The primary controller responsible for the processing of personal data through www.ticketothemoon.com and our related customer management and operational activities is:

PT Ayunan Bulan International
Jalan Batu Sangian VI No. 10
Kuta Utara, Bali 80361
Indonesia
Trading as Ticket to the Moon
Email: contact@ticketothemoon.com
Phone: +62 361 419 288

PT Ayunan Bulan International manages Ticket to the Moon's customer and operational systems and determines the purposes for which customer personal data is processed in connection with our website, order administration, customer service, warranties and related business operations.

European Union representative

For matters relating to the GDPR, our representative in the European Union is:

Ticket to the Moon GmbH
Vienna, Austria

You may contact our EU representative regarding questions about the processing of your personal data or the exercise of your rights under the GDPR.

Email: contact@ticketothemoon.com

Contracting and payment entity

Products purchased through www.ticketothemoon.com are sold by:

TICKETTOTHEMON, LLC

TICKETTOTHEMON, LLC acts as the contracting and payment entity for purchases made through the online store and receives or processes the information necessary to administer transactions and payments.

This may include your name, billing information, order details, payment status, refunds and other information required to process the transaction and comply with applicable accounting, tax and legal obligations.

Complete payment-card details are generally processed directly by the applicable payment service provider and are not independently stored by Ticket to the Moon.

Ticket to the Moon GmbH and marketing

Ticket to the Moon GmbH may receive and process certain customer information for our European operations, including newsletter and marketing activities.

Where Ticket to the Moon GmbH determines the purposes and means of such processing for its own activities, it acts as a controller for that processing.

Marketing communications are sent only where permitted under applicable law. Where processing is based on consent, you may withdraw your consent at any time by using the unsubscribe link in the relevant communication or by contacting us.

Depending on how you interact with us, we may collect the following categories of personal data:

Identification and contact information

This may include your:

• name;
• email address;
• telephone number;
• billing and shipping address;
• country; and
• language.

Order and transaction information

This may include:

• products purchased;
• order number and order history;
• purchase price and currency;
• payment and refund status;
• billing information;
• shipping and delivery information;
• returns;
• warranty information; and
• tax or VAT information where applicable.

Customer account information

If you create or use a customer account, we may process account details, preferences and communication preferences associated with that account.

Customer service and warranty information

When you contact us, we may process:

• your correspondence with us;
• customer service requests;
• warranty, repair or return requests;
• photographs or documents you voluntarily provide; and
• information necessary to resolve your request.

Technical and website information

When you use our website, we may process information such as:

• IP address;
• browser and device information;
• website activity;
• cookie and similar technology identifiers;
• approximate location derived from technical information; and
• referring websites or marketing sources.

Marketing information

Where applicable, we may process:

• newsletter subscriptions;
• marketing preferences;
• consent records; and
• interactions with our marketing communications and advertisements.

We do not intentionally request special categories of personal data, such as health information, religious beliefs, political opinions or biometric data, as part of our normal online-store activities.

We process personal data only where we have an appropriate legal basis.

Performance of a contract

We process personal data where necessary to:

• process and fulfil your order;
• process payments and refunds;
• arrange shipping and delivery;
• manage your customer account;
• communicate with you about your order;
• process returns;
• process warranty and repair claims; and
• respond to requests relating to your purchase.

Legal obligations

We may process and retain information where necessary to:

• comply with tax, accounting and VAT requirements;
• maintain legally required transaction records;
• comply with consumer-protection obligations;
• respond to lawful requests from authorities; and
• comply with other applicable legal obligations.

Legitimate interests

Where permitted by law, we may process personal data for legitimate business interests such as:

• operating and improving our website and services;
• managing customer relationships;
• maintaining the security of our systems;
• preventing fraud and misuse;
• understanding the performance of our products and services;
• internal administration; and
• establishing, exercising or defending legal claims.

Where we rely on legitimate interests, we consider the interests, rights and freedoms of the individuals concerned.

Consent

Where required by law, we ask for consent before:

• sending certain marketing communications;
• using non-essential cookies; or
• using certain analytics and advertising technologies.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before your consent was withdrawn.

Our online store is operated using Shopify.

When you browse our online store, create an account, place an order or otherwise interact with the store, personal data may be processed through Shopify. This may include your contact details, billing and shipping information, order information, IP address, device information and other transaction-related information.

