Privacy Policy
Effective from: 2026-11-02
Effective date: 2026-11-02
Version: 1.2
Capital Commerce Consulting (a service brand of PT Mega Supertek Indo, hereinafter "we") operates capital-commerce.com. This policy describes the personal data we collect, how we process it, the third parties involved, your rights as a data subject, and how to contact us. Drafted in accordance with Indonesia's UU PDP No. 27/2022 and standard international practice (GDPR-equivalent).
1. Data controller identity
PT Mega Supertek Indo
Komplek Marinatama Blok A No. 8–9, Jakarta Utara, Indonesia
Service brand: Capital Commerce Consulting
Data privacy contact: consultant@capital-commerce.com
2. Data we collect
2.1 Contact form (submitted voluntarily)
When you submit the form at /contact, we receive:
- Full name (required)
- Email address (required)
- Company name (optional)
- Job title/role (optional)
- WhatsApp number (optional)
- Problem context / pain point (required)
- Budget range (optional)
- Timeline (optional)
- The page you submitted the form from
- Page language (id-ID or en-US)
2.2 Visit statistics (cookieless)
We use Cloudflare Web Analytics for aggregate visit statistics. It sets no cookies, uses no browser storage, and builds no profiles or device fingerprints. It counts:
- Pages visited and number of visits
- Traffic source (referrer)
- Country, device type, and browser
- Page load performance
2.3 Security and operational data
- Cloudflare Turnstile bot check on the contact form. Turnstile reads technical browser signals to tell humans from bots, without setting tracking cookies.
- Request logs on the Cloudflare network (IP, timestamp, user agent), processed by Cloudflare for security and attack protection.
3. Processing purposes + legal basis
| Data | Purpose | Legal basis (UU PDP Article 20) |
|---|---|---|
| Contact form | Responding to your inquiry, sending a confirmation email, internal team notification | Your consent (Article 20(2)(a)) |
| Visit statistics | Understanding which pages are read and improving site content | Legitimate interest, aggregate data without identity (Article 20(2)(f)) |
| Bot check + security logs | Protecting the form and the site from spam and attacks | Legitimate interest (Article 20(2)(f)) |
4. Third parties (data processors)
We use the following third-party services. Each is bound by its own privacy policy and processes data on our instructions.
| Service | Function | Provider | Jurisdiction |
|---|---|---|---|
| Cloudflare | Site hosting (Pages), form processing, DNS, CDN, DDoS protection, bot check (Turnstile), visit statistics (Web Analytics) | Cloudflare Inc. | United States (global network) |
| Resend | Delivery of form notification and confirmation emails | Resend Inc. | United States |
| Google Workspace | Mailbox for consultant@capital-commerce.com |
Google LLC | United States |
| Telegram Bot API | Internal lead notifications to the team group | Telegram Messenger Inc. | United Arab Emirates |
| DigitalOcean | Server relaying internal notifications to Telegram | DigitalOcean LLC | Singapore (SGP1 region) |
Privacy policy of each provider: Cloudflare (cloudflare.com/privacypolicy), Resend (resend.com/legal/privacy-policy), Google (policies.google.com/privacy), Telegram (telegram.org/privacy), DigitalOcean (digitalocean.com/legal/privacy-policy).
5. Cookies
This site sets no cookies of its own and uses no analytics or advertising cookies. Language is determined by the page address (/en for English), not by a cookie. Cloudflare may set a strictly necessary security cookie (for example __cf_bm) to tell visitors from bots. It is not used for tracking.
6. Cross-border data transfers
Some providers (Cloudflare, Resend, Google, Telegram) process data outside Indonesia. These transfers rely on:
- Your consent when submitting the contact form
- The need to deliver the service you requested (reply and confirmation email)
- Equivalent data protection standards (Standard Contractual Clauses or equivalent safeguards from each provider)
7. Your rights as a data subject (UU PDP Art. 4–13)
You have the right to:
- Access — request a copy of the personal data we hold about you
- Correction — request rectification of inaccurate or outdated data
- Erasure (right to be forgotten) — request deletion of your personal data
- Restriction of processing — limit processing for specific purposes
- Portability — receive your data in machine-readable format
- Objection — object to processing for specific purposes
- Withdraw consent — revoke consent at any time without consequence
- Lodge complaint — to Komisi Perlindungan Data Pribadi (KPDP)
How to exercise your rights
Email consultant@capital-commerce.com with subject "PDP Request: [type of request]" or "Data Request: [type]". Include:
- Name and email used when submitting the form (for identity verification)
- Request type (access / correction / erasure / etc.)
- Specific details (optional)
Response within 7 business days. Complex requests may extend up to 30 business days with prior notice.
8. Storage + retention
| Data type | Retention | Reason |
|---|---|---|
| Contact form content (in the team mailbox and Telegram group) | Until you request deletion | Ongoing commercial relationship |
| Email delivery log (Resend) | 30 days | Resend default, delivery troubleshooting |
| Visit statistics (Cloudflare Web Analytics) | Per Cloudflare default | Aggregate data without personal identity |
| Network request logs (Cloudflare) | Per Cloudflare policy | Security and attack protection |
This site does not store form content in a database of its own.
9. Data security
We apply appropriate technical and organisational measures:
- HTTPS (TLS 1.2+) for all communication
- Static site with no database; forms are processed by Cloudflare serverless functions
- API keys and secrets stored encrypted in Cloudflare, not in the site code
- Bot check (Turnstile) and DDoS protection on every form request
- Notification relay server: active firewall, SSH key-only access, no password login
- API key rotation on any suspected compromise
No system is 100% secure. In the event of a personal data protection failure, we will notify affected data subjects and the personal data protection authority within 3x24 hours in accordance with UU PDP Article 46.
10. Minors
Our services target B2B audiences (adult professionals). We do not knowingly collect data from individuals under 18. If you believe your child has submitted data to us, contact consultant@capital-commerce.com for erasure.
11. Policy updates
This policy may be updated. Material changes will be announced on this page with a new version and effective date, shown at the top. Continued use after changes are in effect constitutes acceptance of the latest version.
12. Contact
For questions, complaints, or to exercise your rights:
Email: consultant@capital-commerce.com
Mail: Capital Commerce Consulting, c/o PT Mega Supertek Indo, Komplek Marinatama Blok A No. 8–9, Jakarta Utara, Indonesia
Lodging complaints with the authority:
Komisi Perlindungan Data Pribadi (KPDP) Complaints via the KPDP portal once the agency becomes operational (timeline per government announcement).