Who is responsible for your data
The controller of your personal data is the company that operates this website:
- Company
- PT BINTANG ARTHA DUNIA (Perseroan Terbatas), registered in Indonesia
- Registered address
- Jl. Raya Campuhan, Desa/Kelurahan Sayan, Kec. Ubud, Kab. Gianyar, Provinsi Bali, Kode Pos: 16966
- Contact for data matters
- info@bintangarthadunia.com
Use this email address for any question about this policy and for any request concerning your data. Requests about work go to contact@bintangarthadunia.com, the address that also receives messages sent through the request form.
What data we handle
| Situation | Data | Where it comes from |
|---|---|---|
| You write to us by email | Your email address, your name and whatever you put in the message | From you |
| You fill in the request form | Name, email address, company (optional) and the text of your message; the language version of the site and the time the request was sent | From you |
| You start filling in the request form, which runs the Cloudflare Turnstile security check | IP address, information about your browser and device that the check reads (such as browser type and settings), and the result of the check | From your browser, through Cloudflare |
| You open a page of this site | IP address, date and time, the address of the page requested, and the browser and device type your browser reports | From your browser, automatically |
| You make a choice in the cookie panel | Your choice, its date and the version of the panel | Kept only in your browser; it is not sent to us |
When you send the form, the website does not keep a copy of what you entered: it checks the entries and passes them on as an email to contact@bintangarthadunia.com. The text of your message is not written to the logs of the web server.
The site has no analytics, no advertising, no social media plug-ins and no content embedded from other websites, apart from the Cloudflare Turnstile security check, which loads only when you start filling in the request form. Fonts and images are served from the site's own domain. We do not ask for special categories of personal data and do not buy data about you from anyone. Please do not include such data in your messages.
Why we handle it and on what legal basis
| Purpose | Data used | Legal basis under the GDPR |
|---|---|---|
| Answering your request and taking the steps you ask for before an agreement is made | Contact details and the content of your message | Steps prior to entering into a contract at your request, Article 6(1)(b); for messages not related to an agreement, our legitimate interest in answering people who write to us, Article 6(1)(f) |
| Protecting the request form and our mailbox from spam and automated submissions: the Cloudflare Turnstile check and a limit on the number of requests sent from one IP address | IP address, browser and device information, the result of the check | Our legitimate interest in receiving genuine requests and keeping the form free of abuse, Article 6(1)(f) |
| Delivering the pages of the site and keeping the site secure | Technical data sent by your browser | Our legitimate interest in running a working and secure website, Article 6(1)(f) |
| Remembering your choice in the cookie panel | The record kept in your browser | Our legitimate interest in respecting the choice you made, Article 6(1)(f). This storage is strictly necessary and does not require consent |
| Complying with the law, for example keeping business correspondence where the law requires it | Correspondence with you | Legal obligation, Article 6(1)(c) |
Under the UU PDP the same processing rests on the corresponding grounds named in that law: performing an agreement or acting on your request before one is made, legitimate interest, and compliance with legal obligations. We do not currently rely on your consent for any processing. If that changes, we will ask you first, and you will be able to withdraw consent at any time.
We do not use your data for marketing, and we do not send newsletters.
Who receives your data
We do not sell personal data and do not pass it on for advertising. It can be received only by the providers of the services needed to run the website and the mailboxes, and by public authorities:
| Recipient | What it does for us | Data it receives | Country |
|---|---|---|---|
| Cloudflare, Inc. | Runs the Turnstile security check on the request form. The pages of the site are also delivered through Cloudflare's network (domain name service, content delivery and proxy), which handles the encrypted HTTPS connection | IP address, browser and device information, the result of the check; for page delivery, the technical data of each page request | United States; Cloudflare's network operates worldwide |
| Google LLC | Provides the Gmail account through which the website sends each request as an email (SMTP). A copy of the sent email may be kept in that account | The contents of the form and the time it was sent | United States |
| Proton AG | Hosts the mailboxes of the bintangarthadunia.com domain, where requests and emails to us are received and kept | Your emails to us and the requests sent through the form | Switzerland |
| HOSTKEY B.V. | Provides the virtual server on which the website runs. The server is located in Germany (European Union) | The technical data of page requests and, briefly, the contents of the form while it is being sent | The Netherlands (company); server in Germany |
Cloudflare describes Turnstile in its Turnstile Privacy Addendum: it handles the data on behalf of website operators and, as a controller in its own right, also uses it to improve its detection of bots. Public authorities and courts receive data only where the law obliges us to disclose it.
