Indonesia Consumer Privacy Policy

This Indonesia Consumer Privacy Policy (“Policy”) supplements the dōTERRA U.S. Privacy Notice and applies solely to Indonesia consumers. The Policy does not apply to dōTERRA personnel.

The purpose of this Policy is to describe how PT dōTERRA Indonesia Marketing, a limited liability company established under the laws of the Republic of Indonesia, ("dōTERRA", "We", "Our", or "Us"), collects, stores, processes, uses and discloses its consumers ("you" or "your") personal information such as when you visit dōTERRA’s websites and mobile applications listed here (collectively, the “Sites”) in Indonesia.

In order to use the Sites, you must affirmatively consent to be bound by this Policy, and the use of your personal data as stated herein. If you do not agree to the terms of this Policy in its entirety or have objections to the use of your personal data as stated herein, you may not access, or otherwise use the Sites.

This Policy does not apply to the practices of entities other than dōTERRA, or any software, or mobile device applications that dōTERRA does not own or control, with whom you may interact while using the Sites.

 

1. What Type of Personal Information Do We Collect?

For the purposes described in this Policy, We may collect the following categories of personal information (collectively ''Personal Data"):

• Identifiers: identifiers such as a real name, alias, address, unique personal identifier (such as a device identifier; cookies, beacons, pixel tags, mobile ad identifiers and similar technology; customer number, unique pseudonym, or user alias; telephone number and other forms of persistent or probabilistic identifiers), online identifier, Internet Protocol address, email address, account name, ID number, driver’s license number, passport number, and other similar identifiers including signature, physical characteristics or description, state identification card number, insurance policy number, education, bank account number, credit card number, debit card number, and other financial information, medical information, and health insurance information;
• Online Activity: Internet and other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding your interaction with websites, applications or advertisements;
• Geolocation Data;
• Sensory Information: audio, electronic, visual, thermal, olfactory, and similar information;
• Employment Information: professional or employment-related information; and
• Inferences: inferences drawn from any of the information identified above to create a profile about you reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

2. Legal Basis for Collecting and Purpose of Processing Personal Data

We will process your Personal Data on the following legal bases unless such data processing would conflict with applicable laws and regulations:

i. Contract. When we need to process your personal data to perform a contract we enter into with you.

ii. Legal Obligation. When we need to comply with a legal obligation.

iii. Legitimate Interests. When the processing of your personal data is necessary for the fulfilment of legitimate interests pursued by us or a third party and your interests and fundamental rights do not override those interests.

iv. Consent. When you have given consent for us to process your personal data. However, even if we obtain consent from you, we may process your personal data based on other legal grounds. The withdrawal of your consent shall not affect the lawfulness of processing performed based on the consent before your withdrawal.

We use the Personal Data that we hold about you for the purposes described in our U.S. Privacy Notice. We will only use your personal data to the extent that it is necessary to do so to fulfil the purposes. You may experience disadvantages if you refuse to provide your Personal Data, such as being unable to make use of some of our services dōTERRA shall keep the Personal Data of the user as long as it is necessary to provide the user with the service but promptly erase it if it is no longer necessary.

3. Provision to Third Party

For the purposes set out in this Policy, dōTERRA may disclose your Personal Data to third parties data processer, (e.g., personal information processor) so that they can perform their role. Third parties shall be subject to contractual obligations to implement appropriate technical and organizational measures to safeguard and process your personal information as instructed.

Meanwhile, dōTERRA may disclose your personal information, when duly required by law, to third parties such as government authorities, courts, or external advisors.

4. Ensuring of Accuracy

dōTERRA shall endeavor to keep the Personal Data up to date and if it is inaccurate or insufficient, rectify it.

5. Security

To prevent unauthorized access to Personal Data or divulgence of Personal Data, dōTERRA evaluates and determines the risk of breach of the Personal Data privacy in a comprehensive manner after taking into account the category of Personal Data, degree of sensitivity, influence including economic and mental damage to the user when the Personal Data privacy is breached, and takes personnel, organizational and technical safety management measures that are necessary and appropriate according to the risk of breach of Personal Data privacy, set the process to inspect and correct such safety management measures as necessary and makes ceaseless efforts to improve security.

