Privacy Policy

Dicky Ibrohim, an independent engineering partner based in Demak, Jawa Tengah, Indonesia ("I"), is the controller for personal-data processing whose purposes and means I determine. My role when processing data in a client system is explained under the scope below. For anything related to this policy, contact hello@dickyibrohim.com.

This policy applies to three contexts:

• The website www.dickyibrohim.com, including its contact form.
• Client services, including builds, cleanup, support, and registration assistance. I control my own enquiries, billing, and professional records. For users’ data in a client system, the client generally controls the purposes and I process only under documented instructions. Actual decisions determine the role; a contract label does not remove my own duties. The offer or official messages may record purpose, data categories, duration, permitted access, providers, and return/deletion arrangements without a separate form for every project.
• Demos and third-party integrations I operate, such as demo-store.dickyibrohim.com and the messaging or login integrations connected to it, described in their own section below. They are separate from this website.

Contact form

Name, email address, your preferred reply channel (WhatsApp or Telegram) with the number or username, the topic you choose, your message, the address of your current website if you add it, and the language you used. The form also carries a hidden anti-bot field and the time you spent filling it in; these are checked and not stored.

Correspondence

The content of email, WhatsApp, or Telegram conversations with me, used to answer you and to deliver what you ask for.

Client identity and billing data

Client/PIC name and contact, business identity/address, and billing details needed for the engagement. NIK, NPWP, identity documents, or registration evidence are requested only where relevant law, tax treatment, a registrar, or an expressly authorised account-registration process requires them. Do not send identity documents through the public contact form; where possible submit them directly to the provider. An electronic-signature provider may process signatory data if that service is agreed.

Access and accounts

Credentials to your existing accounts that you share with me (hosting, domain, control panel, admin), or to accounts I create on your behalf when direct access is not possible (for example Cloudflare, Google, a hosting provider, or a domain registrar), and credentials I create during the work. During a malware cleanup or repair I also take copies of files and databases before changes, as evidence and a restore point; those copies may contain personal data of your website's users, which I process only on your instructions and only for that work.

Client materials for content

Text, product or service details, photos, logos, and other materials you provide to be turned into or optimised as website content, including with the help of AI tools as described in the Terms of Service.

Technical data

Cloudflare processes IP addresses and request data for hosting and security. The contact-form service derives a shortened IP hash for submission limits with windows up to one day. A hash is not necessarily anonymous data. Expired rate-limit records are cleaned periodically as form requests are processed; expiry of a limit is distinct from physical deletion. The form service does not maintain its own general visitor log.

Optional statistics

Aggregated visit and performance statistics through Cloudflare Web Analytics, only after you allow them in the privacy choice.

Your preferences

Your theme choice, stored in your browser, and your privacy choice, stored in a first-party cookie.

• To answer your enquiry and deliver the service you request, through the channel you chose: performance of a contract, or steps taken at your request.
• To issue offers, invoices, and receipts and to keep tax and accounting records: performance of a contract and a legal obligation.
• To register domains and to create or manage accounts with third-party services on your behalf for the features and integrations your website needs, including passing on the registration data those providers require: performance of a contract and your instructions.
• To perform agreed client work, including limited access, repair, and warranty follow-up: the applicable contract or documented controller instructions. AI assistance does not give blanket permission to upload client data; necessary provider use, minimisation, and authorisation follow the Terms of Service. A client’s approval does not replace a lawful basis for processing another person’s data.
• To keep this website secure: a hidden anti-bot field, a check on how long the form took to fill in, and submission limits based on a hashed IP address: legitimate interest.
• Optional visit and performance statistics: your consent, which you can withdraw through the privacy choice.
• To retain necessary evidence of agreed work, payments, and a concrete dispute: legal obligations or a documented legitimate-interest assessment balancing the affected person’s rights. Public project portfolio use follows the specific permission accepted in the offer; that permission is not blanket consent to publish individuals’ personal data.
• To comply with legal obligations under Law No. 27 of 2022 on Personal Data Protection (UU PDP) and, where it applies, the GDPR.