Shopify acts as a processor of customer personal data on our behalf for many of the services we use. For certain Shopify consumer or enhanced services, Shopify may process personal data for its own purposes in accordance with its applicable terms and privacy information.

Shopify operates an international infrastructure. Certain merchant, order and customer data may be stored at rest in Europe, while personal data may also be processed internationally by Shopify group companies and authorized service providers.

Where international transfers are subject to the GDPR, Shopify uses applicable safeguards and transfer mechanisms in accordance with data protection law.

More information about Shopify's processing of personal data is available in Shopify's Privacy Policy.

We use Odoo for enterprise resource planning (ERP), customer relationship management (CRM), order administration and other operational activities.

Personal data processed through Odoo may include:

• customer contact information;
• order information;
• delivery information;
• invoice and transaction information;
• customer service correspondence;
• warranty and repair information; and
• other information necessary to administer our relationship with you.

Customer information stored in Odoo may be accessed by authorized personnel of PT Ayunan Bulan International and, where required for its activities, Ticket to the Moon GmbH.

Access is limited according to operational requirements and user permissions.

Odoo and its infrastructure or authorized service providers may process or access information from different countries. Where GDPR-protected personal data is transferred internationally, applicable data-transfer safeguards are used where required.

Payments are processed through payment service providers available through our online store.

Depending on the payment method you select, information required to process the payment is transmitted to the relevant payment provider.

We generally do not independently receive or store your complete credit or debit card number.

Payment providers process payment information according to their own legal, security and data-protection obligations.

To fulfil and deliver your order, we may provide necessary personal data to shipping, postal, courier, logistics and fulfilment providers.

This may include:

• your name;
• delivery address;
• telephone number;
• email address;
• shipment or order reference; and
• information required for customs clearance where applicable.

Only information reasonably necessary for the relevant service is provided.

For international shipments, information may also be provided to customs authorities or other public authorities where legally required.

We may process or disclose relevant personal data where necessary for accounting, tax, VAT, auditing and legal compliance.

This information may be provided to accountants, tax advisers, auditors, legal advisers, tax-compliance providers and competent authorities where necessary.

The information processed for these purposes may include transaction details, invoices, billing information, shipping information and VAT or tax information.

We use cookies and similar technologies to operate our website, remember preferences, understand how our website is used, measure performance and, where permitted, support marketing and advertising.

Some cookies are technically necessary for the operation of our website and online store.

Other cookies and technologies, including certain analytics and advertising technologies, are used only where permitted under applicable law and, where required, after you have provided consent.

Third-party services used for analytics or advertising may receive information such as your IP address, device information, cookie identifiers and information about your interaction with our website.

You can manage your preferences through the cookie/privacy controls available on our website. Where processing is based on consent, you may change or withdraw your consent at any time.

Please refer to our cookie settings for further information about the cookies and technologies currently in use.

If you subscribe to our newsletter or otherwise validly agree to receive marketing communications, we may use your contact information to send you Ticket to the Moon product news, offers, stories and other marketing communications.

Depending on the relevant activity, newsletter and marketing information may be processed by PT Ayunan Bulan International and/or Ticket to the Moon GmbH.

You may unsubscribe at any time by using the unsubscribe link contained in our marketing emails or by contacting us.

Unsubscribing from marketing does not prevent us from sending communications necessary to perform a contract or provide a requested service, such as order confirmations, shipping information or warranty correspondence.

We may retain limited information about an unsubscribe request where necessary to ensure that your preference continues to be respected.

We do not sell personal data.

Where necessary for the purposes described in this Privacy Policy, personal data may be shared with:

• PT Ayunan Bulan International;
• TICKETTOTHEMON, LLC;
• Ticket to the Moon GmbH;
• Shopify and e-commerce service providers;
• Odoo and business-management service providers;
• payment processors and financial service providers;
• shipping, fulfilment, postal and logistics companies;
• accounting, tax and VAT service providers;
• IT, hosting and security service providers;
• email and communication providers;
• analytics and advertising providers, subject to applicable consent requirements;
• professional advisers such as accountants, auditors and lawyers; and
• public authorities where disclosure is required by law.

Service providers processing personal data on our behalf are required to process that information in accordance with applicable contractual and data-protection requirements.

Ticket to the Moon operates internationally.

PT Ayunan Bulan International is located in Indonesia, TICKETTOTHEMON, LLC is located in the United States, and Ticket to the Moon GmbH is located in Austria. In addition, some of our technology and service providers operate internationally.

