Last updated: 2 October 2026. This policy explains which personal data House of Morphosis collects through this website and in the conversations that follow, why, who receives it, how long it is kept and how you can exercise your rights. It is written to comply with Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP) and, for visitors located in the European Union, with the General Data Protection Regulation (GDPR).
Who is responsible for your data
The data controller is PT PMA Maison Canu Gaillard, trading as House of Morphosis, a company registered in Indonesia under Business Registration Number (NIB) 2804260084125, based in Bali, Indonesia.
For any question about your personal data, write to info@houseofmorphosis.com with the subject “Privacy”. Requests are handled by the founders of the studio.
The data we collect
Data you give us. When you send an enquiry from the Curated Products pages: your name, studio or company, email address, project destination, project name, your message and the list of pieces you selected. When you use the Get in touch form on the home page: your email address and your message. When you write to us by email, WhatsApp or Instagram: your contact details and the content of your messages. If you become a client: the information needed to carry out your project, such as the delivery or site address, plans, photographs and invoicing details.
Data collected automatically. Like any website, ours receives technical data when you visit it: IP address, browser and device type, the pages requested and the date and time. This data is recorded in our host’s server logs, and your IP address is used briefly to protect our forms from abuse. We do not use it to identify you.
Data kept on your own device. The pieces you set aside in the catalogue are stored in your browser (local storage) so that your selection is still there on your next visit. This information stays on your device and only reaches us if you send an enquiry. You can delete it at any time by clearing your browser data.
We do not ask for sensitive personal data (such as health, biometric, financial or criminal-record data) and we ask you not to send it to us.
Cookies and tracking
This website does not use advertising cookies, tracking cookies, analytics tools or social-media pixels. The only data stored in your browser is your selection of pieces, described above, which is necessary for the feature you use. If we ever add analytics or other tracking tools, we will update this policy and ask for your consent beforehand where the law requires it.
Why we use your data and on what basis
To answer your enquiry and prepare a proposal — at your request, before any contract (pre-contractual steps), including the confirmation email sent to you when you submit the enquiry form.
To carry out your project — design, sourcing, production, delivery and installation, under the contract between you and House of Morphosis.
To keep the website secure and running — preventing spam and abuse of the enquiry form, on the basis of our legitimate interest.
To meet our legal obligations — accounting, tax and the requests of competent authorities.
We do not send newsletters or marketing messages. If we ever offer them, we will only send them with your consent, which you will be able to withdraw at any time.
Who receives your data
Your data is never sold or rented. It is shared only with:
Our service providers, who process it on our behalf and on our instructions: Google (Google Workspace, our email service, through which enquiries and our replies are sent), Vercel Inc. (website hosting and the functions that send the enquiry and Get in touch forms) and Cloudflare, Inc. (cdnjs, which delivers the animation library used by the website and therefore receives your IP address).
The makers and suppliers working on your project, once you are a client, and only for what they need to know, for example a delivery address.
Public authorities, when the law requires it.
If you contact us through WhatsApp, Instagram or LinkedIn, those platforms also process your data under their own privacy policies.
Transfers outside Indonesia
Our service providers store and process data on servers that may be located outside Indonesia, in particular in the United States and the European Union. In accordance with Article 56 of the UU PDP, we only use providers that offer an adequate level of protection or appropriate binding safeguards, such as contractual data-protection commitments. For data of visitors located in the European Union, these transfers rely on the European Commission’s Standard Contractual Clauses or an adequacy decision.
How long we keep your data
Enquiries that do not lead to a project: 24 months after our last exchange, then deleted.
Client projects: for the duration of the project and its follow-up, then for the period required by Indonesian accounting and tax law for invoices and contracts.
Server logs: for the short period set by our host for security purposes.
Your selection of pieces: on your device, until you clear it.
How we protect your data
The website is served only over an encrypted connection (HTTPS), access to our mailbox and files is limited to the people who need it, and our providers apply recognised security standards. If a breach affecting your personal data occurs, we will notify you and the competent authority in writing within 3 × 24 hours, as required by Article 46 of the UU PDP.
Your rights
Under the UU PDP (Articles 5 to 13) and, where it applies, the GDPR, you have the right to:
obtain information about who processes your data, why and on what basis; access your data and obtain a copy of it; have it completed, updated or corrected; have it deleted or its processing stopped; restrict or suspend its processing; withdraw your consent at any time, where processing is based on consent; object to decisions based solely on automated processing (we do not make any); receive your data in a commonly used format or have it transferred to another controller; and claim compensation for a breach of your rights, in accordance with the law.
To exercise any of these rights, write to info@houseofmorphosis.com. We may ask you to confirm your identity, and we will reply within the time limits set by the applicable law.
Complaints
If you are not satisfied with how we handle your data, please contact us first so that we can find a solution. You may also lodge a complaint with the Indonesian authority responsible for personal data protection or, if you live in the European Union, with the data-protection authority of your country.
Children
Our services are intended for adults and professionals. We do not knowingly collect data from children. If you believe a child has sent us personal data, contact us and we will delete it.
Links to other websites
This website links to Instagram, LinkedIn and WhatsApp. These services are not operated by House of Morphosis; their own privacy policies apply when you use them.
Changes to this policy
We may update this policy when our practices or the law change. The date at the top of this page shows the latest version. This policy is governed by the laws of the Republic of Indonesia.