1. Object

This Privacy Policy aims to provide information to individuals visiting our website (hereinafter referred to as "Users" or "Data Subjects") regarding how PT Indo Magnovent Ventilation (hereinafter referred to as "the Company") collects, uses, processes, stores, and protects personal data provided through any medium, including but not limited to website forms, email communications, telephone calls, contractual agreements, or other methods of interaction.

By reading this Privacy Policy, Users can consider giving their free and informed consent for any processing of personal data carried out by the Company in accordance with applicable provisions. This policy also serves as a supplement to any notice or provision of information related to personal data processing that has been given to Data Subjects at the time of data collection.

This policy is established to ensure compliance with applicable legal provisions in Indonesia regarding personal data protection, particularly:

• Law of the Republic of Indonesia Number 27 of 2022 concerning Personal Data Protection (PDP Law)
• Implementing regulations and other relevant laws and regulations related to the management and protection of personal data within the legal jurisdiction of Indonesia.

The Company is committed to complying with the principles of personal data protection as regulated in the PDP Law, including the principles of lawfulness, clear purpose, transparency, processing limitation, accuracy, security, accountability, and storage limitation.

2. Who is responsible for the processing of your personal data?

3. What personal data will we process and how do we obtain it?

For the development of our business activity, it is essential to process personal data whose Collection can be carried out by digital means (e.g. email, forms or web questionnaires), by completing paper documents (e.g. contracts or forms) or through conversations in person or by telephone and in any of these cases the data will be treated in a loyal, lawful and transparent.

The categories of data that our entity will process about the interested parties are:

• Identification data: name and surname, DNI or equivalent document, image and signature (handwritten or digital).
• Contact information: telephone, email, postal address.
• Commercial data: budgets, purchasing conditions, management and history of services and/or purchases, result of contacts (phone, email, messaging and other communication channels).
• Access data: username and password (e.g. online store).
• Accounting data: control of income and expenses, billing data.
• Bank details: bank accounts and cards.
• Transaction of goods and services: bank transfers and direct debits, amounts and concepts.
• Navigation data: analysis of the time spent on our website, pages visited, data demographics (e.g. age, sex, language).

Our entity will not collect special category data (e.g. health data, ethnic origin, political opinions or religious beliefs), but if it is necessary to treat them, it will inform you and request your consent prior and express.

Consequently, the data requested will be adequate, relevant, limited to those strictly essential and necessary, treated only by personnel and/or collaborators authorized by our entity, who will have signed a confidentiality commitment and agree to comply with the regulations necessary security measures to guarantee the confidentiality, integrity and availability of the data processed and other requirements legally established in the RGPD. Therefore, they will be treated within the law.

The data to be processed are provided by the interested party themselves or by their legal representative, although it may be the case in which we delegate some functions to certain collaborators and they are in charge of collect your data, but they will always be processed with your prior and express consent.

In the event that an interested party does not provide the data we request or incomplete data is provided or incorrect, it will not be possible to comply with and maintain the relationship with them.

The categories of data that we can process about a person will depend on the relationship they maintain. with our entity, as shown below:

4. What will your data be processed for?

Data processing is carried out to fulfill and maintain relationships with data subjects, according to their categories:

The purpose of processing will not be expanded without new notification or consent.

5. Legal Basis for Processing

The processing of personal data is carried out on the following legal grounds:
A. Explicit consent from the data subject
B. Performance of a contract or steps prior to entering into a contract
C. Compliance with legal obligations
D. Legitimate interests pursued by the data controller, while respecting the rights and freedoms of the data subject

For data subjects under the age of 14, parental or guardian consent is required.

6. Data Retention Period

We retain personal data for as long as the relationship remains active and as necessary to fulfill the purposes of processing and comply with legal obligations. Once these purposes are achieved, the data will be restricted and retained only for potential legal proceedings within the mandatory sectoral retention periods.

7. Profiling

We do not perform profiling or automated decision-making. Should such processing be implemented in the future, we will notify you in advance and request your consent. You have the right to object to such processing at any time.

8. Data Transfers

We do not share personal data with third parties without consent, except in the following cases:

• Official authorities and government institutions when legally required
• Financial institutions for payment processing
• Service providers contracted by us who are bound by data processing agreements
  

Data of job applicants and website users will not be transferred unless required by law.

9. Security Measures

We apply the necessary technical and organizational measures to ensure the confidentiality, integrity, and availability of personal data. Compliance is regularly monitored through internal controls and external audits.

10. Data Subject Rights

You may submit requests to exercise the following rights:

• Access to your personal data
• Rectification of inaccurate data
• Erasure of data
• Restriction of processing
• Data portability
• Objection to processing
• Not to be subject to automated decision-making
  

Requests may be sent to:
Postal Address: Jalan Sunset Road 168A, Legian, Kuta, Bali – Indonesia
Email: info@magnovent.id

Please attach proof of identity and contact information.

11. Commitment to Data Protection

All employees and third parties acting on our behalf are required to comply with this policy. We uphold GDPR principles, including:

• Lawful and transparent processing
• Data minimization
• Storage limitation
• Confidentiality and security of data
• Risk management through impact assessments when necessary

12. Policy Updates

This policy may be updated without prior notice. Users are encouraged to review it periodically when accessing our website.