Skip to content

Premium hijabs, carefully chosen

SONAPremium Hijabs

SONA

Privacy Policy

What data we process, what for, and what rights you have over it.

1. Data controller

Responsible for the processing of personal data on this site:

Nurmansih Maringka
Am Hang 6
28832 Achim
Deutschland
ramadhaniur090@gmail.com

For any question about your personal data, write to the address above.

We do not use automated decision-making or profiling. We do not sell or rent customer data to anyone.

2. Hosting

This site is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When a page is opened, Vercel processes technical access data as a processor on our behalf.

The database, customer accounts and orders are held at Supabase. The server location and provider for Indonesia are not yet settled — the database project has not been created.

Both services mean personal data is processed outside Indonesia. The PDP Act permits this only where the receiving country offers an equivalent level of protection, or binding safeguards are in place, or you consent. Which of these applies here still has to be established and documented.

Basis for processing: our legitimate interest in providing this site securely and reliably.

Server logs

Every time a page is opened, the following is recorded automatically:

This data is technically necessary to deliver the page and keep it secure. We do not combine it with other sources.

3. Fonts

This site uses the typefaces “Cormorant Garamond” and “Montserrat”. Both are stored on our own server and served from there. There is no connection to Google Fonts or any other external provider, and no data is passed to third parties.

4. If you contact us

If you email us or use the contact form, we process what you send purely to answer your enquiry. The basis is performance of the contract where the question concerns an order, and our legitimate interest otherwise. We delete the data once the matter is closed, unless the law requires us to keep it.

If you reach us via WhatsApp, your phone number and the content of your message are also processed by WhatsApp's provider under their own policy. See section 8.

5. Orders and payment

When you order, we process what the contract requires: name, delivery and billing address, email address, phone number, the items ordered, the amount, and the payment status. The basis is performance of the sales contract.

Payment provider

PT Midtrans’ full address and the data processing agreement with them still have to be filled in here before the shop opens.

Payments are processed for us by PT Midtrans. Once you choose how to pay, you are taken to the Midtrans page and enter your payment details there. Card and account numbers never reach our servers — we learn only whether the payment succeeded, which method was used, and for how much. What we pass to Midtrans: the order number, the amount, your name, email address and phone number.

Delivery

The delivery service is not yet settled.

To deliver, we pass your name and delivery address to the carrier. Without that, the parcel cannot be delivered. The basis is performance of the contract.

How long data is kept

How long order and invoice data must be kept under Indonesian tax and bookkeeping rules has not been established.

During that period the data is locked against other uses and held only to meet the legal obligation. Once the period has passed, it is deleted.

Customer account

An account is optional — you can order without one. If you create one, we store your email address, your password in encrypted form, and your order history so you can look it up later. The basis is performance of the contract.

You can ask for your account to be deleted at any time. Retention obligations for orders already placed apply separately from that.

6. Newsletter

For the newsletter we use double opt-in: after you sign up we send an email with a confirmation link. Only once you click it do you join the list. If you do not confirm, you receive nothing.

What we store: the email address, the time of signup and of confirmation, and which page you signed up from. We keep the time and origin as evidence that the signup really came from you.

The basis is your consent. You can withdraw it at any time via the unsubscribe link in every email, without giving a reason. Withdrawal takes effect from that moment and does not make earlier sendings unlawful.

The emails are sent by an email service provider. That provider is not yet settled and must be named here before the shop opens.

7. Following up after a purchase

After a purchase we may send one email asking whether the item worked out. The basis is our legitimate interest in improving the products and the service.

You can decline such emails at any time via the link inside them or by sending us a short message. Emails tied directly to an order — confirmations, invoices, shipping notices — are not advertising and are not affected.

8. Cookies and storage on your device

This site sets no cookies. What we store sits in your browser's local storage and never leaves your device:

Basket
so your selection survives while you keep browsing
Recent search terms
for you alone, as a convenience in the search box
Your privacy choice
so we do not ask again on every visit

To sign in to an account, our provider Supabase sets one session cookie. It is required for signing in and is only set if you actually sign in.

All of this is necessary for the service you asked for yourself, and so needs no separate consent.

Statistics and advertising

Anything beyond that — measuring visits, or evaluating advertising — we load only after you agree. Until you do, none of it is loaded at all; it is not enough for us merely not to evaluate it.

You can change or withdraw your decision at any time via the Privacy settings link at the foot of every page. Withdrawal takes effect from that moment and does not make earlier processing unlawful.

Measuring visits

If you agree to the “Statistics” category, we count which pages are opened using Vercel Web Analytics. The service works without cookies and puts nothing on your device. It processes the page view, the rough origin, the device, and the IP address; from the IP address Vercel derives an identifier from which no person can be worked out, and it does not store the address itself.

The basis is your consent. Without it the counting script is not loaded at all. The provider is Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA.

WhatsApp

On the product pages and at the checkout there is a button that opens a WhatsApp conversation. It is an ordinary link — as long as you do not press it, nothing is loaded from WhatsApp.

Once you do, WhatsApp's provider processes your phone number and the content of your message under its own responsibility and privacy policy. If you would rather not, you can reach us just as well by email at ramadhaniur090@gmail.com.

Remembering your details at the checkout

At the checkout you can tick a box to have your details kept for next time. They then sit only in the browser on this device — not with us. What is stored: email address, phone number and delivery address. Payment details are never included; they never reach our servers in the first place.

Storage begins when you tick the box and ends when you untick it on your next order. You can also delete the details yourself at any time by clearing site data in your browser. Without the tick, nothing is stored.

9. Your rights over your data

Under the Personal Data Protection Act you have the right to:

An informal message to the email address in section 1 is enough. We charge nothing for it.

Some of these rights have limits: order data we are required to keep for tax purposes cannot be deleted before that period ends. In that case we lock the data rather than delete it.

10. Complaints

If you think we have handled your data wrongly, tell us first — we respond to every complaint.

You are also entitled to complain to the data protection supervisory authority. The supervisory body and where complaints go still need to be established before the shop opens.

11. Encryption

This site is served only over an encrypted connection (HTTPS). You can see this in your browser's address bar.

Last updated: August 2026