Privacy Policy

01Introduction

Pandawa respects your privacy and is committed to protecting personal data in line with Law No. 27 of 2022 on Personal Data Protection (the PDP Law) and its implementing regulations.

This policy explains the personal data we collect, how and why we process it, the legal basis for processing, who it may be disclosed to, how long it is kept, how we protect it, your rights as a Data Subject, and how to contact us.

It applies to the corporate website pandawa.io and the official communication channels connected to it.

02Scope & Data Controller Identity

This policy applies to visitors of the website and to individuals who contact Pandawa through the contact form or the site's official channels.

For activity on this corporate website, Pandawa acts as the Personal Data Controller. Where Pandawa processes personal data for a client in delivering a project or service, Pandawa may act as a Personal Data Processor under a separate agreement with that client, not under this policy.

Requests regarding personal data protection may be sent through the privacy contact channel above.

03Personal Data We Collect

A. Identity & Contact Data

• Full name
• Company or organization name (optional)
• Email address
• Phone or WhatsApp number (optional)

B. Project Requirement Data

• Service of interest
• Estimated budget (optional)
• Expected timeline (optional)
• Project description and requirements

C. Technical Data

This website does not use cookies, analytics, or third-party tracking. The only technical data we process is your IP address, temporarily, when the contact form is submitted, solely to limit repeated submissions (anti-spam) and maintain security. We do not store it in a database. Our hosting provider may record request metadata at its infrastructure layer under its own privacy policy.

D. Data from Direct Communication

If you contact us by email or another official channel, the data you provide (such as your email address and message content) is used to respond to your request.

04Purpose & Legal Basis of Processing

We separate the purpose of processing from its legal basis. To respond to prospective clients, the basis we rely on is the Data Subject's request prior to entering a contract (Article 20 of the PDP Law), not consent alone.

We do not use your data for marketing unrelated to your initial request. If we later send a newsletter or marketing communication, we will ask for separate consent first.

05How Data Is Used

The personal data you submit is used to:

• Respond to questions and requests for information
• Understand prospective client needs
• Contact you about your project request
• Prepare communication or an initial proposal based on your needs
• Maintain the security and integrity of the website
• Meet legal obligations

We do not use your personal data beyond the purposes described above.

06Disclosure to Third Parties

We use third-party service providers to operate this website. We do not sell your personal data and do not share it for third-party marketing.

Each provider's role is to process data in support of the website's operation. A provider's use of data is governed by its own terms of service and agreements; we do not claim that providers are barred from using data for any purpose beyond that support.

07International Data Transfers

Our hosting and email providers operate global infrastructure, so your personal data may be processed or transferred outside Indonesia.

Where that happens, we ensure it complies with Article 56 of the PDP Law: an equal or higher level of personal data protection, adequate and binding safeguards, or — if neither can be met — the Data Subject's consent as required by law.

08Cookies & Similar Technologies

This website does not use cookies, localStorage, sessionStorage, marketing pixels, or third-party analytics scripts. Because there are no non-essential technologies, we do not show a cookie consent banner.

Language preference is determined from the URL (for example /id or /en), not from a cookie. You may still clear or block cookies through your browser settings; doing so does not affect how this website functions.

09Data Retention & Deletion

This website does not store form messages in a database. Each submission is forwarded as an email to our team and, where relevant, an acknowledgement is sent to you. Copies of the data therefore reside in email systems (the team mailbox and the email provider), not in the website application.

For prospect data, we keep correspondence only as long as necessary to respond to and follow up on your request, then delete or anonymize it, unless the discussion continues into an engagement or retention is required by law.

Data tied to a contract or engagement document follows the retention period relevant to that relationship and applicable legal obligations. Copies in backups or system logs follow the relevant provider's retention cycle; we do not promise instant deletion from all backups.

10Data Security & Protection

We apply reasonable technical and organizational measures appropriate to the risk to protect personal data, including:

• HTTPS-encrypted connections across the website
• Limiting access to message data to the team handling incoming communication
• Input validation and rate limiting on the contact form to prevent abuse
• Same-origin checks on the form endpoint
• An anti-bot (honeypot) field to filter automated submissions

We do not claim any specific security certification (such as ISO 27001) and do not promise that data transmission over the internet is entirely risk-free.

11Security Incident Handling

If a personal data protection failure occurs, we will investigate and identify the impact and the data affected, take mitigation steps, notify the affected Data Subjects and the relevant authority as required (no later than 3×24 hours under Article 46 of the PDP Law), and carry out remedial action to reduce the risk of recurrence.

12Data Subject Rights

Under the PDP Law, you have the right to:

1. 1Obtain information about the identity of the Personal Data Controller, the basis of processing, its purpose, and use of your data
2. 2Access and obtain a copy of your personal data
3. 3Correct and complete inaccurate personal data
4. 4End processing, delete, or destroy your personal data as permitted by law
5. 5Withdraw consent to processing, where consent is the legal basis
6. 6Object to a decision based solely on automated processing, including profiling, that has a significant effect
7. 7Restrict or defer the processing of your personal data
8. 8Obtain and use your personal data in a commonly used format, or transmit it to another Personal Data Controller (data portability)
9. 9Bring a claim and obtain remedies in accordance with the law

To exercise your rights, we may need to verify your identity to prevent access by unauthorized parties. Requests are processed according to applicable procedures and timeframes.

13Children's Privacy & Third-Party Links

The Pandawa corporate website is not specifically directed at children, and we do not knowingly collect children's personal data through the contact form. If we learn that such data was collected without the required basis or consent, we will take appropriate action in line with applicable law.

This website may contain links to third-party sites (for example WhatsApp or social media). We are not responsible for the privacy practices and data processing on those sites, and we encourage you to read each site's privacy policy.

14Changes to This Policy & Privacy Contact

We may update this policy as our operations, services, technology, or legal requirements change. For material changes affecting how or why data is processed, we will give notice as required by law. The effective date and last-updated date are always shown on this page.