Skip to content
HCN
AI Briefing

Legal

Privacy Policy

Effective 15 October 2026 · Last updated: 15 October 2026

1. Who we are

PT Handeliv Cipta Niaga (“Handeliv”, “we”, “us”), Business Identification Number (NIB) 2504260084155, is a limited liability company (Perseroan Terbatas) established in the Republic of Indonesia, registered at Pakuwon Tower (Tunjungan Plaza 6), Lt. 22 OT 18, Jl. Embong Malang No.21-31, Village/Sub-district Kedungdoro, District Tegalsari, City Surabaya, Province Jawa Timur, Postal code: 60261.

We act as the data controller (pengendali data pribadi) for personal data collected through handeliv.io. For questions about this policy, contact hello@handeliv.io.

2. Scope

This policy covers personal data we collect through this website and through direct business correspondence. Personal data we process on behalf of a client under a services agreement is governed by that agreement, where we generally act as a data processor (prosesor data pribadi) rather than a controller.

3. Legal basis

We process personal data in accordance with Law No. 27 of 2022 on Personal Data Protection (Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi, the “PDP Law”) and its implementing regulations. Depending on the situation, our legal basis is your consent, the performance of a contract or pre-contractual steps at your request, compliance with a legal obligation, or our legitimate interests in operating and securing this website.

4. What we collect

  • Information you give us through a form. Your name, work email address, company name, job title, WhatsApp number (optional), your message, the times you chose, and a record that you agreed to this policy. An AI Briefing registration may also include your industry, headcount and department.
  • Payment data. If you pay for a 1:1 Consultation online, your name and email are sent to Xendit to create the invoice. Your card, bank account or e-wallet details are entered directly on Xendit’s page and are never received or stored by us. We receive only the payment status.
  • Correspondence. Emails and meeting notes arising from your enquiry.
  • Usage data. Vercel Web Analytics records page views and some form steps in aggregate, without cookies and without identifying you.

We do not knowingly collect specific personal data as defined in Article 4 of the PDP Law (such as health, biometric, genetic, criminal record, or financial data) through this website. Please do not include such data in a form on this site.

Do not send credentials, sensitive personal data, customer data, or information under a confidentiality agreement through a public form.

5. How we use personal data

  • To respond to your enquiry and correspond with you about it.
  • To send one automated confirmation email to the address you gave, telling you the message arrived. That email is part of replying to you, not marketing.
  • To prepare proposals, scopes of work and contracts you have asked for.
  • To process payment for a 1:1 Consultation and issue a receipt.
  • To operate, secure and improve this website.
  • To meet legal, tax and accounting obligations in Indonesia.

We do not sell personal data, and we do not use contact-form submissions for unsolicited marketing. Your email address is not added to any subscription list.

6. Sharing and processors

We share personal data only with service providers who help us operate the business, and only to the extent needed for those services. There are currently five processors:

  • Vercel Inc., United States: website hosting and cookieless analytics.
  • Supabase, Singapore region: storing AI Briefing registrations.
  • Xendit, Indonesia: payment for the 1:1 Consultation.
  • Resend, United States: sending the email a form produces and the confirmation email.
  • Hostinger, Lithuania (company), server location as set by the provider: the mailbox where your message arrives and is kept.

These providers are bound by contract to protect the data. We may also disclose data where required by Indonesian law or a lawful order of a competent authority. If you contact us through the WhatsApp link, that conversation is subject to WhatsApp’s privacy policy.

7. Storage, transfer and residency

Some personal data is processed outside the territory of the Republic of Indonesia: in the United States (Vercel and Resend), in Singapore (Supabase), and at Hostinger’s server location. Under Article 56 of Law No. 27 of 2022, we make sure the receiving country or organization provides a level of personal data protection equal to or higher than the PDP Law. Where that is not met, we make sure adequate and binding safeguards are in place. Where neither is met, we ask for your consent. By submitting a form, you have been informed of this transfer.

Where a client engagement requires Indonesian data residency, we agree the storage location, retention period and deletion procedure in writing before the engagement begins.

8. Retention

AI Briefing registrations are stored in our database on Supabase, which only the Handeliv team can read. Other form submissions are sent as email to hello@handeliv.io.

  • Contact form and AI Briefing registration data: 2 years from the last contact, then deleted, unless you ask us to delete it sooner.
  • Correspondence that becomes an engagement: 5 years after that engagement ends, then deleted or anonymised.
  • Transaction and invoice data: 10 years, as required for bookkeeping and tax, then deleted.

We keep data longer only where applicable law requires it.

9. Your rights

Subject to the PDP Law, you have the right to:

  • obtain information about the personal data we hold about you and how we use it;
  • correct or update inaccurate or incomplete personal data;
  • request deletion or destruction of your personal data;
  • withdraw consent you previously gave;
  • object to or request restriction of certain processing;
  • request that your data be provided in an interoperable format; and
  • lodge a complaint with the competent Indonesian authority.

To exercise any of these rights, email hello@handeliv.io. We respond no later than 3x24 hours after receiving your request.

10. Security

We apply technical and organizational measures appropriate to the risk, including access control, encryption in transit, and limiting personal data to the minimum needed. No system is completely secure. If a personal data protection failure occurs, we notify the affected data subjects and the competent authority in writing no later than 3x24 hours. The notice states what personal data was disclosed, when and how it happened, and what we are doing to handle it and recover, in accordance with Article 46 of the PDP Law.

11. Cookies and analytics

This website uses Vercel Web Analytics, which sets no cookies and reports aggregate usage only. We do not use advertising cookies or cross-site tracking. Strictly necessary cookies may be used to operate the site.

12. Children

This website is intended for business users. We do not knowingly collect personal data from children. Where a data subject is a child, processing requires the consent of a parent or guardian in accordance with the PDP Law.

13. Changes to this policy

We may update this policy from time to time. The “last updated” date at the top reflects the most recent version. Material changes will be communicated where appropriate. This policy is effective from 15 October 2026.

14. Contact

PT Handeliv Cipta Niaga
NIB 2504260084155
Pakuwon Tower (Tunjungan Plaza 6), Lt. 22 OT 18, Jl. Embong Malang No.21-31, Village/Sub-district Kedungdoro, District Tegalsari, City Surabaya, Province Jawa Timur, Postal code: 60261
hello@handeliv.io

Chat on WhatsApp (opens in a new tab)