1. About this Policy
This Privacy Policy explains how PT MentariNova International Commerce (“Company”, “we”, “us” or “our”) collects, uses, stores, discloses, transfers, deletes and otherwise processes personal data in connection with Website.
This Policy is intended to meet the transparency, purpose limitation, accountability and data subject rights requirements under Indonesian personal data protection laws, including Law No. 27 of 2022 on Personal Data Protection (“PDP Law”).
If there is any conflict between this Policy and mandatory Indonesian law, the mandatory Indonesian law will prevail. If we provide a local-language version, the Bahasa Indonesia version may be used for interpretation for Indonesia-facing processing unless applicable law requires otherwise.
2. Who is responsible for your personal data
PT MentariNova International Commerce acts as the Personal Data Controller for personal data processed for the purposes described in this Policy, unless we expressly state that another party is the controller. Our contact details are listed above.
Where we process personal data on behalf of a business customer, we may act as a Personal Data Processor and will process such data under the customer’s documented instructions and applicable law.
3. Personal data we collect
Depending on how you use the Service, we may process the following categories of personal data:
Identity and profile data: name, company, job title.
Contact data: email address, telephone number, postal address and communication preferences.
Account and authentication data: login credentials, device identifiers, access logs.
Technical and usage data: IP address, cookies, device information, browser type, operating system, pages viewed, interaction logs and analytics events.
Communications data: messages, requests, complaints, feedback, survey responses and call or chat records.
Any other personal data that you choose to provide or that is necessary for the purposes described in this Policy.
4. How we collect personal data
Directly from you when you register, use the Service, complete forms, contact us, participate in promotions or otherwise interact with us.
Automatically through cookies, logs, SDKs, analytics tools and similar technologies when you use our website.
From third parties, such as payment providers, identity-verification providers, business partners, public sources, social login providers and service providers, where permitted by law.
5. Purposes and lawful bases of processing
We process personal data only for specific, explicit and lawful purposes. Depending on the context, our lawful bases may include consent, performance of a contract, compliance with legal obligations, vital interests, public interest or official authority where applicable, and legitimate interests balanced against your rights.
To communicate with you about the Service, security, updates, policy changes and administrative matters.
To personalise content, remember preferences and improve user experience.
To conduct analytics, product development, troubleshooting, testing, research and service improvement.
To prevent, detect and respond to fraud, abuse, security incidents, illegal activity and violations of our terms.
To comply with legal, regulatory, tax, accounting, law-enforcement and dispute-resolution obligations.
To send marketing communications where we have a valid legal basis and you have not opted out.
To conduct automated processing or profiling only where lawful, proportionate, transparent and subject to applicable safeguards.
6. Consent
Where we rely on consent, we will request consent in a clear and explicit manner before processing personal data for the disclosed purposes. Consent may be provided electronically or in other lawful forms.
You may withdraw consent at any time by contacting us or using the available privacy settings. Withdrawal of consent does not affect processing that occurred before withdrawal and may affect our ability to provide certain features of the Service.
7. Children’s personal data
We do not knowingly collect children’s personal data without valid consent from a parent or legal guardian where required by Indonesian law. If you believe a child has provided personal data to us without appropriate consent, please contact us so that we can take appropriate action.
8. Cookies and similar technologies
We may use cookies, pixels, SDKs, local storage and similar technologies to operate the Service, secure accounts, remember preferences, measure performance and deliver or measure marketing. You may manage cookies through your browser, device settings or our cookie controls where available. Disabling certain cookies may affect Service functionality.
9. Sharing and disclosure of personal data
We may disclose personal data only where lawful and necessary for the purposes described in this Policy, including to:
Vendors and processors, including hosting, cloud, analytics, customer support, payment, security, communications, verification and IT providers.
Business partners, merchants or integrators where needed to provide requested features.
Professional advisers, auditors, insurers, banks and other business support providers.
Government authorities, regulators, courts, law-enforcement agencies or other parties where required or permitted by law.
Parties involved in mergers, acquisitions, financing, restructuring, asset sales or similar corporate transactions, subject to confidentiality and legal safeguards.
10. International transfers
Personal data may be stored or processed outside Indonesia where our affiliates, vendors or service providers are located. Where we transfer personal data outside Indonesia, we will apply the conditions required by Indonesian law, which may include assessing whether the recipient country provides an adequate or higher level of protection, implementing adequate and binding safeguards, or obtaining your consent where required.
11. Security measures
We implement organisational and technical measures designed to protect personal data against unauthorised access, disclosure, alteration, misuse, destruction and loss. Measures may include access controls, encryption or pseudonymisation where appropriate, secure development practices, logging, monitoring, staff training, vendor due diligence and incident-response procedures.
No electronic system is completely secure. You are responsible for keeping your account credentials confidential and notifying us promptly of suspected unauthorised use.
12. Retention, deletion and destruction
We retain personal data only for as long as necessary for the purposes for which it was collected, to comply with legal, regulatory, tax, accounting or reporting obligations, to resolve disputes, and to enforce agreements. When the retention period expires or when deletion/destruction is required, we will delete, anonymise or securely destroy personal data unless retention is required or permitted by law.
13. Your rights
Subject to applicable conditions and exceptions under Indonesian law, you may have the following rights:
Right to obtain information about clarity of identity, legal basis, purposes and accountability of parties requesting personal data.
Right of access to your personal data and processing information.
Right to complete, update and/or correct inaccurate or incomplete personal data.
Right to terminate processing, delete and/or destroy personal data in accordance with law.
Right to withdraw consent previously given to us.
Right to object to decisions based solely on automated processing, including profiling, that have legal consequences or significant impact on you.
Right to delay or restrict processing proportionately to the processing purpose.
Right to obtain and transfer your personal data to another controller where technically feasible and lawful.
Right to submit complaints and claim compensation for violations in accordance with applicable law.
14. How to exercise your rights
You may exercise your rights by contacting welcom@mentarinovainternationalcommerce.com. We may need to verify your identity and request additional information to process your request. We will respond within the timeframe required by applicable law. We may refuse, postpone or limit a request where permitted by law, for example where disclosure would affect another person’s rights, where retention is legally required, or where the request is manifestly unfounded or excessive.
15. Personal data breach
If a personal data protection failure occurs, we will take appropriate steps to contain, investigate and remediate the incident. Where required by Indonesian law, we will provide written notification to affected Personal Data Subjects and the competent authority within the legally required timeframe, including information about the affected personal data, when and how the failure occurred, and our handling and recovery efforts.
16. Automated decision-making and profiling
We may use automated tools to support security, fraud prevention, personalisation, analytics or eligibility assessments. We will not make decisions based solely on automated processing, including profiling, that produce legal consequences or significant impact on you unless permitted by law and subject to appropriate safeguards and rights to object or request review.
17. Third-party links and services
The Service may contain links to third-party websites, applications or services. We are not responsible for the privacy practices of third parties. Please review their privacy notices before providing personal data to them.
18. Changes to this Policy
We may update this Policy from time to time. The updated version will be posted on our website or application with a new effective date. Where required by law, we will notify you and/or request renewed consent.
19. Contact us
For questions, requests, complaints or withdrawal of consent, please contact: welcom@mentarinovainternationalcommerce.com. Postal address: Jl. Danau Tamblingan No. 40 Sanur, Sanur Village/Sub-district, South Denpasar District, Denpasar City, Bali Province, Postal Code: 80228.
