withdraw at any time |
| Security and legal duties | Preventing fraud and misuse, keeping tax and accounting records, responding to lawful requests | Legal obligation; legitimate interest |
We do not sell personal data. We do not use buyer data from a marketplace for marketing outside that marketplace, and we do not use data from platform APIs to build profiles of individuals beyond the purposes above.
6. Platform commitments
TikTok
We access TikTok data only through TikTok's official APIs after the account owner authorises our app, and we use it only as described in this policy and as TikTok's developer terms allow. You can remove our app's access at any time in your TikTok account settings. To ask us to delete TikTok data we hold, see Data deletion.
Google and YouTube
Some of our tools use YouTube API Services. By using a feature that connects to YouTube, you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy. You can revoke our access at any time on the Google security settings page.
KSR Group's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Meta
We use data from Meta products only to run our pages, accounts, messaging and advertising, under Meta's Platform Terms. You can remove our app in the "Apps and websites" section of your Facebook or Instagram settings. Instructions for deleting data we received from Meta are on our Data deletion page.
Marketplaces
Buyer data from TikTok Shop, Tokopedia, Shopee and other marketplaces is used only to fulfil and support that buyer's order. We do not try to reveal data that a marketplace masks, we contact buyers only in the ways the marketplace allows, and we delete buyer data within the periods each marketplace requires.
7. Who we share data with
- Service providers that work for us, such as cloud hosting and storage, email and messaging, payment, courier and business software providers. They may use the data only to provide their service to us.
- Platforms and marketplaces, when we use their services, for example to reply to a message, confirm an order or measure an ad.
- PT Anugerah Wijaya Raga, which owns the Bloom360 app, when your BloomLab order includes a Bloom360 membership, so that it can set up your membership. We share only what is needed, such as your name, phone number and order details.
- Authorities and advisers: courts, regulators and law enforcement when the law requires it, and our professional advisers under a duty of confidentiality.
- A successor business, if all or part of our business is reorganised or sold, under the protections of this policy.
We do not sell personal data.
8. Transfers outside Indonesia
Some of the providers and platforms we use store or process data outside Indonesia, for example in Singapore or the United States. When personal data is transferred outside Indonesia, we do so as the PDP Law allows: to a country with an equal or higher level of protection, under adequate and binding safeguards, or with your consent.
9. How long we keep data
| Data | How long we keep it |
|---|---|
| Orders and transactions | As long as needed for delivery, returns and guarantee claims. Transaction records are kept for up to 10 years where Indonesian tax and accounting law requires it. |
| Customer service conversations | Up to 2 years after our last contact with you. |
| Marketplace buyer details (name, phone number, address) | Only as long as needed to fulfil and support the order, and within each marketplace's limits. |
| Data from platform APIs (content, comments, metrics) | Only as long as the platform's developer terms allow. Reports that no longer identify anyone may be kept longer. |
| Connected accounts and access tokens | Until the account owner removes our access, the token expires, or we no longer need the connection. |
| Marketing consent | Until you withdraw it. |
| Website server logs | Generally no more than 30 days. |
When we no longer need personal data, we delete it or make it anonymous.
10. How we protect data
We protect personal data with encrypted connections (HTTPS), access controls that limit each person to the data their work needs, and confidentiality duties for our team and providers. Access to platform accounts and API credentials is restricted to authorised staff. If a personal data protection failure occurs, we will notify the people affected and the authorities as the PDP Law requires, within 3 x 24 hours.
11. Your rights
Under the PDP Law you have the right to:
- get information about who processes your data, why, and on what legal basis;
- access your personal data and get a copy;
- complete, update or correct your personal data;
- ask us to stop processing, delete or destroy your personal data;
- withdraw consent you have given;
- object to decisions based only on automated processing, including profiling, that have legal effects or a significant impact on you;
- ask us to delay or restrict processing;
- receive your personal data in a commonly used format and have it sent to another controller, where the law allows; and
- file a claim and receive compensation for violations, as the law provides.
To use a right, email support@ksrgroup.id with the subject "Privacy request". We may ask you to confirm your identity first. We respond within the time limits set by the PDP Law. Some requests may be limited where the law allows, for example when we must keep records for tax purposes. You may also complain to the Indonesian government authority responsible for personal data protection.
12. Children
Our products and services are intended for adults. We do not knowingly collect personal data from children without the consent of a parent or guardian, as the PDP Law requires. If you believe a child has given us personal data, contact us and we will delete it.
13. Cookies
ksrgroup.id does not use cookies. Our brand websites use cookies as explained in their own privacy notices. Our in-house tools may use essential cookies to keep authorised users signed in.
14. Changes to this policy
We may update this policy from time to time. The date at the top of this page shows the latest version. If a change significantly affects how we use your personal data, we will tell you through our websites or by email or message.
15. Contact us
PT Kuat Surya Raga (KSR Group), attention: Privacy
Japfa Indoland Center, Japfa Tower II Level 12, Embong Kaliasin, Genteng, Kota Surabaya, Jawa Timur, Indonesia
Email: support@ksrgroup.id (subject: Privacy request)
Phone and WhatsApp: +62 822-7781-8818