Your personal data may therefore be transferred to, stored in or accessed from countries outside the EEA.

For example, authorized personnel of PT Ayunan Bulan International in Indonesia may access customer information contained in Shopify, Odoo and other business systems where necessary for:

• order administration;
• customer service;
• warranty processing;
• logistics;
• accounting and administration;
• IT support; and
• other operational activities.

Where the GDPR applies and personal data is transferred to a country outside the EEA that is not covered by an applicable adequacy decision, we implement or rely upon appropriate safeguards as required by Chapter V of the GDPR. Depending on the circumstances, these safeguards may include European Commission Standard Contractual Clauses or other legally recognized transfer mechanisms.

You may contact us for further information regarding safeguards applicable to transfers of your personal data.

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and to meet applicable legal, accounting, tax, warranty and regulatory obligations.

Orders, invoices and transactions

Order, invoice, payment and transaction records may be retained for the periods required under applicable tax, accounting, commercial and other laws.

Customer service, returns and warranties

Customer service, return, repair and warranty information may be retained for the time necessary to administer the relevant request and for an appropriate period afterwards where necessary to handle potential claims or legal obligations.

Customer accounts

Customer account information may be retained while the account remains active and afterwards where retention is necessary for legitimate operational or legal purposes.

Marketing information

Marketing information may be retained until you unsubscribe, withdraw consent or the information is otherwise no longer required for the relevant marketing purpose.

We may retain limited suppression information after an unsubscribe request to ensure that we continue to respect that request.

Cookies and analytics

Information collected through cookies and similar technologies is retained according to the retention periods applicable to the relevant technology or service.

When personal data is no longer required, it is deleted or anonymized unless further retention is required or permitted by law.

Residual copies may remain temporarily in backups until those backups are overwritten according to normal backup cycles.

We implement appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or unauthorized access.

Depending on the relevant system and risk, these measures may include:

• access controls and user permissions;
• authentication measures;
• restricted employee access;
• secure data transmission;
• backups;
• security measures provided by our technology and hosting providers; and
• internal procedures for handling personal data.

Access to customer information is limited to authorized personnel and service providers who require access for legitimate business purposes.

No electronic system can guarantee absolute security, but we review our measures in light of the nature of the information processed and the associated risks.

Where the GDPR applies to our processing of your personal data, you may have the following rights, subject to the conditions and limitations provided by law:

Right of access

You may request confirmation as to whether we process your personal data and request access to that information.

Right to rectification

You may ask us to correct inaccurate or incomplete personal data.

Right to erasure

You may ask us to delete personal data where the legal requirements for erasure are met.

Right to restriction of processing

You may ask us to restrict processing in certain circumstances.

Right to data portability

Where applicable, you may request certain personal data in a structured, commonly used and machine-readable format.

Right to object

You may object to certain processing based on legitimate interests.

You have the right to object at any time to the processing of your personal data for direct marketing purposes.

Right to withdraw consent

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise your rights, please contact: contact@ticketothemoon.com

We may request information reasonably necessary to verify your identity before responding to a request.

If you are located in the EEA, you also have the right to lodge a complaint with a competent data protection supervisory authority, in particular in the EEA country of your habitual residence, place of work or place of the alleged infringement.

You may also contact our EU representative, Ticket to the Moon GmbH, regarding GDPR matters.

Our online store is not intended to collect personal data directly from children who are unable to provide valid consent under applicable data-protection law.

If you believe that a child has provided personal data to us without the required authorization or consent, please contact us so that we can take appropriate action.

Our website may contain links to websites or services operated by independent third parties.

We are not responsible for the privacy practices of independent third-party websites. We encourage you to review their privacy information before providing personal data to them.

We may update this Privacy Policy from time to time to reflect changes in our services, systems, business operations, service providers or applicable legal requirements.

The current version will be published on this page and the date of the latest update will be shown at the top.

For questions about this Privacy Policy, the processing of your personal data or the exercise of your data-protection rights, please contact:

PT Ayunan Bulan International
Trading as Ticket to the Moon
Jalan Batu Sangian VI No. 10
Kuta Utara, Bali 80361
Indonesia
Email: contact@ticketothemoon.com
Phone: +62 361 419 288

EU Representative
Ticket to the Moon GmbH
Vienna, Austria
Email: contact@ticketothemoon.com