01. Data Controller

THE FACES is a wellness, beauty and SPA brand operating in Bali, Indonesia. Its activities include wellness services, SPA experiences, customer reservations, business development and related partnership communications.

For the activities covered by this Privacy Policy, the individual responsible for determining the purposes and means of processing personal information is:

Evgenii Dubinin is identified as the data controller based on the registration and operational information provided for THE FACES.

Where an independently operated company, business partner or service provider determines its own processing purposes, that organisation may act as a separate data controller and provide additional privacy information.

02. Scope of This Privacy Policy

This Privacy Policy covers personal information processed in connection with THE FACES activities through the following websites:

• thefacesworld.com
• thefacesspa.com
• thefacespeace.com

This Policy applies to website visitors, SPA customers, prospective customers, business contacts, potential partners and individuals who voluntarily submit enquiries through our websites or communication channels.

Independent third-party platforms may have their own privacy policies and act as separate controllers for certain processing activities.

03. Personal Data We Collect

Depending on your relationship with THE FACES and the services you request, we may process the following categories of personal information.

Identity and contact information

• Full name.
• Email address.
• Telephone number.
• WhatsApp contact information.
• Country of residence.
• Preferred language.

SPA and reservation information

• Selected treatments or services.
• Appointment dates and times.
• Reservation history.
• Customer preferences.
• Relevant service-related communications.

Business and partnership information

• Professional or company information.
• Business interests and collaboration preferences.
• Projects of interest.
• Indicative investment or partnership budgets voluntarily provided.
• Preferred contact methods.
• Meeting requests and correspondence.

Technical and usage information

• IP address.
• Browser and device information.
• Operating system.
• Website pages visited.
• Approximate geographic location derived from IP address.
• Referral sources.
• Cookie identifiers and advertising identifiers, where permitted.
• Interaction and conversion information, where lawfully collected.

We aim to limit personal data collection to information reasonably necessary for the relevant purpose.

04. Sources of Personal Information

We may obtain personal information directly from you when you:

• Complete an online form.
• Request information about our services.
• Book or enquire about a SPA treatment.
• Request a business meeting.
• Contact us by email, telephone or WhatsApp.
• Communicate with our team through social media.
• Participate in a business or partnership discussion.

Technical information may also be collected through website servers and permitted cookies or similar technologies.

Where legally permitted, we may receive relevant information from booking providers or other service providers involved in fulfilling your request.

05. Purposes of Processing

THE FACES processes personal information for specified business and operational purposes, including:

• Responding to customer enquiries.
• Managing reservations and appointments.
• Providing requested SPA and wellness services.
• Communicating service information.
• Providing customer support.
• Evaluating partnership enquiries.
• Arranging requested business meetings.
• Maintaining business correspondence.
• Operating and securing our websites.
• Preventing fraud, spam and misuse.
• Meeting applicable legal and accounting obligations.
• Analysing website performance where permitted.
• Measuring advertising effectiveness where lawfully authorised.
• Sending marketing communications where permitted by law.

We will not process personal information for materially incompatible purposes without an appropriate legal basis and any notice or consent required by law.

06. Legal Bases for Processing

Where the European Union General Data Protection Regulation or United Kingdom GDPR applies, processing is based on an appropriate legal ground under the relevant legislation.

Performance of a contract

Processing necessary to provide requested services, manage reservations or take steps at your request before entering into a contract.

Legitimate interests

Processing necessary for proportionate business purposes, such as responding to relevant enquiries, maintaining security and preventing fraud, where those interests are not overridden by applicable individual rights.

Legal obligations

Processing required to comply with applicable laws, regulations or lawful requests from authorities.

Consent

Processing based on valid consent, including certain marketing activities, non-essential tracking technologies and sensitive personal information where consent is legally required.

Consent may be withdrawn at any time. Withdrawal does not affect processing lawfully carried out before withdrawal.

Where Indonesian or other applicable privacy legislation establishes additional requirements, those requirements also apply.

07. SPA Reservations and Services

When you request or book a SPA treatment, THE FACES may process information necessary to manage the reservation and deliver the requested service.

