Last revised: 27 August 2026
ARC Anime Lab (“ARC“, “we“, “our“, “us“) recognises the importance of your right to privacy and wants you to be familiar with how we collect, use, and disclose personal data that identifies you.
This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our website at arcanimelab.com (the “Site“) or purchase our products (the “Products“). It is issued under Law No. 27 of 2022 on Personal Data Protection (“UU PDP”) and is incorporated into and forms part of our Terms & Conditions.
ARC Anime Lab is the data controller. Privacy contact: help@arcanimelab.com.
By using our Site and supplying your personal data, you acknowledge that you have read and understood this Privacy Policy. Where we rely on your consent, we ask for it separately and explicitly. If you do not agree with this Policy, please do not use our Site or supply us with your personal data.
Personal data means any data about an identifiable individual. Anonymous Data means data that is not linked to, and does not readily permit identification of, any individual. ARC does not consider Anonymous Data to be personal data.
The personal data we may collect includes, but is not limited to:
your name;
your shipping and billing address;
your telephone or WhatsApp number;
your email address;
your payment-related information;
your social media username, where you provide one or contact us through social media;
your order and purchase history;
your account login details;
your IP address, device type, browser, and operating system;
log information such as pages viewed and how you used the Site;
photographs and video you provide in support of a return, exchange, or complaint;
photographic identification, where required to verify your identity; and
personal data you give us that we did not request, such as data you voluntarily include in a message to us.
We do not seek health, religious, political, or other specific personal data under UU PDP, and we do not purchase personal data from data brokers.
We collect, use, and disclose your personal data to operate our Site, sell you Products, meet our legal obligations, and as otherwise permitted or required by applicable law. We use personal data only for the purposes for which it was collected.
Our purposes are:
to provide you access to the Site and to maintain your account;
to verify your identity;
to establish and maintain commercial relations with you, including fulfilling and delivering your orders;
to respond to your questions and provide customer service;
to process returns, exchanges, and complaints, and to investigate delivery and product issues;
to process payments and detect, prevent, and analyse fraudulent transactions;
to protect our safety, property, staff, and other customers, and to enforce our Terms;
to maintain accounting, tax, and transaction records;
to improve our Products, Site, and service, and to develop new ones;
subject to your consent, to send you newsletters, drop announcements, and marketing about Products and events that may interest you; and
to meet any legal or regulatory requirement.
Our legal basis. Most of the above is necessary to perform our contract with you. Record-keeping and responding to authorities is a legal obligation. Fraud prevention, enforcement of our Terms, and site security rest on our legitimate interest. Marketing, non-essential cookies, and reposting your public content rest on your consent.
We limit collection of personal data to what is necessary to fulfil the purposes identified in this Policy, and we collect, use, and disclose it only in accordance with this Policy.
Your personal data will not be used for purposes other than those for which it was collected, except with your consent or as permitted by law. Where we wish to use personal data for a new purpose, we will amend this Policy and, where UU PDP requires it, obtain fresh consent.
Anonymous Data. We may generate Anonymous Data from personal data by removing what makes it identifiable. We may use and disclose Anonymous Data and aggregated data for any reasonable purpose, at our discretion.
Retention. We retain personal data only as long as we need it to fulfil the purposes for which it was collected, to verify your compliance with our Terms, and to comply with our legal obligations:
| Data | Period |
|---|---|
| Order and transaction records | [10] years (Indonesian tax and company-record rules) |
| Account data | While active, then [12] months |
| Return, complaint, and evidence files | [24] months from closure |
| Customer service correspondence | [24] months |
| Marketing contacts | Until consent is withdrawn |
| Site log data | [12] months |
| Fraud and abuse records | [36] months |
Data held in backup archives is isolated from further processing and deleted in the normal backup cycle.
Disclosure. We may disclose personal data to service providers, data processors, and other third parties (“Third Parties“) in these limited circumstances:
to Third Parties that support our operations — couriers and logistics, payment providers, hosting, IT and security, messaging platforms, analytics, and marketplace platforms where you ordered. Such Third Parties may use your personal data only for the purposes described in this Policy;
where necessary to protect our safety, property, or other rights, or those of our staff and customers, including to detect and prevent fraud and abuse;
if we sell or transfer all or part of our business or assets, in which case your personal data remains subject to this Policy unless you agree to the acquirer’s policy;
with your consent; or
where otherwise required or permitted by law.
We never sell or rent your personal data. Internal access is limited to staff who need it. A current list of our Third Parties is available on request.
Some Third Parties — including hosting, content delivery, email, messaging, and analytics providers — may store, process, or transfer personal data on servers outside Indonesia, in jurisdictions whose data protection laws differ from Indonesia’s. As a result, personal data may be subject to lawful access requests from governments, courts, or law enforcement in those jurisdictions.
We use reasonable efforts to ensure our Third Parties maintain protections consistent with UU PDP.
We use Third Parties to process transactions on our Site, and use commercially reasonable efforts to select providers that maintain the confidentiality and security of your payment information. We do not store your full card or banking details. Your use of a payment provider is governed by the agreement between you and that provider.
