STATUTORY PRIVACY GOVERNANCE · UU NO. 27/2022 (UU PDP)
Privacy Policy & Personal Data Protection (UU PDP No. 27/2022)
PT OmindTech Solusi Digital processes personal and corporate contact data strictly under Law of the Republic of Indonesia No. 27 of 2022 on Personal Data Protection (UU PDP)—enforcing data minimization, cryptographic safeguards, and transparent Data Subject Rights.
1. Data Controller Identity & Lawful Bases (Pasal 20 UU PDP)
For visitors, prospective B2B clients, NDA counterparties, and job applicants interacting with omindtech.id, PT OmindTech Solusi Digital acts as the Personal Data Controller. When building or operating dedicated custom software for an enterprise client under contract, the client acts as Data Controller and PT OmindTech Solusi Digital acts strictly as Data Processor upon documented instructions.
- Explicit Informed Consent: Granular opt-in via our Privacy Preferences banner before activating non-essential analytics or marketing attribution.
- Contractual & Pre-Contractual Necessity: Processing your name, corporate email, role, and technical scope to prepare requested architecture blueprints, quotations, or Mutual NDAs.
- Statutory & Security Obligations: Tax/accounting compliance and preventing unauthorized intrusion or fraud against electronic systems.
2. Purpose Limitation & Cryptographic Controls (AES-256-GCM & TLS 1.3)
We collect only the minimum Personal Data necessary for the stated business purpose and never sell, rent, or trade contact lists to third-party data brokers. In fulfillment of Article 35 of UU PDP, we enforce defense-in-depth technical safeguards:
- AES-256-GCM & TLS 1.3: All transport traffic is encrypted via HTTPS/TLS 1.3 with HSTS, while sensitive system credentials and integration secrets are sealed using authenticated AES-256-GCM encryption.
- 5-Role RBAC, TOTP 2FA & Audit Logs: Internal administrative access requires least-privilege Role-Based Access Control, RFC 6238 TOTP multi-factor authentication, and immutable access logging.
3. Your Data Subject Rights (Pasal 5–13 UU PDP)
Under UU No. 27 Tahun 2022 (UU PDP), every Data Subject holds enforceable rights which PT OmindTech Solusi Digital fulfills promptly following identity verification:
- Right of Access & Information (Hak Akses): Request clarity on processing purposes and obtain a copy of Personal Data we hold about you.
- Right to Rectification (Hak Perbaikan): Correct or complete inaccurate or outdated Personal Data within 3×24 hours of verified request.
- Right to Erasure (Hak Penghapusan): Request permanent deletion of your Personal Data once no longer required for active contractual or statutory retention.
- Right to Withdraw Consent & Data Portability (Penarikan Persetujuan & Portabilitas): Revoke consent anytime via the "Privacy Preferences" footer control or request structured machine-readable export (JSON/PDF).
4. Mandatory 3×24-Hour (72-Hour) Breach Notification (Pasal 46 UU PDP)
In the event of a Personal Data protection failure, PT OmindTech Solusi Digital commits to delivering written notification to affected Data Subjects and the relevant Indonesian Personal Data Protection Authority no later than 3×24 hours (72 hours) from detection.
Every statutory notification specifies: (1) the nature of Personal Data exposed, (2) when and how the incident occurred, and (3) immediate containment, credential rotation, and mitigation measures executed by our security engineering team.
5. Data Retention & Secure Purge Schedule
| Data Category | Processing Purpose | Maximum Retention Period |
|---|---|---|
| Essential Security & Double-Submit CSRF Token (omind_csrf) | Prevent Cross-Site Request Forgery (CSRF) across public inquiry & NDA endpoints. | Maximum 1 hour (ephemeral HttpOnly session expiry) |
| B2B Consultation Inquiries, ROI Blueprints & Mutual NDA Records | Pre-contractual scoping, architecture proposal delivery, and MNDA legal archive. | 24 months from last interaction (or 36 months for active executed MNDAs) |
| Career & Engineering Recruitment Applications (/karir) | Candidate evaluation, technical interviews, and hiring communication. | 12 months from vacancy closure, or purged earlier upon candidate request |
| Security Audit Trails & Rate-Limit Anti-Abuse Telemetry | Intrusion detection, forensic investigation, and statutory audit compliance. | 12 months in restricted encrypted append-only storage |
6. Data Protection Officer (DPO) Contact Channel
To exercise any Data Subject Right under UU No. 27/2022, submit a privacy inquiry, or verify our Data Processing Addendum (DPA), contact our Data Protection Officer:
PT OmindTech Solusi Digital — Data Protection & Security Office
Email DPO: dev@omindtech.id / angga@omindtech.id
Verification & initial acknowledgment SLA: within 3×24 hours (business days).