Since we do not collect your Personal Data as such information is stored by the Sites on your mobile device, it is your responsibility to ensure that you prevent unauthorized access, loss or theft of the Personal Data on your mobile device by the use of security codes and other access controls. You are solely responsible for maintaining the confidentiality of your login information and access credentials. Should you choose to not implement access controls to the Sites, to prevent any unauthorized access to the Sites or information stored by it, you shall be liable for not enabling and maintaining appropriate security measures to prevent unauthorized access.

We will delete your Personal Data when it is no longer necessary for the purposes for which it was collected and when it is not within the retention period of the contract or applicable law. Currently, this period is no more than 5 years.

6. Access to Personal Data, Rectification, Erasure, Restriction on Processing, Right of Data Portability

The user may request dōTERRA make the Personal Data concerning the user retained by dōTERRA available to the user, rectify or restrict the processing of such information or take procedures for data portability within the scope which is recognized by the laws and regulations of each county and region.  Further, the user shall have the right to raise an objection to dōTERRA or data protection authority governing the location where the user resides with respect to the processing of the Personal Data related to the user within the scope which is recognized by the laws and regulations of each county and region. If the user requires the procedures for exercising various types of rights granted to the user with respect to the Personal Data, please contact us at the following e-mail address.

7. Cross-Border Transfer

The Sites is controlled and operated by us from Indonesia and is not intended to subject us to the laws or jurisdiction of any state, country, or territory other than that of Indonesia with respect to processing of Personal Data collected from users in Indonesia. The information we collect through the Sites may be stored and processed in any country where we have facilities, or in which we engage service providers, and by using the Sites, you consent to the transfer of information to countries outside of your country of residence, which may have different data protection rules than those of your country. In the event of us transferring any of your Personal Data to countries outside of Indonesia we will take steps to ensure that your Personal Data continues to receive a standard of protection comparable to that provided under, including but not limited to, (i) Law No. 27 of 2022 on Personal Data Protection and (ii) Minister of Communication and Informatics Regulation No. 20 of 2016 on Personal Data Protection in Electronic Systems.

8. Amendment to the Policy

From time to time, we may amend this Policy. Any changes will become effective when we post the revised Policy in the Sites. We will provide you notice of amendments to this Policy, as appropriate, and update the “Last Updated” date at the top of this Policy. If there are any material updates, we will require you to consent or sign up to such modified terms by way of in an pop-up before continuing to use the Sites and also send push notification via the Sites (unless you have turned such functionality off). You are encouraged to review this Policy from time to time.

9. Company’s Policy for Children

If you are less than 21 years of age, you will need your parent's or legal guardian's permission to use the Sites, and you may only access or use the Sites under the supervision of a parent or legal guardian who has consented to and agreed to be bound by this Policy. We encourage parents or legal guardians with queries or concerns to contact us at: 

PT. dōTERRA Indonesia Marketing
Attn: Legal Department
DBS Tower Ciputra World One Building
28th Floor, Suite 2887
JL. Prof. DR. Satrio Kav.3-5
Jakarta Selatan 12940, Indonesia

10. Inquiries

If the user has any matter for consultation or question with respect to the Policy or the processing of the Personal Data by dōTERRA, or request with respect to the access to, rectification or erasure of the Personal Data, restriction on processing or right of data portability, please contact us at privacy@doterra.com.

11. Language

This Policy is made in both the English language and the Indonesian language. Both texts are equally original. In case of any inconsistency or different interpretation between the English text and the Indonesian text, the relevant English text shall be deemed to be automatically amended to conform with and to make it consistent with the relevant Indonesia text.

12. Administrator and Representative

If you have any questions, complaints, or requests regarding the processing of your personal data, this Policy, or your rights, please contact the following at:

dōTERRA

PT dōTERRA Indonesia Marketing

Email: indonesia@doterra.com

Directorate General of Consumer Protection and Trade Order, Ministry of Trade of the Republic of Indonesia

WhatsApp : +62 853 1111 1010