I do not sell personal data. Data is shared only with processors and providers needed to run the service:

• Cloudflare, Inc.: hosting, storage of contact form submissions, security, and, after your consent, aggregated statistics.
• Google LLC: contact form submissions are sent as email through the Gmail API to my mailbox, and email correspondence is stored in that mailbox.
• WhatsApp (Meta Platforms) or Telegram: if you choose one of these as your reply channel, our conversation runs through that app under its own privacy policy.
• AI providers and any additional processors: before necessary personal or confidential data is sent, the relevant provider, purpose, data categories, processing safeguards, and client/controller authorisation are recorded in the offer or official correspondence. I minimise or redact input and assess retention and model-training settings. No blanket assurance that every provider stores data in one country or never trains on it is made; the selected service and settings must support the agreed use.
• Service providers for a client's website or system, on the client's instructions: the set varies by project according to the features and integrations needed, for example domain registrars (registration data may be published in WHOIS according to registry rules, such as PANDI for .id domains, with privacy protection where the registrar offers it), hosting and server providers, Cloudflare, Google or another business email provider, email marketing platforms for sending promotional email on the client's behalf, email verification services, payments, maps, analytics, and other supporting services. Client data such as name, email address, phone number, and business address is used to register and configure accounts with those services in the client's name, and is processed by each provider under its own terms. The providers used for your project are listed in the offer or the handover document.
• PrivyID (PT Privy Identitas Digital): electronic signatures and e-stamps (e-meterai) on offers, contracts, or other documents when needed; PrivyID processes the signer's identity data under its own privacy policy.
• Professional support, a substitute contact, or subcontractors only where needed for the authorised service, legal advice, or continuity, with confidentiality and limited access. If they are additional processors for client data, the controller’s required written authorisation is obtained before access. Provider terms do not release either party from its own statutory duties.
• Authorities, when required by law.

• Contact enquiries and ordinary correspondence: up to 24 months after the last contact, unless a valid earlier deletion request applies. Only necessary contractual or dispute evidence may be retained longer under the separate grounds below; the whole mailbox is not automatically a legal archive.
• Rate-limit IP hashes: used for windows up to one day, with expired records subject to periodic cleanup during form processing as described above. They are not used for advertising or cross-site profiling. Necessary records are included in applicable access or deletion handling.
• Necessary offers, approvals, invoices, receipts, and tax records: the statutory period applicable to the record. A concrete legal claim may justify retaining specific evidence until that need ends, with restricted access and periodic review. Accounting needs do not justify retaining an entire client database or passwords.
• Client file/database copies and supplied working materials: during the agreed work, warranty, or support that needs them; then return or deletion within 30 calendar days, unless a shorter lawful deadline applies or a specific longer retention has a documented lawful basis. A client’s silence does not authorise indefinite retention. Unnecessary identity-document copies are deleted after the registration/verification purpose ends, subject to any specific legal retention duty.
• Credentials and access: use ends when the authorised need ends. I remove access and copies under my control; you revoke invitations, tokens, or shared passwords that only the account owner can change, and we coordinate closure. A compromised password may be rotated during a warranty with safe replacement access. A billing dispute does not extend permission to access data.
• Backups and providers: deletion handling includes available local copies and requests to relevant providers within my control or contractual authority. Any backup cycle, lawful retention exception, or provider limitation affecting completion is explained for the request; backups are not reused for another purpose. Privacy-choice cookie: 180 days. Aggregate analytics follow the applicable Cloudflare service retention.

You may exercise access, correction, deletion, withdrawal, restriction, objection, and portability rights to the extent provided by applicable law. Email hello@dickyibrohim.com or use the official channel through which you supplied the data. State the data or service concerned; identity checks use only what is proportionate. You do not need to buy support or use a fixed subject line to exercise a right.

Requests are handled within the deadline for the relevant right. UU PDP requires action within 3 × 24 hours from receipt for certain requests, including correction, access, withdrawal-related cessation, and restriction, subject to applicable legal conditions. Business days, my availability, an automated acknowledgement, or a contractual support schedule do not extend a statutory deadline. A general 30-day completion period does not override a shorter legal requirement.

