Privacy policy

1. Who is responsible for your data

The controller of personal data collected through this website is Zandrel Editorial, Jalan Bunga Raya No. 25, Kebayoran Baru, Jakarta Selatan, DKI Jakarta 12160, Indonesia. Telephone: +62 813 6745 2918. Privacy enquiries can be sent to [email protected].

We handle personal data in line with Law No. 27 of 2022 on Personal Data Protection (UU PDP) and related regulations in Indonesia.

This policy applies to everything published at www.zandrel.id, including the contact form and the cookie notice. It does not apply to external websites we link to. In this policy, “personal data” means any information about an identified or identifiable person, such as a name, an email address or an IP address, and “processing” covers collecting, storing, using, sharing and deleting it. Zandrel is a small editorial team. It has not appointed a separate data protection officer, and privacy questions are handled by the managing editor, who can be reached at the email address above. If that changes, this page will name the person responsible.

The site has no user accounts, no payment system, no newsletter sign-up and no comment section. Because of that, the amount of personal data we hold is small, and most readers never give us any personal data at all beyond the technical information that every web server receives.

2. What we collect

Zandrel does not require an account and does not sell products. We collect only what is needed to run the site and answer readers.

We do not ask for medical records or details about your health. If you include health information in a message, you do so voluntarily; we will use it only to reply and will delete it on request.

The following points describe each category in more detail:

• Contact form. The form asks for your name, email address, a subject and your message. Providing them is voluntary, but we cannot reply without a working email address. We do not ask for a telephone number, date of birth, identity number or address. If you write to us by email or telephone instead of the form, we treat what you send in the same way and keep it for the same period.
• Technical logs. The web server records the IP address, the page requested, the browser and device type reported, the referring page if there is one, and the time. We use these logs to find faults, to spot unusual traffic that could harm the site, and to see in broad terms which pages are read. We do not use them to identify individual readers, and we do not combine them with the contents of messages.
• Cookie preference. The item stored on your device holds only your answer to the cookie notice. It is not sent to us, and the cookie policy describes it in full.
• Data requests. When you ask to exercise a right, we keep the request, the steps we took and our reply, so that we can show that the law was followed.

We do not collect location data, payment details, biometric data, data about children, or any sensitive category of data on purpose. We do not create profiles of readers and do not use automated decision-making. Because we do not use advertising or measurement tools, we do not receive data from advertising networks or data brokers; the only source of personal data is you, and the technical information sent by your browser.

3. Sharing your data

We do not sell personal data or share it for advertising. Data may be handled by service providers that act on our instructions, such as web hosting and email providers. They are bound by confidentiality and security obligations. We may disclose data where required by law or a lawful request from an Indonesian authority.

The service providers that may handle personal data for us are named below, so that you know who they are:

These providers may use the data only to supply their service to us, and they are bound by their contractual security and confidentiality terms. We review the list at least once a year, and we will update this page before adding a new provider that handles personal data. We do not share data with advertisers, insurers, employers, data brokers or social media companies.

4. Transfers outside Indonesia

Some providers may store data on servers outside Indonesia. Where this happens, we take steps to make sure the recipient offers a level of protection comparable to that required by Indonesian law, or we rely on your consent.

In practice, the website itself is hosted in the Jakarta region, so the pages and server logs are stored in Indonesia. Messages sent through the contact form pass through an email service whose data centres may be located elsewhere, and loading the fonts involves a request to servers that may also be outside Indonesia. Article 56 of Law No. 27 of 2022 addresses transfers of personal data outside the country and asks the controller to make sure that the receiving country or organisation provides an equal or higher level of protection, or that other adequate safeguards or consent exist. We rely on the providers' published security commitments and on your consent when you choose to send a message.

If you prefer that your message does not leave Indonesia, you can write to us by post at the address in section 1, and the letter will be handled on paper and by staff in Jakarta. You can also ask us to tell you which provider handled your message and where, and we will reply within the time stated in section 6.

5. Security

The site is served over HTTPS. Access to messages is limited to named editorial staff, and contact messages are stored in access-controlled systems. No online service can be completely secure; if a breach affects your data, we will notify you and the competent authority as required by law.

The measures we use include:

• encrypted connections (HTTPS) between your browser and the website;
• individual logins and two-step verification for the email and hosting accounts used by editorial staff;
• limiting access to messages to the managing editor and the editor-in-chief;
• keeping the software used to publish the site up to date and removing accounts of former staff on the day they leave;
• deleting messages and logs at the end of the retention periods in the table in section 2.