This may include your identity, contact information, selected treatment, appointment date and service preferences.

Reservations may be processed through external booking systems, including Altegio where that platform is used by the relevant establishment.

Such providers may process information on our behalf or independently, depending on their contractual role and the relevant service.

Customers should review any additional privacy information displayed by the booking provider before submitting their personal information.

08. Sensitive Personal Information

Certain wellness treatments may require information relating to allergies, medical conditions, pregnancy, skin sensitivities or other health circumstances relevant to the treatment.

Such information may qualify as sensitive personal data or special-category personal data.

We seek to collect only information reasonably necessary for the safety and suitability of the requested service.

Where required, we will obtain explicit consent or rely on another legally permitted condition before processing such information.

Sensitive information should only be accessible to personnel who reasonably need it for the relevant service and should be protected through appropriate safeguards.

Health-related information is not intended to be used for targeted advertising or unrelated marketing.

09. Business and Investment Enquiries

THE FACES may receive enquiries concerning business collaborations, SPA development, commercial partnerships, co-investment opportunities and other business arrangements.

When you submit such an enquiry, we may process information voluntarily provided through our forms or communication channels.

This may include your name, contact details, country of residence, professional background, projects of interest and indicative budget.

This information is used to understand your enquiry, assess its relevance, communicate with you and, where appropriate, arrange a meeting.

We do not require prospective partners to submit banking credentials, payment card details, passport copies or other highly sensitive financial information through ordinary website enquiry forms.

Any subsequent identity verification, due diligence or contractual processing must be supported by an appropriate legal basis and additional information where required.

10. Marketing Communications

Where permitted by applicable law, THE FACES may send communications concerning wellness services, new locations, events and business-related updates.

Where consent is required, marketing communications will be sent only after obtaining the necessary authorisation.

Consent to receive marketing communications is separate from submitting an ordinary contact or reservation enquiry.

You may unsubscribe from marketing communications using the unsubscribe instructions provided or by contacting us.

We will respect applicable restrictions on email, telephone and messaging marketing.

11. Cookies, Analytics and Advertising

Our websites may use cookies, pixels, tags and similar technologies to operate website functions, understand visitor interactions and measure advertising performance.

Strictly necessary technologies

Technologies required for essential website functionality, security and basic operation.

Analytics technologies

Technologies used to understand website traffic and performance, where lawfully enabled.

Advertising technologies

Depending on the website configuration, advertising measurement tools may include Google Ads and technologies provided by Meta.

These technologies may collect online identifiers and interaction information where permitted under applicable law.

Where legally required, non-essential cookies and tracking technologies must remain disabled until valid consent has been obtained.

Visitors must be able to withdraw or modify consent through an accessible mechanism where required.

Additional information about the cookies actually used, their providers, purposes and retention periods should be provided through a separate Cookie Policy or cookie preference centre.

12. Third-Party Services and Disclosures

THE FACES may use external service providers to support its business and website operations.

Depending on the services actually used, these may include:

• Website hosting and maintenance providers.
• WordPress-related service providers.
• Online booking and reservation platforms.
• Email and communication providers.
• WhatsApp and related communication services.
• Google services used for scheduling or advertising.
• Meta services used for communication or advertising.
• Payment processing providers.
• Professional and legal advisers.
• Public authorities where disclosure is legally required.

Personal information may be disclosed to these parties only where there is an appropriate purpose and legal basis.

Where a provider processes personal information on our behalf, appropriate contractual and organisational safeguards should be implemented.

Some third parties may act as independent data controllers and maintain their own privacy policies.

We do not intend to sell personal information as a standalone commercial product.

Certain advertising disclosures may nevertheless qualify as «sharing» or «sale» under specific privacy laws. Where such laws apply, the required disclosures and opt-out mechanisms must be provided.

13. International Data Transfers

THE FACES operates in Indonesia and communicates with individuals and business contacts located internationally.

Personal information may be processed in Indonesia or in other countries where relevant service providers operate.