If some data must lawfully be retained, another controller must decide, or a request is lawfully refused, I explain the relevant reason, scope, and next step; unaffected portions are still handled. Requests concerning a client-controlled website are coordinated with that client without removing my own obligations. Deletion guidance is at https://www.dickyibrohim.com/data-deletion/. You may complain to a competent authority or pursue available legal remedies.

Safeguards are proportionate to the data and actual service: encrypted transport, limited access, two-step verification where available, and an encrypted password manager for credentials. Prefer a separate limited account or secure sharing link; never submit passwords or identity documents through the public form. Provider security features and service limits vary; this is not a promise that every device, backup, or third-party system is immune to compromise.

Each party remains responsible for its own handling of access and data. On an incident, I take reasonable containment measures, preserve necessary evidence, and promptly coordinate with the relevant controller. Where I am the controller, mandatory notifications follow applicable law, including UU PDP’s written notice requirement of no later than 3 × 24 hours to affected data subjects and the competent institution in the event of a personal-data protection failure. Notices contain the required information and are updated as appropriate; I do not wait for a routine support window or final forensic report to meet a legal deadline.

Necessary storage supports your theme choice (kept in your browser) and your privacy choice. The first-party di_privacy cookie remembers that choice for 180 days; it holds the choice and a timestamp, not an advertising identifier. Cloudflare may set security cookies it needs to protect the website.

Optional visit and performance statistics use Cloudflare Web Analytics, without advertising cookies. Statistics stay off until you allow them. Global Privacy Control and Do Not Track signals from your browser keep optional statistics off. You can withdraw consent through the privacy choice in the footer; turning off statistics that were on reloads the page. No advertising trackers are installed.

This website and my services are not directed at children under 18. I do not knowingly collect their data; if you believe a child has provided data, contact me and it will be deleted.

Cloudflare, Google, messaging providers, AI services, and other authorised providers may process data outside Indonesia. For a transfer that I control, I assess equivalent or higher destination-country protection; if unavailable, adequate binding safeguards; if neither is met, the data subject’s consent as required by UU PDP. Provider terms alone do not automatically establish compliance. Relevant provider/location and safeguards are recorded for the service, and required controller authorisation is obtained before a client-data transfer. If a lawful transfer basis cannot be established, the affected transfer does not proceed.

Websites I build can connect to third-party services according to the client's needs, such as messaging, sign-in, payments, maps, analytics, or email. Each service processes data under its own privacy policy, and the privacy policy of the client's website describes the integrations that website uses. This section applies when you use a demo I operate, such as demo-store.dickyibrohim.com, or interact with an integration I operate.

• Demos are intended for synthetic test data and may be reset. Do not enter real personal or confidential data. If real personal data is entered, calling it test data does not remove its legal protection; applicable access, security, and deletion duties still apply.
• Messaging: when you trigger a transactional message (a verification code, an order or shipping update), your number, the template sent, and the delivery status are processed by the messaging provider, for example Meta Platforms, Inc. for WhatsApp. Marketing messages go only to people who opted in and can be stopped by replying STOP.
• Sign-in: where a demo or client website offers Facebook Login or a similar sign-in, the app-scoped user identifier, public profile name, profile photo, and email address permitted by the provider are received. You can end the connection at any time by removing the app in your account settings.
• Retention: messaging logs (delivery status, one-time passcode records) up to 90 days, then deleted or anonymised; sign-in data until you remove the app or request deletion; demo data until the demo is reset.
• Security: webhooks from integration providers are verified with signed payloads before processing. A client website explains its own cookies and integrations separately.

The effective date is updated when this policy changes. Material changes to purposes, data categories, or recipients are explained before the affected new processing begins, and new consent or authorisation is obtained where required. Continued use alone does not supply every required consent. Service-contract changes follow the Terms of Service at https://www.dickyibrohim.com/terms/; this policy does not retrospectively authorise a different use of data.