1. Who we are

This site, korafoodhall.com, is operated by the KORA Food Hall project team in connection with the upcoming food hall at Jalan Monkey Forest 15, Ubud, Bali, Indonesia. In this policy "KORA", "we", and "us" refer to that team. For any privacy question you can reach us at privacy@korafoodhall.com.

2. What we collect

We only collect personal data that you actively submit through a form on this site. Specifically:

Name, email, and phone / WhatsApp number.
For private event enquiries: preferred date, group size, and event type.
For leasing applications: your concept description and preferred corner category.
Any free-text message you choose to include with your enquiry.
Technical metadata automatically attached to every request: IP address (used only for rate limiting and abuse prevention), timestamp, and the inquiry type.

We do not collect payment card data, government ID numbers, or any category of sensitive personal data on this site. We do not run third-party ad trackers or social pixels.

3. Why we collect it

To respond to your enquiry or application.
To schedule visits, tastings, viewings, or investor meetings you've requested.
To operate a leasing and investor pipeline, including internal follow-up and note-taking.
To protect the site from spam and abuse through rate limiting.

We do not use the data you submit to send unrelated marketing. We do not sell personal data to anyone, ever.

4. Who processes your data

When you submit a form, we share the information you provided with a small set of processors strictly to deliver the service you asked for:

Supabase (PostgreSQL hosting) — stores the enquiry record.
Resend — delivers the notification email to the relevant KORA inbox (investor, tenant, events, or general).
HubSpot — stores contact, deal, and timeline-note records from forms you submit so our team can follow up; on the tenant leasing section only, it also provides website analytics after you opt in (see section 7).
Upstash Redis — stores a short-lived, IP-keyed counter used only for rate limiting (hashes, no payload).
Netlify — hosts the site and serves request logs standard to any web host.
Sentry — captures error events with PII redaction applied client-side before transmission, in compliance with Indonesia's Personal Data Protection Law (UU 27/2022).

Each processor acts under its own privacy commitments. They process data only to provide the service we contracted them for.

5. International transfers

KORA operates in Indonesia. The processors above store data in the United States, the European Union, and the Asia-Pacific region. By submitting a form you acknowledge your data may cross borders to those locations under the providers' standard data-processing terms.

6. How long we keep it

Enquiry and application records are kept for up to 24 months from last contact, after which they are either deleted or anonymised. Rate-limit counters expire automatically within 10 minutes. You can ask us to delete your record sooner at any time — see section 8.

7. Cookies and analytics

On our guest-facing pages this site does not set advertising cookies and does not use third-party analytics that build cross-site profiles; the only cookies there are strictly necessary ones the framework uses to keep the site working, so no cookie banner is shown. The one exception is the tenant leasing section (/for-tenants and its sub-pages): there we use HubSpot website analytics to understand how prospective tenants use those pages. It loads only after you give explicit consent through the notice shown on that section — nothing is set beforehand, and if you decline, no HubSpot analytics cookies are placed. If you accept, HubSpot may set analytics cookies such as __hstc, hubspotutk and __hssc. You can withdraw consent at any time using the Privacy Settings control in the leasing section, which stops HubSpot analytics and expires those cookies; you can also exercise the rights in section 8. This applies to the leasing section only and changes nothing elsewhere on the site.

8. Your rights

You can ask us, at any time and at no cost, to:

Confirm what data we hold about you.
Correct anything that is wrong or out of date.
Delete your record from our database and from HubSpot.
Stop contacting you.

Send your request to privacy@korafoodhall.com from the email address you used in the form. We aim to respond within 14 days.

9. Children

This site is not directed at children under 16 and we do not knowingly collect their personal data. If you believe a child has submitted a form, contact us and we will delete the record.

10. Changes to this policy

We will update this page when our practices change. The "Last updated" date at the top always reflects the most recent version. Material changes to how we process your data will be noted here before they take effect.

Privacy Policy