Privacy Policy

01Introduction

CV Adikara Digital Solusindo (“Legia”) processes your personal data when you visit legiatechnology.com, fill in a form, or use Legia's services. This policy is drawn up with reference to Law No. 27 of 2022 on Personal Data Protection.

If there is any difference in interpretation between the Indonesian and English versions of this policy, the Indonesian version prevails.

02Data Legia collects

Legia collects personal data from three sources:

• What you give us directly: full name, email address, phone or WhatsApp number, company name, and the content of messages you send through the contact form. If you apply through the Careers page, this also includes the application files you upload and what they contain, such as your CV and portfolio.
• What is collected automatically: IP address, browser type, device used, and the pages visited.
• From third parties: only if you are referred by a Legia partner or you have published the data yourself, for example in a company profile.

03Basis for processing

Legia processes personal data on the following bases:

• Your consent: filling in the contact form and subscribing to the newsletter.
• Performance of a contract: delivering projects and services in progress.
• Legal obligation: bookkeeping and taxation.
• Legia's legitimate interest: keeping the site secure and preventing abuse.

04Purposes of use

Your personal data is used to:

• Respond to requests and questions you send.
• Assess job applications and run the hiring process for the role you apply for.
• Prepare and send quotes.
• Carry out work agreed in a contract.
• Issue invoices and settle payments.
• Improve the reliability and security of the Legia site.

05Data sharing

Legia prohibits any selling, trading, or renting of personal data to unaffiliated parties or companies.

Data may be shared with:

• Service providers that support Legia's operations, including business email, hosting and cloud infrastructure, and backup services. Each receives only the data it needs and is bound by confidentiality obligations.
• Competent authorities, when required by law.

These service providers may only process data for the purposes Legia specifies.

06Transfers outside Indonesia

Some service providers Legia uses, such as business email, cloud infrastructure, and the Cal.com consultation scheduler, may process data on servers outside Indonesia. If you book a session through the Schedule a Consultation page, your name, email address, phone number, and any other details you enter are processed by Cal.com and then enter Legia's calendar. For such transfers, Legia ensures that the destination country offers an equal or higher level of personal data protection, or agrees a data protection agreement with the provider, as required by Law No. 27 of 2022.

07Retention period

Legia retains personal data for as long as it is needed for the purpose it was collected.

Data from contact forms that do not lead to a project is kept for at most 12 months from the last contact. Active client data is kept for the duration of the engagement and for at most 5 years afterwards, in line with document and bookkeeping retention obligations. Data of job applicants who are not hired is kept for at most 12 months. After the retention period ends, data is deleted or anonymized.

08Your rights

Under Law No. 27 of 2022, you have the right to:

• Access and obtain a copy of your personal data.
• Correct data that is wrong or inaccurate.
• Delete your personal data.
• Withdraw consent you have given.
• End or restrict the processing of your personal data.
• Object to decisions made entirely by automated means.
• Claim compensation for a breach in the processing of your personal data.

Requests can be sent to privasi@legiatechnology.com. Legia responds within 14 business days of receiving the request and verifying the requester's identity.

09Data security

Legia secures personal data through encryption in transit, internal access limited to personnel who need it, and regular backups.

Other safeguards in place: the site connection uses HTTPS, access to internal systems uses two-factor authentication, access rights are reviewed regularly and revoked immediately when personnel change roles or leave, and security updates to servers and applications are applied regularly.

No system is completely immune. Legia cannot guarantee absolute security, but is committed to applying measures that are reasonable and proportionate to the risk.

10Data protection failure notification

If a personal data protection failure occurs, Legia notifies the data subjects and the competent authority within the deadline set by Law No. 27 of 2022.

In accordance with Article 46 of Law No. 27 of 2022, notification is given no later than 3x24 hours after the failure is discovered, to both the data subjects and the personal data protection agency.

The notification states which personal data was exposed, when and how it happened, and the handling and recovery steps Legia has taken.

11Cookies

The Legia site uses Google Analytics 4 analytics cookies, and those cookies are only set after you agree through the consent banner. There is also local storage in your browser to remember your light or dark display choice and your consent choice, and that data is not sent to Legia. A full explanation is on the Cookie Policy page.

12Third-party links

The Legia site may contain links to third-party sites. Legia is not responsible for the privacy practices or content of those sites.

13Children's data

Legia's services are intended for businesses and not for children. Legia does not knowingly collect children's personal data.

Following Law No. 27 of 2022, a child is a person under 18 years of age. Processing a child's personal data may only be done with the consent of a parent or guardian.

If Legia learns it has received a child's personal data without that consent, the data is deleted. Parents or guardians can contact Legia to request deletion.

14Changes to this policy

Legia may update this policy from time to time. Every change is announced on this page together with an updated effective date and version number.

15Contact us

Questions and requests about personal data can be sent to privasi@legiatechnology.com.

CV Adikara Digital Solusindo, Jalan Jembawan IV Blok 3C No. 3, Keduyo, Mangliawan, Malang Regency, East Java 65154, Indonesia.