Law No. 27 of 2022 provides that affected people should be notified in writing within three days (3 x 24 hours) after a failure of personal data protection becomes known, and that the authority may also need to be informed. If a breach affects your data, our notice will describe what happened, what data was involved, what we have done about it and what you can do to reduce risk.

6. Your rights

Under the PDP Law you have the right to:

• obtain information about how your data is used;
• access and obtain a copy of your data;
• correct inaccurate or incomplete data;
• request deletion or ending of processing, subject to legal retention duties;
• withdraw consent at any time, without affecting earlier processing;
• object to automated decisions that affect you (we do not make any);
• lodge a complaint with the competent personal data protection authority in Indonesia.

To exercise a right, write to [email protected] or use the contact form and choose “Privacy or data request”. We may ask for information to confirm your identity and aim to reply within 14 days.

The following clarifications explain how each right works in practice:

1. Information and access. You can ask what data we hold about you and receive a copy in a common electronic format. Because we hold little, the reply is usually a short summary of the message or messages you sent and the date they were received.
2. Correction. If your name or email address was entered incorrectly, tell us and we will change it. We cannot rewrite the history of a message you sent, but we can add a note that the details were corrected.
3. Deletion. We will delete your messages on request unless the law requires us to keep a record, such as the record of the data request itself, which is kept for 36 months. Deleting a message also removes it from our email system, though copies may remain in routine backups for up to 30 days before they are overwritten.
4. Withdrawing consent. You can withdraw consent at any time by writing to us. We will stop using your data for the purpose you consented to as soon as practicable. Withdrawal does not affect anything we did before it, for example a reply already sent.
5. Identity checks. To protect your data from someone else, we may ask you to write from the email address you used before or to confirm a detail of your earlier message. We will not ask for a copy of an identity document unless there is no other reasonable way to confirm who you are.
6. Time and cost. There is no charge for ordinary requests. If a request is complex, we may extend the reply period by up to 14 further days, and we will tell you in advance and explain why.

If you are not satisfied with our reply, you can ask for it to be reviewed by the editor-in-chief, who will answer within ten working days. You may also contact the authority responsible for personal data protection in Indonesia or the Ministry of Communication and Digital Affairs (Komdigi), and you may seek a remedy through the courts.

7. Children

The website is written for adults and is not directed at children under 18. We do not knowingly collect data from children. If you believe a child has sent us data, please contact us and we will delete it.

Because the contact form does not ask for a date of birth, we cannot check the age of the sender. If a message makes it clear that the sender is under 18, we will reply in general terms, will not keep the message for longer than needed to answer it, and will encourage the sender to speak to a parent, guardian or school health service. A parent or guardian who wants a child's message deleted can write to us at the address in section 1, and we will act on the request within 14 days.

8. External links

Articles link to external sites, including government and professional bodies. We are not responsible for their privacy practices and recommend reading their policies.

When you follow a link, your browser sends the address of the page you came from to the destination site, which is normal behaviour on the web. Depending on your browser settings, this may be only the domain name or the full page address, and the other site may see that the visit came from Zandrel. We do not pay for links or receive data back from the sites we link to, and we do not know whether you followed a link unless the destination site tells us, which it does not.

9. Changes to this policy

If we change this policy in a meaningful way, we will update the date at the top and describe what changed. Earlier versions are available on request.

The changes made so far are listed below. Minor corrections, such as a typing error or a changed link, are recorded too, so that the history is complete.

If a change affects how your data is used in a way you might not expect, we will post a notice on the home page for at least 30 days, in addition to updating this page. If we ever need your consent for a new use, we will ask you again and not rely on your continued use of the site.

10. Questions

For questions about this policy, please write to the address above or see our cookie policy and terms of use.

Privacy questions and complaints can be sent by email to [email protected], by telephone to +62 813 6745 2918 from Monday to Friday during office hours, or by post to Zandrel Editorial, Jalan Bunga Raya No. 25, Kebayoran Baru, Jakarta Selatan, DKI Jakarta 12160, Indonesia. We acknowledge every message within five working days, reply to data requests within 14 days, and tell you if more time is needed. Replies are sent in English or, on request, in Bahasa Indonesia. Our hosting provider is Amazon Web Services, Asia Pacific (Jakarta) region, as listed in section 3.