Legal
Privacy Policy
PT Sinamon Demo Indonesia ("we", "us", or "our") operates the Taco Kitchen website and online ordering service (the "Service"). This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and the rights you have over your data.
We respect your privacy and are committed to protecting the personal information you share with us, including when we communicate with you through WhatsApp using the WhatsApp Business Platform. By using the Service you agree to the collection and use of information in accordance with this policy.
Taco Kitchen operates physical locations as well as this website (tacokitchen.com). For any privacy-related question or request you can reach us at hello@tacokitchen.com.
1. Information we collect
Account and contact information
Your name, phone number, email address (if provided), and delivery addresses. We use your phone number to communicate with you via WhatsApp, SMS, or voice call about your orders.
Order and transaction data
Items ordered, order times, delivery or pickup location, notes or special requests, and price paid.
Payment information
Payments are processed by Xendit, a licensed payment service provider. We do not store your full card number, CVV, or bank credentials. For saved cards, we store only a tokenized reference along with masked details (brand and last four digits) to enable repeat purchases.
Messaging data
When you contact us over WhatsApp we receive messages via Meta's WhatsApp Business Platform. Inbound and outbound messages, media, delivery receipts, and read receipts are retained in our systems so we can respond to you and maintain service quality. The same applies to messages you send us by email, through contact forms on our website, or on social media, and to any reservation, feedback, or support history.
Automatically collected data
IP address, browser and device information, pages viewed, referring URL, and timestamps. With your permission we may also collect approximate location in your browser to help you find the nearest location.
Cookies and similar technologies
We use cookies and local storage to keep you signed in, remember your cart, and measure site usage. You can disable cookies in your browser, but parts of the Service may stop working.
2. WhatsApp Business Platform and Meta
We use the WhatsApp Business Platform (API), provided by Meta Platforms, to communicate with our customers for customer service, order confirmations, delivery updates, and other transactional notifications. When you message us on WhatsApp or share your WhatsApp number with us, the following applies:
- Your phone number and the content of your messages are processed by WhatsApp and Meta in accordance with the WhatsApp Business Messaging Policy and the WhatsApp Privacy Policy.
- We only message you in response to a conversation you have initiated, to confirm or update you on an order you have placed, or where you have given us prior consent to receive promotional messages.
- We do not use information obtained through WhatsApp for advertising to third parties, and we do not sell your data.
- You can opt out at any time by replying STOP to any of our WhatsApp messages or by emailing hello@tacokitchen.com.
3. How we use your information
- To process, fulfill, and deliver your orders.
- To send order confirmations, status updates, and receipts.
- To process payments and prevent fraud.
- To provide customer support and respond to your inquiries, bookings, and messages across WhatsApp, email, and other channels.
- To send marketing or promotional messages, only where you have opted in; you can opt out at any time.
- To comply with tax, accounting, and other legal obligations.
- To improve the Service, including through aggregated and anonymized analytics.
4. Legal basis for processing
We process your personal data on the basis of (a) performance of a contract with you, such as fulfilling an order, (b) your consent, for example opting in to promotional WhatsApp messages, (c) our legitimate interests in responding to customer inquiries and improving our service, and (d) compliance with applicable legal obligations.
5. How we share your information
We do not sell your personal data. We share it only with the following categories of recipients, and only to the extent necessary:
- Payment providers — Xendit — to authorize and capture payment.
- Messaging providers — Meta Platforms Ireland (WhatsApp Business Platform) — to deliver messages to you.
- Mapping and location providers — including Google Maps — to display locations and calculate delivery distances.
- Online ordering and delivery platforms — strictly as necessary to fulfil orders you place through them.
- Service providers who help us operate our website, customer-relationship, and analytics tools, under appropriate confidentiality obligations.
- Delivery partners — to complete delivery orders where applicable.
- Cloud infrastructure providers — including Amazon Web Services — which host our systems.
- Legal and regulatory authorities — where required by law, court order, or to protect the rights, property, or safety of our customers, our team, or the public.
6. Data retention
We retain your personal data for as long as your account is active and afterward for the period required by applicable law. In Indonesia this is typically up to ten (10) years for tax and accounting records. Data that is no longer required for a legitimate purpose is deleted or anonymized. WhatsApp conversation history is generally retained for up to 12 months, unless a longer retention period is required, after which it is deleted or anonymised.
7. International transfers
Your data may be processed on servers located outside Indonesia. When we transfer data internationally we take reasonable steps to ensure appropriate contractual and technical safeguards are in place.
8. Security
We use administrative, technical, and physical safeguards — including TLS in transit, encryption at rest, access controls, and regular reviews — to protect your information. No system is perfectly secure, and we cannot guarantee absolute security of information you transmit to us.
9. Your rights
Depending on your jurisdiction, you may have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Request deletion of your data (see our Data Deletion Policy).
- Receive a portable copy of your data.
- Object to or restrict certain types of processing.
- Withdraw consent at any time where processing is based on consent.
- Opt out of marketing communications.
- Lodge a complaint with a data protection authority.
To exercise any of these rights, email us at hello@tacokitchen.com.
10. Children
The Service is not directed to children under 13, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
11. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by notifying you directly. The "Last updated" date at the bottom of this page indicates when it was last revised.
12. Contact us
To exercise your rights or ask questions about this policy, contact us at:
Last updated: September 2026
Platform provider
This website and online ordering service are operated by PT Sinamon Demo Indonesia, the merchant of record responsible for the products, orders, and customer data on this Service. The storefront software is built and provided by Butter. Butter Technology Holdings is a Wyoming (USA) C Corporation; Indonesian operations are conducted under license by PT Butter Teknologi Group, its authorized local operating entity.