Privacy Policy.

This website, fromdxp.com (the “Site”), is operated by PT DXP Global Inovasi (“DXP”, “we”, “us”, or “our”), a company incorporated in the Republic of Indonesia with its registered address at Jl. Tarumajaya Raya, Sagara Makmur, Kec. Tarumajaya, Kabupaten Bekasi, Jawa Barat 17211, Indonesia.

For the purposes of Indonesian Law No. 27 of 2022 on Personal Data Protection (“UU PDP”) and its implementing regulations, DXP acts as the personal data controller for the personal data described in this policy: we determine the purposes and means of processing that data, and we take responsibility for it.

You can reach us about anything in this policy at hello@fromdxp.com.

This policy explains how we collect, use, store, disclose, and protect personal data when you visit the Site or contact us by email. “Personal data” means any data about an individual who is identified or identifiable, on its own or combined with other information, as defined in the UU PDP.

Products built by DXP, such as BARA AI, are separate services. Where a product processes personal data, it is governed by its own privacy policy, which will be made available within that product. This policy covers the Site only.

We deliberately keep the Site simple. It has no user accounts, no sign-up forms, and no analytics trackers. The personal data we handle is limited to the following.

3.1 Data you give us directly

When you email us at hello@fromdxp.com, we receive your email address, your name if your email account shares it, and whatever information you choose to include in your message — for example your organization, role, or the subject of a partnership or press inquiry.

3.2 Data collected automatically

Like almost every website, our hosting infrastructure automatically records basic technical logs when you visit: your IP address, browser type and version, device and operating system information, the pages you request, and the date and time of each request. These logs exist to keep the Site available and secure, and are not used to profile or identify individual visitors.

3.3 Specific (sensitive) personal data

We do not request or intentionally collect specific personal data as defined by the UU PDP — such as health data, biometric data, genetic data, criminal records, children’s data, or personal financial data. Please do not send us such data by email. If we receive specific personal data we did not request, we will delete it unless the law requires us to keep it.

The UU PDP requires every act of processing to rest on a legal basis. The table below sets out each purpose for which we process personal data and the basis we rely on.

Where any future processing relies on your consent, we will ask for it explicitly, in clear and plain language, for stated purposes — and you may withdraw it at any time, as easily as you gave it, without affecting the lawfulness of processing carried out before withdrawal.

We do not use personal data for automated decision-making that produces legal effects for you, and we do not sell personal data to anyone.

The Site currently sets no analytics, advertising, or marketing cookies. Any storage used is limited to what is strictly necessary for the Site to function technically.

If we ever introduce non-essential cookies or similar technologies, we will update this policy first and ask for your consent before they are placed on your device.

We share personal data only in the following situations:

• Service providers (personal data processors). We use third-party providers for website hosting and email. They process personal data only on our documented instructions, for the purposes described in this policy, and under agreements that require them to protect it in line with the UU PDP.
• Legal requirements. We may disclose personal data where required by Indonesian law, a court order, or a lawful and binding request from an authorized government institution.
• Corporate transactions. If DXP is involved in a merger, acquisition, restructuring, or sale of assets, personal data may be transferred as part of that transaction. We will ensure the receiving party remains bound by obligations consistent with this policy, and we will notify you as required by law.

Our service providers may store or process data on servers located outside the Republic of Indonesia. Where personal data is transferred outside Indonesia, we do so only in accordance with the UU PDP, which means at least one of the following applies:

• the country receiving the data provides a level of personal data protection equal to or higher than that of the UU PDP;
• adequate and legally binding safeguards for personal data protection are in place with the recipient; or
• you have given your consent to the transfer.

We keep personal data only for as long as it is needed for the purposes described in this policy, or for as long as laws and regulations require us to keep it. As a rule:

• Email correspondence is kept for as long as needed to handle the matter you contacted us about and any follow-up, after which it is deleted in the ordinary course of mailbox management.
• Technical logs are kept for short, rolling periods determined by our hosting providers for security and operational purposes.

When the retention period ends, or when personal data is no longer necessary for its purpose, we delete or destroy it — or irreversibly anonymize it so it no longer identifies anyone — in accordance with the UU PDP.

We apply technical and organizational measures appropriate to the nature and risks of the personal data we process, to protect it against unauthorized access, disclosure, alteration, loss, and destruction. These measures include encrypted connections to the Site (HTTPS), access controls limiting who at DXP can read correspondence, and the use of reputable infrastructure providers with their own certified security programs.

No method of transmission or storage is perfectly secure, but we review our measures as the Site and our processing evolve.

If a failure of personal data protection occurs that affects your personal data, we will provide written notification no later than 3 × 24 hours to you and to the personal data protection authority, as required by the UU PDP. The notification will describe the personal data involved, when and how the breach occurred, and how we are handling and recovering from it. Where the breach may disrupt public services or seriously impact the public interest, we will also notify the public as the law requires.

As a personal data subject under the UU PDP, you have the right to:

• Be informed — obtain clear information about the identity of the controller, the legal basis, the purposes of processing, and the accountability of the parties handling your data;
• Access — access your personal data and obtain a copy of it;
• Rectify — complete, update, or correct inaccurate personal data about you;
• Delete — request the deletion or destruction of your personal data, subject to conditions in the law;
• Withdraw consent — withdraw any consent you have given for processing, at any time;
• Object to automated decisions — object to processing carried out solely by automated means, including profiling, that produces legal or otherwise significant effects for you;
• Restrict — postpone or restrict the processing of your personal data, proportionate to the purpose of processing;
• Data portability — obtain and reuse your personal data, and have it transmitted to another controller, where technically feasible;
• Complain and claim compensation — lodge a complaint and sue for compensation for violations of the UU PDP concerning your personal data.

Some of these rights are subject to exceptions set out in the UU PDP — for example, in the interests of national defense and security, law enforcement, or state administration.

To exercise any of these rights, email us at hello@fromdxp.com with the subject line “Data subject request”. We may need to verify your identity before acting on a request, and we will respond within the timeframes required by the UU PDP and its implementing regulations. You also have the right to submit a complaint to the Indonesian personal data protection authority.

The Site is not directed at children, and we do not knowingly collect children’s personal data. Under the UU PDP, processing a child’s personal data requires the consent of the child’s parent or guardian. If you believe a child has provided us personal data without such consent, contact us at hello@fromdxp.com and we will delete it.

The Site may link to websites operated by others, including the products we build. We are not responsible for the privacy practices of those websites. When you leave the Site, we encourage you to read the privacy policy of every site you visit.

We may update this policy from time to time — for example, when the Site gains new features or when regulations change. The current version will always be published on this page with its effective date. If a change materially affects how we process your personal data, we will take reasonable steps to bring it to your attention, and where the law requires consent for the changed processing, we will ask for it.

Questions, requests, or complaints about this policy or about how we handle personal data can be sent to:

PT DXP Global Inovasi
Jl. Tarumajaya Raya, Sagara Makmur, Kec. Tarumajaya, Kabupaten Bekasi, Jawa Barat 17211, Indonesia
Email: hello@fromdxp.com