Privacy policy

Last updated: 2026-09-23.

Controller

Bulan Juli Limited, Unit 909, Prosperity Millennia Plaza, 663 King's Road, Quarry Bay, Hong Kong. Company Registration No. 76938968 · Business Registration No. 76938968-000. Contact: info@allindonesia-arrivalcard.com.

Data we collect

• Identity and passport details of each traveler (name, date of birth, gender, nationality, passport number and dates), and for e-VOA orders a scan of the passport bio page and a passport-style photo.
• Travel details (dates, flight, port of entry, accommodation) and the health and customs declarations you make.
• Contact details (email, phone) and order records. Card details are processed by our payment provider and never stored by us.

Purpose and legal basis

To perform the contract you place with us: preparing and submitting your arrival card and delivering the result. Also to comply with legal obligations (accounting, fraud prevention) and, with your consent, to send service reminders.

Sharing

Your data is entered into the official Indonesian government portal to submit your arrival card. It is also processed by our hosting, database, email and messaging providers under data-processing agreements. We never sell personal data.

International transfers

Data is stored in Singapore and processed by our team in Hong Kong and Indonesia. Transfers are protected by contractual safeguards meeting the standards of Indonesia's Personal Data Protection Law and the GDPR.

Retention

Passport and declaration data, including uploaded passport scans and photos, is deleted 30 days after your arrival date. Order and payment records are kept for 7 years as required by accounting law, without passport data.

Your rights

You may request access, correction, deletion or a copy of your data, withdraw consent and lodge a complaint with a supervisory authority. Write to info@allindonesia-arrivalcard.com. We respond within 3 working days.

Security

Encryption in transit and at rest, role-based access for our team, audit logs, and breach notification to affected persons and authorities within the legally required period (3×24 hours under Indonesian law).

Cookies

We use Google Analytics 4 and the Meta (Facebook) Pixel, including their server-side interfaces (Google Analytics Measurement Protocol and Meta Conversions API), to measure visits and advertising conversions. For a completed order we send Google and Meta the order value and a hashed (irreversible) version of your email address, phone number, name and nationality, together with your IP address, browser identifier and advertising click identifiers, so that the advertising platforms can attribute the purchase to an advertisement. Nothing about your passport or your declarations is sent to them. You can opt out through the settings of those platforms or by using a browser that blocks their scripts.