Where cross-border transfers are restricted by applicable data protection legislation, we will apply an appropriate lawful transfer mechanism.

Depending on the relevant jurisdiction, safeguards may include adequacy decisions, approved contractual clauses, contractual protections and supplementary measures.

Where Indonesian law imposes additional cross-border transfer requirements, those requirements must also be satisfied.

You may contact us to request information about safeguards relevant to your personal data.

14. Data Retention

THE FACES retains personal information only for as long as reasonably necessary for the purpose for which it was collected.

Retention periods depend on the category of information, the nature of the relationship and applicable legal requirements.

Relevant considerations include:

• The duration of an active customer relationship.
• Reservation administration and customer support.
• Ongoing business correspondence.
• Applicable tax and accounting obligations.
• Legal claims and dispute resolution.
• Consent withdrawal and deletion requests.
• Security and fraud prevention requirements.

When information is no longer required, we will delete, anonymise or securely dispose of it, subject to applicable legal retention obligations.

Specific retention periods may be communicated separately where required by law.

15. Information Security

THE FACES seeks to protect personal information through appropriate technical and organisational safeguards.

Depending on the relevant system and risk, measures may include:

• Encrypted website connections.
• Restricted administrative access.
• Secure account authentication.
• Role-based access permissions.
• Software and security updates.
• Confidentiality obligations.
• Secure handling of customer information.
• Incident management procedures.

No online service or electronic storage system can be guaranteed to be completely secure.

If a personal data breach occurs, we will assess the incident and fulfil applicable notification obligations.

16. Your Privacy Rights

Depending on the law applicable to the processing of your personal information, you may have rights including:

• Access to personal information.
• Correction of inaccurate information.
• Deletion of personal information.
• Restriction of certain processing activities.
• Objection to certain processing activities.
• Data portability.
• Withdrawal of consent.
• Objection to direct marketing.
• Information about international transfers.
• Complaint to a competent supervisory authority.

These rights are subject to applicable legal conditions and exceptions.

To exercise an applicable privacy right, contact:

info@thefacespeace.com

Please describe your request and identify the website or service concerned.

We may request reasonable information necessary to verify your identity before responding.

We will respond within the timeframe required by applicable law.

17. Regional Privacy Laws

Indonesia

Where applicable, THE FACES processes personal data in accordance with Indonesian Law No. 27 of 2022 concerning Personal Data Protection and applicable implementing regulations.

Relevant rights and obligations may include transparency, lawful processing, data security, access, correction, deletion, consent withdrawal and breach notification.

European Union and European Economic Area

Where the EU General Data Protection Regulation applies to our activities, individuals may exercise the rights provided under that Regulation.

The applicability of the EU GDPR depends on the nature of our activities and the relevant processing.

Where an EU representative is legally required, the relevant contact details must be made available to individuals and supervisory authorities.

United Kingdom

Where UK data protection legislation applies, individuals may exercise their rights under the UK GDPR and applicable UK legislation.

Where a UK representative is legally required, the relevant contact details must be provided.

United States

Certain US state privacy laws may provide eligible residents with rights concerning access, correction, deletion, portability and opting out of specific forms of data processing.

These rights depend on whether the relevant state legislation applies to our business activities.

Where applicable, additional notices, opt-out mechanisms and appeal procedures will be provided.

Other Jurisdictions

Visitors from other jurisdictions may have additional rights under their applicable local privacy legislation.

Where those laws apply to THE FACES, we will comply with the relevant obligations and provide any required supplementary disclosures.

18. Children’s Privacy

Our websites are not intended to solicit personal information directly from children without appropriate authorisation.

Where services involve minors, THE FACES will apply the consent and safeguarding requirements established by applicable law.

If you believe a child has provided personal information without legally required authorisation, please contact us.

19. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our business activities, technology, service providers or applicable legal requirements.

Updated versions will be published on this page with a revised effective date.

Where required by law, we will provide additional notice or obtain renewed consent before implementing relevant changes.

20. Contact and Privacy Requests

If you have questions about this Privacy Policy or wish to exercise an applicable privacy right, you may contact THE FACES using the following details.