We may ask for additional information to verify your identity before processing an order, including a copy of photographic identification, where a transaction is flagged as potentially fraudulent, where we suspect bulk buying for unauthorised resale or bot activity, or where we cannot otherwise verify the details provided. We may decline or cancel an order where verification is not completed.
As you interact with the Site, we may use automatic data collection technology — cookies, pixels, web beacons, tags, and similar devices — that records information identifying your device and tracking your use of the Site. Information tracked includes your IP address, browser and operating system, pages visited, and referring pages. We may also include tracking pixels in marketing emails to see which were opened.
We use:
essential cookies — cart, login, and security. These cannot be switched off, and blocking them breaks parts of the Site;
functional cookies — remembering your preferences;
analytics cookies — understanding how the Site is used, in aggregate; and
marketing and advertising cookies — measuring campaigns and serving relevant advertising, including through social platforms.
Where we use non-essential cookies, we ask your consent before setting them. You may withdraw consent through our cookie settings at any time. You can also set your browser to notify you about cookies, refuse them, or delete stored cookies; refer to your browser’s guide. If you refuse cookies you may still see advertising, but it will be less relevant.
We maintain reasonable technical, physical, and administrative safeguards to protect personal data against loss, theft, and unauthorised access, and data you submit is exchanged over a secured connection. No transmission over the internet can be guaranteed to be completely secure, and while we are committed to protecting your personal data, we cannot warrant the security of anything you send us.
We take reasonable steps to verify your identity before granting access to your account. You are solely responsible for the secrecy of your username, password, and account details.
If a personal data breach occurs, we will notify affected individuals and the supervisory authority in writing within 3 × 24 hours of becoming aware of it, describing the data affected, how and when it occurred, and the steps we are taking, as required by UU PDP.
Under UU PDP you may request information about the personal data we hold and how it is processed; access a copy; correct or complete inaccurate data; request deletion; withdraw consent; object to processing, including automated decision-making; request transfer to another controller where technically possible; restrict processing; and claim compensation for unlawful processing.
We will verify your identity before responding, and will respond within 3 × 24 hours of receiving a complete request. Where a request is complex, we will tell you within that period what we are doing and when it will be done. There is no charge, except where you require copies of records.
We may be unable to provide access where the data cannot be separated from the personal data of others, cannot be disclosed for reasons of security or commercial confidentiality, is protected by legal privilege, or where a legal obligation requires us to retain it — most commonly, transaction records within the retention period required for tax and accounting. Where we deny access, we will tell you why, unless prohibited by law from doing so.
Where you refuse or withdraw consent, you acknowledge that we may be unable to provide, or continue to provide, certain services to you.
Marketing is opt-in. We send newsletters, drop announcements, and promotions only where you have subscribed or ticked the consent box.
Every marketing message includes unsubscribe instructions, and you may opt out at any time by contacting us at help@arcanimelab.com. Opting out does not stop messages about your orders, payments, deliveries, returns, or customer service requests, which are not marketing.
Personal data you post on Instagram, TikTok, Facebook, or any other social platform is subject to that platform’s privacy policy and is not governed by this Policy.
As set out in our Terms, where you publicly post content about ARC — a review, photo, video, tag, or hashtag — we may repost and use it across our marketing channels, including your username, with credit where reasonable. Ask us and we will stop.
Where you order through a marketplace or social commerce platform, that platform processes your data under its own policy and passes us what we need to fulfil your order. Contact the platform directly about data it holds.
Our Site may link to sites independently owned and operated by third parties, with their own privacy policies. We are not responsible for the privacy practices or content of those sites. We encourage you to review the policy of each site you visit.
Our Site and Products are intended for customers aged 18 or over, consistent with our Terms. A person under 18 may use our Site only with the consent and supervision of a parent or legal guardian.
We do not knowingly collect personal data from children without that consent. If a child has provided us with personal data, a parent or guardian may contact us and we will delete it.
We may change or replace this Policy at any time. The current version is posted on this page with the revision date shown at the top, and we encourage you to check back.
Continued use of the Site after a change constitutes acceptance of the revised Policy. Where a change materially affects consent-based processing, we will seek fresh consent as UU PDP requires.
We welcome your feedback. Contact us at help@arcanimelab.com if you have questions about this Policy, wish to exercise a right in Section 9, wish to stop receiving marketing, or want to report a breach of this Policy. We will get back to you promptly.
If you are not satisfied with how we handle your personal data, you may complain to the authority responsible for personal data protection supervision in Indonesia, and pursue remedies available under UU PDP.
ARC Anime Lab
Email: help@arcanimelab.com
WhatsApp: +62 812-9403-9813
Hours: Mon–Fri, 09:00–17:00 WIB
Published in English and Bahasa Indonesia. Under Law No. 24 of 2009, the Indonesian version prevails.
Template prepared for ARC Anime Lab; not legal advice. UU PDP carries administrative sanctions and its implementing rules are still developing — have this reviewed before publishing, and confirm Sections 4, 8, and 9 against current rules.
