1. Data Controller Identification
The data controller responsible for this website is PT Heksa Inti Kreasindo, an Indonesian limited liability company having its registered office at Jl. Matahari Raya, No. 480 RT.002/RW.010, Jaka Setia, Bekasi Selatan, Jawa Barat 17147, Indonesia.
In operating this corporate website and its communication channels, we act as the Data Controller responsible for the lawful processing, storage, and handling of any personal data you submit.
2. Personal Data We Collect
We collect only the minimum data required to facilitate professional communications and maintain system integrity:
a. Data You Provide Directly
- Your full name.
- Your corporate or business email address.
- Name of the organization, agency, or enterprise you represent.
- Selected service area or topic of interest.
- Message content, project specifications, or system requirements.
b. Automatically Collected Technical Data
- Public Internet Protocol (IP) addresses and connection header metadata.
- Browser type, operating system, and viewport specifications.
- Cloudflare Turnstile verification challenge tokens to deter malicious bots and automated abuse.
- System timestamps of form requests.
3. Legal Basis and Processing Purposes
Pursuant to Article 20 of Law No. 27/2022 (UU PDP), processing is conducted based on your explicit consent when submitting our consultation form and our legitimate interests in protecting our network infrastructure.
Processing purposes include:
- Contacting you to furnish preliminary technical evaluations, cost estimates, or consultative meetings.
- Verifying genuine business inquiries and safeguarding forms against spam, credential stuffing, and bot assaults.
- Maintaining website availability, performance, and cyber resiliency.
- Complying with statutory reporting and legal obligations under the laws of the Republic of Indonesia.
4. Data Storage, Retention, and Security
We implement robust technical and organizational security controls to guard personal data against unauthorized access, loss, or disclosure.
All data transmissions between your browser and our servers are encrypted using modern HTTPS (TLS 1.3). The application runs on Cloudflare's distributed edge network with built-in DDoS mitigation and Web Application Firewall (WAF) filtering.
Inquiry records are retained only for as long as necessary to fulfill pre-contractual discussions and corporate compliance obligations under Indonesian company law. Security and rate-limiting logs are rotated and purged within 90 days.
5. Third-Party Disclosures
We do not sell, license, rent, or trade your personal information to third parties for commercial advertising.
Your information is disclosed only to vetted technical service providers bound by strict confidentiality requirements:
Relevant processors:
- Cloudflare, Inc. for edge CDN hosting, DDoS mitigation, and Turnstile bot verification.
- Authorized transactional email relay infrastructure used to deliver inquiry notifications directly to our corporate consulting inboxes.
- Law enforcement authorities or governmental regulatory bodies if strictly compelled by a valid legal subpoena or court order under Indonesian jurisdiction.
6. Your Rights as a Data Subject
Under Chapter IV of the Indonesian Personal Data Protection Law (UU PDP), you possess enforceable legal rights regarding your personal data:
Summary of rights:
- Right to Notice: The right to transparent disclosure of controller identity, purpose, and legal basis.
- Right of Access: The right to inspect and obtain copies of personal data held about you.
- Right of Rectification: The right to correct inaccurate, obsolete, or incomplete personal data.
- Right to Erasure: The right to request permanent deletion of your data when no longer required.
- Right to Withdraw Consent: The right to revoke previously given consent for communication.
- Right to Object: The right to object to automated decision-making or unwarranted processing.
8. Amendments to this Privacy Policy
We may periodically revise this Privacy Policy to reflect technology enhancements, security updates, or statutory adjustments.
The 'Last Updated' indicator at the top of this document denotes the most recent revision date. Continued engagement with our digital services constitutes acknowledgment of the revised provisions.
9. Contact and Data Subject Inquiries
If you have inquiries, complaints, or wish to exercise your statutory rights under the UU PDP, please direct your request to our data protection team:
PT Heksa Inti Kreasindo
Jl. Matahari Raya, No. 480 RT.002/RW.010, Jaka Setia
Bekasi Selatan, Jawa Barat 17147, Indonesia