Privacy Policy

1. Overview

YPYM Company (legally registered as PT ADI TJANDRA TEKNOLOGI, "we," "us," or "our") is committed to protecting your privacy in accordance with Law No. 27 of 2022 on Personal Data Protection ("PDP Law") and other applicable regulations. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website or use our development and venture studio services.

2. Definitions (Under PDP Law)

• "Personal Data" means any data relating to an identified or identifiable individual, either directly or indirectly.
• "Controller" means the party determining the purposes and means of processing personal data (us).
• "Processor" means the party processing personal data on behalf of the controller.
• "Data Subject" means the individual to whom the personal data relates (you).

3. Types of Personal Data We Collect

We may collect the following categories of personal data:

A. Automatically Collected Information

• IP address
• Browser type and version
• Operating system
• Time and duration of visits
• Pages accessed and referring sources

B. Voluntarily Provided Information

• Full name
• Email address
• Phone number
• Company name and position
• Billing and payment information
• Project requirements and communications

C. Sensitive Data

We do not intentionally collect sensitive personal data (health information, biometrics, criminal records) unless required for specific services with your explicit consent.

4. Purposes of Data Collection and Legal Basis

We process your personal data based on the following lawful grounds under PDP Law:

Figure 1: Legal basis and lawful processing categories for personal data collection under the Indonesian Personal Data Protection (PDP) Law.

5. Third-Party Infrastructure and Sub-Processors

We partner with enterprise infrastructure, analytics, and technology providers under strict Data Processing Agreements (DPAs) and security standards:

Figure 2: Enterprise infrastructure providers, operational scopes, and data transfer safeguards governing platform services.

6. Google API Services, OAuth 2.0 User Data & Limited Use Policy

When users authenticate, sign in, or interact with our platform and client systems using Google OAuth 2.0, we collect and process only the minimal necessary Google user profile data required for account identity verification and authorized platform access.

A. Google User Data We Collect

• Basic Profile Information: User's full name, verified primary email address, profile photo URL, and unique Google account identifier (subject ID).
• Authentication Tokens: Cryptographically secured OAuth 2.0 access and refresh tokens used exclusively to validate and maintain active user sessions.

B. Purpose and Use of Google User Data

Information received via Google APIs is used strictly for:

• Authenticating user identity and granting secure access to authorized dashboards and workspace features.
• Creating and managing user account profiles within YPYM platforms.
• Delivering essential administrative notifications, security alerts, and service updates.

C. Data Sharing, Retention, and Revocation

We do not sell, rent, monetize, or transfer your Google user data to third-party data brokers, advertising networks, or external commercial entities. Google user data is retained only for the duration of the active account relationship. Users may request complete deletion of their account records by emailing [email protected], or immediately revoke YPYM's access to their Google account at any time via Google Account Security Settings.

D. Google API Services User Data Policy Compliance (Limited Use Disclosure)

YPYM Company's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

E. AI Safety & Non-Consensual Intimate Imagery (NCII) Prohibition

In strict accordance with the Google APIs Terms of Service, YPYM Company prohibits, and does not use Google APIs or artificial intelligence capabilities for, the creation, processing, hosting, generation, or dissemination of AI-generated Non-Consensual Intimate Imagery (AI NCII), sexually explicit material, deepfakes, or any harmful, abusive, or non-consensual content.

7. Data Security

We implement administrative, technical, and physical safeguards to protect your personal data, including:

• Data encryption in transit and at rest
• Role-based access controls
• Regular security audits
• Internal staff training on data protection

8. Data Retention

We retain personal data only as long as necessary for its stated purpose and applicable legal requirements. The following schedule applies:

Figure 3: Statutory data retention schedule across website connection logs, operational records, and commercial enterprise files.

After the applicable period, data is securely deleted or irreversibly anonymized.

9. Your Rights as Data Subject

Under the PDP Law, you have the following rights:

• Right to access your personal data
• Right to rectify inaccurate or incomplete data
• Right to withdraw consent at any time
• Right to request deletion of your data (Right to be Forgotten)
• Right to restrict processing
• Right to data portability
• Right to object to automated decision-making

To exercise your rights, please contact us at [email protected].

10. International Data Transfers

Your data may be processed outside Indonesia (e.g., cloud servers). We ensure such transfers are protected by appropriate safeguards, such as Standard Contractual Clauses, in compliance with PDP Law.

11. Children's Data

Our Services are not intended for individuals under 18. We do not knowingly collect data from children without parental consent.

12. Changes to This Policy

We may update this Privacy Policy periodically. Changes will be posted here with an updated "Last Updated" date.

13. Contact Us and Data Protection Officer

If you have questions, concerns, or formal data subject requests regarding this Privacy Policy or our personal data handling practices, please contact our Data Protection team:

YPYM Company (PT ADI TJANDRA TEKNOLOGI)
Nomor Induk Berusaha (NIB): 1003260083966
Data Protection Officer (DPO) Email: [email protected]
Corporate Address: Indonesia Stock Exchange Tower 1 Level 3, Unit 304, Jl. Jendral Sudirman Kav. 52-53, Senayan, Kebayoran Baru, Jakarta Selatan, DKI Jakarta 12190, Indonesia