Privacy Policy

Last updated: 30 September 2026

This policy explains what personal data papasitocigars.com collects, why it collects it, who receives it and how long it is kept. It also sets out your rights and how to use them. It applies to the English site and to the Indonesian site at papasitocigars.com/id/.

1. Who we are

Papasito Cigars runs papasitocigars.com and decides why and how the personal data collected through it is processed. Under Indonesia’s Personal Data Protection Law (Law No. 27 of 2022, “UU PDP”), that makes us the personal data controller for this site.

For anything to do with your personal data, contact us:

Email: hola@papasitocigars.com
WhatsApp: +62 821 3114 811
Address: Papasito Cigars, Jl. Pemelisan Agung, Tibubeneng, Kec. Kuta Utara, Kabupaten Badung, Bali 80361, Indonesia

2. What this policy covers

This policy covers papasitocigars.com only. The site sells nothing. It has no shopping cart, checkout, customer accounts or login, and it takes no orders or payments.

Our cigars are sold through our order store at order.papasitocigars.com, which delivers within Indonesia and asks every visitor to confirm they are 21 or over before they can browse or buy. Our merchandise is sold through our merch shop at merch.papasitocigars.com. This policy does not cover what happens on either store. The merch shop has its own privacy policy, which covers orders, payments and delivery there. If you have a question about how the order store handles your details, contact us using the details above.

3. What we collect and why

We collect personal data in the ways described below and use it only for the purpose given in each case.

Contact form

The form on our contact page asks you to choose the type of enquiry (wholesale or customer) and to give your name, phone number with country code, email address and message. All of these are required. When you send the form, the site passes them to our email service, Resend, which delivers them as a single email to our inbox at hola@papasitocigars.com, with your email address set as the reply address. The email also shows which language version of the site you used. The site holds your enquiry only while it sends it. It does not save a copy.

We use these details to reply to you, whether you are asking about wholesale, stockists or anything else. The legal basis is our legitimate interest in answering the enquiry you sent us.

Newsletter sign-up

The “Join the Club” form near the bottom of every page asks for your email address. The site does not add your address to a mailing list, a database or a newsletter service. It sends the address to our inbox in a short email through Resend, so we know you have signed up. The site does not send you a confirmation email.

We use your address only to send you news from Papasito Cigars. The legal basis is your consent, which you give by submitting the form. You can withdraw it at any time by emailing us or messaging us on WhatsApp. We will then stop contacting you and delete your address.

Spam and bot checks

Both forms use automated checks to keep out spam:

The contact page uses Google reCAPTCHA. Its script loads when you open the page and collects information about your device and browser, including your IP address, browser type and the page address. Your browser may also send Google any google.com cookies it already holds. When you send the form, our server passes Google a one-time token and your IP address to confirm the message came from a person.
The newsletter form uses Cloudflare Turnstile. The form appears on every page, so Turnstile loads with every page. It collects your IP address, browser type and technical details about your connection and device. When you sign up, our server passes Cloudflare a one-time token and your IP address.
Both forms contain a hidden field that people never see and bots tend to fill in. The contact form also rejects messages completed in under two seconds.
The newsletter form limits repeated sign-ups from one IP address to about four an hour. To count them, the server instance that handles your sign-up keeps your IP address in its working memory until Vercel shuts that instance down. Vercel starts and stops these instances as traffic changes, so we cannot give a fixed time. Your IP address is never written to disk, a database or a log.
The newsletter form also ignores sign-ups from Gmail addresses with three or more dots before the @, a pattern often used by bots. You still see the welcome message. If that is you, email us and we will add you by hand.

reCAPTCHA and Turnstile load automatically, because the forms cannot work without them. The legal basis for these checks is our legitimate interest in protecting the site and our inbox from spam and abuse.

The checks run automatically. A submission that looks automated may be rejected, or discarded without an error message. That happens, for example, when the contact form was completed too quickly or the newsletter form was used too often. The checks decide only whether a message or sign-up reaches us. They have no other effect on you, and we do not use them to build a profile of you. If you think a message of yours did not get through, email us or message us on WhatsApp.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply. Cloudflare explains how it handles Turnstile data in its Turnstile privacy addendum.

Your country

When you open the site, your browser asks our server which country you are in. Our host, Vercel, works this out from your IP address. If you are in Indonesia, the site uses the answer to point its merch shop links to our order store instead. The site does nothing else with the answer and does not store it. The legal basis is our legitimate interest in sending you to a store that serves your country.

Hosting and server logs

Vercel hosts the site. Like any web host, it receives your IP address, your browser type, the address of the page you ask for and the time of each request. Vercel keeps these details in logs of requests to the site, which cover every page you open. Depending on our plan, the logs are kept for between one hour and 30 days. Vercel may also keep some request data for its own security and operations, under its own privacy policy. We use the logs only to run the site, keep it secure and fix faults. The legal basis is our legitimate interest in running a working, secure website.

Our own code does not write your IP address, your form entries or your email address to any log. If an email fails to send, the log records the technical error, not your form entries.

Email and WhatsApp

If you email hola@papasitocigars.com or message +62 821 3114 811 on WhatsApp, we receive whatever you send. Emails arrive in our Google Workspace mailbox. WhatsApp is run by Meta under its own terms. We use your message only to reply to you.

Links to other sites

The site links to our order store, our merch shop and our Instagram, Facebook, X, TikTok and WhatsApp pages. Nothing loads from those sites until you click a link. The site has no social media plugins, embedded posts, advertising pixels or analytics, and we add no tracking codes to our links. Blog posts have a WhatsApp share button, which opens WhatsApp with the post’s title and link. When you click “Buy Cigars”, “Where to Buy” or “find a shop that stocks it” on our Cigar Range page, your browser tells the order store only that you came from papasitocigars.com. Our other links to outside sites do not pass on even that.