Transfers to other countries
PT BINTANG ARTHA DUNIA is established in Indonesia. The website runs on a server in Germany (European Union). Your data is also handled in Indonesia and in the countries of the other recipients listed above: the United States (Cloudflare, Inc. and Google LLC; Cloudflare's network also operates in other countries) and Switzerland (Proton AG). If you write to us from the European Union or the European Economic Area, some of your data is therefore handled outside those territories.
The European Commission recognises Switzerland as providing an adequate level of data protection. Cloudflare, Inc. and Google LLC state that they participate in the EU–U.S. Data Privacy Framework, and Cloudflare's data processing terms also include the EU standard contractual clauses. The European Commission has not adopted an adequacy decision for Indonesia. You send us your data yourself when you write to us, and we use it only to answer your request.
If we send personal data from Indonesia to another country, we follow the rules on cross-border transfers of the UU PDP.
How long we keep it
- Correspondence: for as long as it takes to deal with your request and with any dealings that follow from it. After that it is deleted, unless the law requires us to keep business records for longer.
- Technical data of page requests: the web server does not keep access logs. Application and system logs on the server, which record technical events and errors but not the contents of the form, are kept for 14 days and then deleted automatically. Cloudflare keeps its own logs of the requests it delivers according to its own policies.
- Your IP address for the limit on the number of requests: in the memory of the web server for up to 10 minutes after your last request, and not written to disk. Cloudflare keeps the data of the security check according to its own terms.
- Emails with requests: in our mailboxes at Proton and in the sending Gmail account, for as long as described for correspondence above.
- The record of your cookie choice: 12 months in your browser, or until you delete it. After that the site asks again.
Your rights
You can ask us to:
- confirm whether we hold data about you and give you a copy of it;
- correct or complete data that is inaccurate or out of date;
- delete your data or stop handling it;
- restrict or suspend the handling of your data;
- hand your data over to you or to another controller in a commonly used format, where this right applies;
- stop handling based on legitimate interest, if you object to it;
- withdraw a consent you have given, without affecting what was done before.
You also have the right not to be subject to a decision based solely on automated processing, and the right to claim compensation as provided by law if your data has been handled unlawfully.
To use any of these rights, write to info@bintangarthadunia.com. It is free of charge. We answer within the time limits set by the applicable law: under Indonesian Law No. 27 of 2022, within 3 x 24 hours of receiving a request for access, for correction, to stop or restrict processing, or to withdraw consent; under the GDPR, within one month of receiving the request. We may ask you for information needed to confirm that the request comes from you.
Complaints
If you believe your data has been handled unlawfully, please write to us first so that we can put it right. You also have the right to complain to a supervisory authority:
- in the European Union or the European Economic Area: the data protection authority of the country where you live or work, or where the suspected infringement took place;
- in Indonesia: the authority responsible for personal data protection under Law No. 27 of 2022.
Do you have to give us your data
No law or contract obliges you to give us data. If you do not provide a way to reach you, however, we cannot answer your request. We do not make automated decisions about you and do not build profiles.
The site is addressed to businesses and adults. It is not intended for children, and we do not knowingly handle children's data.
How the data is protected
The site is served only over an encrypted connection (HTTPS); plain HTTP requests are redirected to HTTPS. The site sets security headers that restrict what a page may load and where data may be sent. Emails with requests leave the website over an encrypted connection to the mail server. We collect as little data as possible, which is the most reliable protection of all. No method of transmission over the internet is completely secure, so please do not send confidential information through the site.
Changes and language
If the way we handle data changes, we will update this page and the date at the top. See also the Cookie Policy, the Terms of Use and the Legal Notice.
This policy is published in English and Indonesian.