Legal
Privacy Policy
This document explains what personal data we collect through this site, what we use it for, and your rights over that data.
Terakhir diperbarui: October 6, 2026
This Privacy Policy applies to the site beresindigital.id, operated byPT Beresin Urusan Digital ("we") as the controller of personal data, domiciled inDepok, Indonesia. We process personal data in accordance with Law No. 27 of 2022 on Personal Data Protection ("PDP Law") and its implementing regulations.
1. Data we collect
a. Data you provide yourself
When you fill in a consultation or contact form, we collect your full name, WhatsApp/phone number, email address (optional), and a description of your project needs. We also record which page the form was submitted from.
b. Technical data
Our server records IP address, device type, and access time for security, abuse prevention, and rate limiting. For form submissions, the IP address is stored in asalted hash (HMAC) form, not the raw address, in line with the principle of data minimisation.
2. Basis and purposes of processing
| Purpose | Basis for processing |
|---|---|
| Responding to consultation and proposal requests | Your consent; performance of a contract |
| Preventing spam, abuse, and security attacks | Our legitimate interest |
| Site visit analytics (aggregate statistics) | Your consent (analytics cookies) |
| Compliance with legal and administrative obligations | Legal obligation |
We do not use your data for targeted advertising and do not sell personal data.
3. Cookies and similar technologies
This site uses two different kinds of measurement, and we distinguish them transparently:
- Cloudflare Web Analytics — cookieless measurement with no personal identification. Data is aggregate (visit counts, popular pages, referrers). Because it does not process personal data, this technology does not require consent, but we disclose it here anyway.
- Google Analytics 4 (GA4) — uses cookies and can identify a device. GA4 cookies are only loaded after you give consent through the banner shown on your first visit. If you decline, the GA4 script does not run at all. We also enable Google Consent Mode v2 with all initial states set to denied.
You can change or withdraw your choice at any time via the "Cookie Preferences" link in the banner and in the site footer.
4. Third parties that process data
We use a number of service providers that process data on our behalf under data processing agreements:
| Provider | Role | Data |
|---|---|---|
| Cloudflare, Inc. | CDN, security, and web analytics | Request metadata; aggregate cookieless statistics |
| Google (GA4) | Visit analytics | Device and interaction data — only after consent |
| Brevo (Sendinblue) | Notification email delivery | Message contents and destination email address |
| VPS provider in Indonesia | Database and site file storage | All application data |
Application data (database and files) is stored on server infrastructure located in Indonesia. Cloudflare's CDN terminates TLS at the point nearest to you, so some request metadata may pass through Cloudflare infrastructure outside Indonesian territory. We have signed data processing agreements with these providers.
5. Data retention
- Lead data from forms: maximum 24 months since last contact.
- Security and rate-limit logs: maximum 90 days.
- Aggregate analytics data: per the provider's retention configuration (maximum 14 months for GA4).
- Contract and administrative documents: per applicable legal obligations.
Once the retention period ends, data is permanently deleted or anonymised.
6. Security
We apply reasonable technical and organisational measures, including TLS encryption on all site traffic, storing administrator passwords with the argon2id algorithm, restricting access to the admin panel, audit logging, and regular database backups. Nevertheless, no method of transmission or storage is entirely free of risk.
7. Your rights as a data subject
Under the PDP Law, you have the right to:
- obtain information about our identity, and the basis and purposes for processing your data;
- access and obtain a copy of the personal data we hold about you;
- request updates or corrections to inaccurate data;
- request the deletion of your personal data;
- withdraw your consent to data processing;
- object to certain processing;
- request restriction of data processing;
- file a claim and/or receive compensation for violations of your rights.
Requests can be made by email to[email protected]. We will verify your identity and respond within 3×24 hours as required by the PDP Law.
8. Minors
This site is intended for businesses and institutions, not for children under 18. We do not knowingly collect children's personal data. If you become aware of any such data, contact us and we will delete it.
9. Changes to this policy
We may update this Privacy Policy from time to time. The latest version is always marked with the "Last updated" date at the top of the page. Material changes will be communicated via a notice on the site.
10. Contact
Questions about this Privacy Policy can be sent to:
PT Beresin Urusan Digital
Depok, Indonesia
Email: [email protected]