Introduction
This Privacy Policy explains how Gia Kreasi ("we") collects, uses, shares, and protects the personal data of visitors to https://giakreasi.com. We have written it to align with Law Number 27 of 2022 on Personal Data Protection.
By accessing and using this site, you confirm that you have read and understood this policy. If you do not agree with it, we suggest you do not continue using the site.
Identity of the data controller
Data controller: Gia Kreasi
Address: Jakarta Barat, DKI Jakarta, Indonesia
For any question or request concerning your personal data, use the contact form and select the topic "Request concerning personal data".
The data we collect
We collect two kinds of data.
Data you provide voluntarily
- Contact form: your name, email address, topic, and the message you write.
- Email correspondence: the contents of any email you send us.
- Service enquiries: business name, location, and technical details about the venue, if you request a service consultation.
Data collected automatically
- Server logs: IP address, browser type, operating system, pages accessed, and time of access.
- Device and usage data: screen resolution, device type, referral source, and visit duration.
- Cookies and similar technologies: markers stored in your browser, described further in the Cookie Policy.
We do not collect specific categories of personal data such as health, biometric, personal financial, or national identity number data through this site.
Basis and purpose of processing
| Purpose | Data used | Basis for processing |
|---|---|---|
| Responding to your message | Name, email, message content | Consent |
| Operating and securing the site | Server log data | Legitimate interest |
| Measuring traffic and improving content | Aggregated usage data | Consent |
| Meeting legal obligations | As required | Legal obligation |
We apply the principle of data minimisation: we collect only what is needed for the purposes stated above.
Analytics
We may use an analytics service to understand which pages are most useful to readers. What we see is aggregated, we do not attempt to identify individual visitors. You can refuse analytics cookies through your browser settings, and no measurement runs on your visit.
Sharing data with others
We do not sell your personal data. Data may be shared on a limited basis with:
- Technical service providers: hosting, email delivery, and security, who process data on our instructions.
- Competent authorities: where required by law or by court order.
Some providers are located outside Indonesia. Where data is transferred across borders, we seek to ensure the recipient applies an equivalent level of protection in accordance with applicable rules.
Retention periods
| Type of data | Retention |
|---|---|
| Messages from the contact form | 24 months from the last correspondence |
| Server log data | 12 months |
| Data relating to a service agreement | As required by applicable bookkeeping obligations |
Once the retention period ends, data is deleted or anonymised so that it can no longer be linked to you.
Your rights
Under the Personal Data Protection Law, you have the right to:
- obtain information on the identity of the controller, the legal basis, and the purpose of the request for and use of your personal data;
- complete, update, and/or correct errors in your personal data;
- access and obtain a copy of your personal data;
- end the processing of, delete, and/or destroy your personal data;
- withdraw consent you have given;
- object to decisions based solely on automated processing;
- postpone or restrict the processing of your personal data proportionately;
- bring a claim and receive compensation for a breach in the processing of your personal data.
To exercise these rights, use the contact form. We may request additional information to verify your identity before acting on a request.
Data security
We apply reasonable technical and organisational safeguards, including transmitting data over an encrypted connection (HTTPS), restricting internal access on a need-to-know basis, and reviewing our configuration periodically. Even so, no method of electronic transmission or storage is entirely free of risk.
Should a failure in personal data protection occur that affects you, we will notify you in accordance with applicable rules.
Children's privacy
This site is intended for adult readers and is not directed at children under the age of 18. We do not knowingly collect children's personal data. If you are a parent or guardian and believe your child has provided data to us, contact us so that it can be deleted.
Links to other sites
This site contains links to third-party sites. The privacy policies that apply on those sites are outside our control. We recommend reading each site's own policy before providing personal data.
Changes to this policy
This policy may be updated from time to time to reflect changes in our practices or in applicable rules. The date of the last update appears at the top of the page. For material changes, we will display a notice on the site.