Privacy policy

Last updated 2 August 2026. Written to comply with Law No. 27 of 2022 on Personal Data Protection (UU PDP) and, for customers in the EU and UK, the GDPR.

Your privacy matters to us. This explains what we collect, why, how we use it, and what you can ask us to do about it.

Who controls your data

The data controller for personal data collected through madeofsunday.com is PT Elnath Cipta Global, Jalan Teluk Cendrawasih No. 52, Kelurahan Arjosari, Kecamatan Blimbing, Kota Malang, Jawa Timur 65126, Indonesia.

For anything to do with privacy, write to hello@madeofsunday.com or message +62 813 1529 171, Monday to Friday, 09:00–17:00 WIB.

What we collect

What you give us directly: your name and email address; your shipping and billing address; your phone or WhatsApp number for delivery; body measurements, if you send them to us for sizing advice; your order history; and the content of messages you send us.

What we collect automatically: your IP address and approximate location at country or city level; your browser, device, and operating system; the pages you visit and how you move through the site; the referring URL that brought you here; and cookie identifiers.

What we never collect: your card number, CVV, or banking credentials. Payment details go directly into our payment provider's secure environment under PCI-DSS standards. We receive only the result of the transaction, the payment method, and the last four digits of a card.

Why we are allowed to process it

To perform our contract with you — taking your order, making your garment, delivering it, handling returns.
Legitimate interests — preventing fraud, keeping the site secure, understanding how it is used, improving what we make.
Your consent — marketing email and non-essential cookies. You can withdraw it at any time.
Legal obligation — Indonesian tax and accounting records, customs declarations, and lawful requests from authorities.

What we use it for

Processing, producing, and delivering your order. Sending order confirmations, production updates, and delivery notifications. Giving sizing advice when you ask. Handling cancellations, returns, refunds, and questions. Sending newsletters where you have opted in. Understanding site performance. Preventing fraud and protecting the checkout. Meeting our tax and customs obligations.

Who we share it with

We do not sell your personal data. We share it only with the providers needed to run the business:

Shopify — hosts the store and processes order data.
Midtrans (PT Midtrans) — our payment gateway, licensed and supervised by Bank Indonesia. Receives transaction and billing data to process payments and refunds.
Carriers — JNE, J&T, SiCepat, AnterAja, Pos Indonesia, DHL and partner express services. Receive your name, address, and phone number to deliver your parcel.
Customs authorities — receive shipment contents and declared value, as the law requires for international orders.
Our email platform — for order emails and newsletters.
Analytics providers — for aggregated website statistics.
Meta and Instagram — if you interact with our social accounts or advertising.
Advisers and authorities — our accountants, or law enforcement where legally required.

Every provider is bound to process your data only on our instructions and in line with applicable data protection law.

Sending data abroad

We are based in Indonesia. If you order from elsewhere, your data is processed in Indonesia and shared with carriers and customs authorities in transit and destination countries so your parcel can reach you. Some providers, including Shopify and Google, store data in other jurisdictions.

For personal data of individuals in the EU or UK we rely on approved transfer mechanisms including Standard Contractual Clauses. Under Article 56 of UU PDP we ensure recipients apply protection at least equivalent to Indonesian law, or we rely on your consent for a specific transfer.

How long we keep it

Order and transaction records — 10 years, as Indonesian tax and company law require
Account data — until you delete your account, or 3 years of inactivity
Marketing data — until you unsubscribe or withdraw consent
Customer service correspondence — 2 years from last contact
Analytics data — typically 26 months

Your rights

You can ask us to give you a copy of your data, correct it, delete it where we are not required to keep it, restrict how we use it, send it to you in a portable format, or stop using it for direct marketing. Where we rely on consent, you can withdraw it at any time. You can also complain to the Indonesian personal data protection authority, or, in the EU or UK, to your national supervisory authority.

Write to hello@madeofsunday.com with "Privacy Request" in the subject line. We respond within 3 days of a valid request, as UU PDP requires, and in all cases within 30 days.

Cookies

We use strictly necessary cookies to run the cart and checkout, and — with your consent — analytics and marketing cookies to understand how the site is used and to measure advertising. You can manage or refuse the non-essential ones through the consent banner or your browser. Refusing them will not stop you shopping with us.

Children

This site is not directed at children under 18 and we do not knowingly collect their data. If you believe we have, tell us and we will delete it.

Security

The site runs over SSL. Payment data is handled entirely by PCI-DSS compliant processors. Administrative access is limited to authorised people and protected by strong authentication. No transmission over the internet is completely secure, so we cannot promise absolute safety — but if a breach affects your data we will notify you and the authorities without undue delay, within 3 × 24 hours as UU PDP requires.

Changes

We may update this policy. Material changes are posted here with a new date and, where appropriate, sent by email.

Made of Sunday is operated by PT Elnath Cipta Global · Jalan Teluk Cendrawasih No. 52, Arjosari, Blimbing, Kota Malang, Jawa Timur 65126, Indonesia · hello@madeofsunday.com · +62 813 1529 171