Privacy Policy
Last updated: 16 October 2026
We collect only the personal data we need to prepare and deliver your private chef, catering and food orders, and we never sell it. This policy explains what we collect, why, who we share it with and how you can control it, in line with Indonesian Law No. 27 of 2022 on Personal Data Protection (PDP Law) and its implementing regulation, Government Regulation No. 33 of 2026.
Who is responsible for your data
PT Nardin Ventures Group, operating as Aperitivo Bali, is the data controller. Contact for any privacy question: hello@aperitivobali.com or WhatsApp +62 882 4522 7202.
What we collect
| Category | Examples | When |
|---|---|---|
| Identity and contact | Name, phone or WhatsApp number, email, company name | When you use our contact form, write to us, request a quote or book |
| Event and delivery details | Villa or venue address, Google Maps link, date and time, number of guests, occasion, villa manager contact | When you book a service or place an order |
| Dietary and health information | Food allergies, intolerances, dietary needs | Only if you share it, with your explicit consent |
| Payment information | Bank transfer details, invoice and payment records | When you pay a deposit, balance or order |
| Communications | WhatsApp, email and Instagram messages with us | When you write to us |
| Photos and videos | Pictures of our food and set-ups taken during your event | Only with your agreement if you or your guests can be identified |
| Website data | IP address, browser, pages visited, cookies | When you browse this website |
We do not store card numbers. Card payments made through booking platforms (Grab, Gojek, Klook, Airbnb) are processed by those platforms under their own privacy policies.
Why we use it and on what legal basis
| Purpose | Legal basis under the PDP Law |
|---|---|
| Prepare quotes, confirm bookings, cook, deliver and serve | Performance of a contract with you |
| Adapt menus to allergies and dietary needs | Your explicit consent |
| Invoicing, accounting and tax records | Compliance with our legal obligations |
| Answer your questions and follow up after an event | Our legitimate interest in serving our clients |
| Send news and offers | Your consent, which you can withdraw at any time |
| Post event photos on our website or social media | Your consent |
| Website security and statistics | Our legitimate interest, and your consent for non-essential cookies |
Who we share it with
We share only what each party needs to do its part:
- Our chefs, kitchen and service staff, who prepare and serve your event
- Villa managers, property managers or partners who referred or host your booking, to coordinate access and logistics
- Booking and delivery platforms you used to order (Grab, Gojek, Klook, Airbnb)
- Our banks and payment providers, to process payments
- Our external accountants and tax advisers
- Our IT and communication providers (website hosting, email, WhatsApp, cloud storage)
- Public authorities, when the law requires it
All of them may only use your data for the service they provide to us or to you.
Transfers outside Indonesia
Some of our providers, such as email, messaging and cloud services, store data outside Indonesia. When this happens, we rely on providers that offer a level of protection equivalent to Indonesian law, or on appropriate safeguards, as required by the PDP Law.
How long we keep it
- Booking and event details: up to 2 years after your last booking, so we can serve you again
- Allergy and dietary information: deleted after your event, unless you ask us to keep it for future bookings
- Invoices and accounting records: 10 years, as required by Indonesian tax law
- Marketing contacts: until you unsubscribe or withdraw consent
- Event photos: until you ask us to remove them
Your rights
Under the PDP Law you can:
- Get information about how we use your data and access a copy of it
- Correct or update inaccurate data
- Ask us to delete your data or stop processing it
- Withdraw your consent at any time, without affecting what was done before
- Object to processing based on our legitimate interest, including direct marketing
- Receive your data in a usable format
- Complain to the Indonesian personal data protection authority
To use any of these rights, contact us by email or WhatsApp. We will answer within the time limits set by Indonesian law. We may ask you to confirm your identity first.
Security
Access to your data is limited to the people who need it. We use password-protected accounts and reputable providers. If a data breach puts your rights at risk, we will notify you and the authorities as required by law.
Cookies
Our website uses essential cookies to work properly. With your consent, we also use analytics and advertising cookies (Google Analytics / Meta Pixel) to understand how visitors use the site and to measure our ads. You can accept or refuse them in the cookie banner and change your choice at any time in your browser settings.
Children
Our services are booked by adults. We do not knowingly collect data from anyone under 18 without the consent of a parent or guardian. Children's dietary needs shared by a parent for an event are handled with the same care as any allergy information.
Changes to this policy
We may update this policy. The date at the top shows the latest version. Significant changes will be announced on this website.