4. Cookies

The site does not set any cookies of its own.

Until 28 September 2026 the site showed a cookie notice. Clicking “Ok” or closing it set a cookie called cookie_notice_accepted, which only stopped the notice from appearing again. If you did either, your browser may still hold that cookie. The site no longer reads it, and it expires by itself 30 days after it was set.

We do not use analytics, advertising or tracking cookies, and the site does not use local storage or any similar browser storage.

Two third-party services may use cookies or storage on your device:

Google reCAPTCHA may set a cookie called _GRECAPTCHA when it runs on the contact page. Google uses it for its risk analysis. It lasts about six months.
Cloudflare Turnstile, on every page, may read and write data on your device. Cloudflare states that the information Turnstile collects is strictly necessary to detect and block bots.

You can block or delete cookies in your browser settings. If you block reCAPTCHA or Turnstile, the forms will not work, but you can still email us or message us on WhatsApp.

5. Who receives your data

We do not sell or rent personal data, and we do not share it with anyone for their own marketing. These service providers receive personal data so that the site can work:

Vercel (United States) hosts the site and runs its server functions. It receives every request, including your IP address, and your form entries as they pass through.
Resend (United States) delivers form submissions to our inbox. It receives your contact form details or your newsletter email address.
Google (United States) hosts our hola@papasitocigars.com mailbox through Google Workspace, where contact enquiries, newsletter sign-ups and your emails arrive. Google also runs reCAPTCHA on the contact page.
Cloudflare (United States) runs Turnstile for the newsletter form.
WhatsApp, owned by Meta, carries your messages if you choose to contact us on WhatsApp.

6. Transfers outside Indonesia

All of these providers are based outside Indonesia, mainly in the United States. Vercel first handles each request at the data centre nearest to you, which for visitors in Indonesia is usually Singapore. The site’s server functions run in Vercel’s Washington, D.C. region, Resend handles email data mainly in the United States, and Google and Cloudflare process data in their own data centres in several countries. When you use the site, your personal data is therefore transferred out of Indonesia.

These countries may not protect personal data to the same standard as UU PDP. To reduce that risk, we send each provider only what it needs to do its job, the site keeps no copy of your form entries, and Resend deletes its copies after 30 days. Each provider handles the data under its own published terms and data protection commitments.

7. How long we keep data

The site itself keeps no copy of your enquiry or your newsletter address.
Resend deletes its copies of the emails it delivers after 30 days.
Enquiries and emails stay in our inbox until we delete them. We have not set a fixed deletion period for the inbox. If you ask us to, we will delete your messages.
Your newsletter address stays in our inbox until you unsubscribe. We then delete it.
WhatsApp messages stay in our WhatsApp account until we delete them. If you ask us to, we will delete yours.
The IP address used for the newsletter sign-up limit stays only in the working memory of the server instance that handled your sign-up, until Vercel shuts that instance down. It is never saved.
Vercel keeps its request logs for between one hour and 30 days, depending on our plan.
Google and Cloudflare keep reCAPTCHA and Turnstile data under their own terms. The _GRECAPTCHA cookie lasts about six months.

When we delete personal data at your request, we will confirm it to you.

8. Your rights

Under UU PDP, you have the right to:

know who we are, why we process your personal data and how we are accountable for it;
see the personal data we hold about you and get a copy;
have inaccurate or incomplete data completed, updated or corrected;
have us stop processing your data, and delete or destroy it;
withdraw your consent at any time, for example to receiving our news;
object to decisions made only by automated processing, including profiling, that have legal effects on you or significantly affect you;
ask us to delay or restrict processing;
receive your data in a commonly used format, or have it sent to another controller;
sue for compensation if your personal data is processed in breach of the law.

If you live outside Indonesia, the law where you live may give you similar rights. We handle requests from every visitor the same way.

To use any of these rights, email hola@papasitocigars.com or message us on WhatsApp and tell us what you would like us to do. If we need to confirm your identity, for example by asking you to write from the email address you gave us, we will ask straight away. We will act on requests to see or correct your data, to restrict or delay processing, or to stop processing after you withdraw consent, within 3 x 24 hours of receiving them, as UU PDP requires. We will answer other requests as quickly as we can.

If you are not satisfied with our answer, you can complain to the Indonesian authority responsible for personal data protection. UU PDP provides for a dedicated agency; until it is in operation, the Ministry of Communication and Digital Affairs (Komdigi) oversees personal data protection. If you live elsewhere, you can contact your local data protection authority.

9. Age

Papasito Cigars makes tobacco products. This site is for adults aged 21 and over and is not intended for anyone under 21. We do not knowingly collect personal data from anyone under 21, and if we find that we have, we will delete it. If you think someone under 21 has sent us their details, please tell us.

10. Security

The site is served only over encrypted HTTPS connections, and it tells browsers to always use HTTPS when they visit (HSTS). Form entries travel encrypted to our server and on to our email service. The site keeps no database of form entries, so there is no stored copy on the site to lose. The spam checks and the sign-up limit help stop abuse of the forms.

11. Data breaches

If a breach of personal data we are responsible for affects you, we will tell you in writing within 3 x 24 hours of confirming it. We will explain what data was exposed, when and how it was exposed, and what we are doing to deal with it and recover. We will also notify the Indonesian authority, as UU PDP requires.

12. Changes to this policy

We update this policy when the site changes how it handles personal data, and we change the date at the top of this page when we do. If a change affects personal data you have already given us, we will tell you before it takes effect, using the contact details you gave us.