Privacy Policy

1. Overview

YPYM Company ("we," "us," or "our") is committed to protecting your privacy in accordance with Law No. 27 of 2022 on Personal Data Protection ("PDP Law") and other applicable regulations. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website or use our development and venture studio services.

2. Definitions (Under PDP Law)

• "Personal Data" means any data relating to an identified or identifiable individual, either directly or indirectly.
• "Controller" means the party determining the purposes and means of processing personal data (us).
• "Processor" means the party processing personal data on behalf of the controller.
• "Data Subject" means the individual to whom the personal data relates (you).

3. Types of Personal Data We Collect

We may collect the following categories of personal data:

A. Automatically Collected Information

• IP address
• Browser type and version
• Operating system
• Time and duration of visits
• Pages accessed and referring sources

B. Voluntarily Provided Information

• Full name
• Email address
• Phone number
• Company name and position
• Billing and payment information
• Project requirements and communications

C. Sensitive Data

We do not intentionally collect sensitive personal data (health information, biometrics, criminal records) unless required for specific services with your explicit consent.

4. Purposes of Data Collection and Legal Basis

We process your personal data based on the following lawful grounds under PDP Law:

5. Data Sharing and Disclosure

We do not sell or rent your personal data. We may share your data with:

• Service Providers: Trusted third parties (cloud hosting, payment processors, AI tools) under strict data processing agreements.
• Professional Advisors: Lawyers, accountants, and consultants bound by confidentiality.
• Government Authorities: When required by Indonesian law or court order.

6. Data Security

We implement administrative, technical, and physical safeguards to protect your personal data, including:

• Data encryption in transit and at rest
• Role-based access controls
• Regular security audits
• Internal staff training on data protection

7. Data Retention

We retain your personal data only as long as necessary to fulfill the purposes for which it was collected, or as required by Indonesian law. After that period, data will be deleted or anonymized.

8. Your Rights as Data Subject

Under the PDP Law, you have the following rights:

• Right to access your personal data
• Right to rectify inaccurate or incomplete data
• Right to withdraw consent at any time
• Right to request deletion of your data (Right to be Forgotten)
• Right to restrict processing
• Right to data portability
• Right to object to automated decision-making

To exercise your rights, please contact us at [email protected].

9. International Data Transfers

Your data may be processed outside Indonesia (e.g., cloud servers). We ensure such transfers are protected by appropriate safeguards, such as Standard Contractual Clauses, in compliance with PDP Law.

10. Children's Data

Our Services are not intended for individuals under 18. We do not knowingly collect data from children without parental consent.

11. Changes to This Policy

We may update this Privacy Policy periodically. Changes will be posted here with an updated "Last Updated" date.