Privacy Policy
Last updated:
This policy explains what personal data PT MAHKOTA GLOBAL ASIA processes when you visit this website or write to us, why we do it, and what rights you have.
Who is responsible for your data
The controller of your personal data is PT MAHKOTA GLOBAL ASIA, a limited liability company (Perseroan Terbatas) incorporated in Indonesia.
- Company name
- PT MAHKOTA GLOBAL ASIA
- Legal form
- Perseroan Terbatas (limited liability company)
- Incorporation decree
- AHU-0054324.AH.01.01.TAHUN 2026
- Decree date
- 10 July 2026
- Issued by
- Minister of Law of the Republic of Indonesia
- Business Identification Number (NIB)
- 1208260073107
- Registered address
- Jl. Raya Campuhan, Desa/Kelurahan Sayan, Kec. Ubud, Kab. Gianyar, Provinsi Bali, Kode Pos: 80571
- Country of registration
- Indonesia
For any question about personal data, write to:
What data we process
- Enquiry data: your name, your email address, your company name (optional) and the text of your message, when you use the contact form or write to us by email.
- Technical data: the IP address, the date and time of the request, the page requested and the type of browser and device. Cloudflare, through whose network the website is delivered, and our server in Germany receive this data whenever a page is opened. Our server keeps no access logs; its application and system logs may contain this data and are deleted after 14 days. Cloudflare keeps its own logs under its own policies.
- Security check data: the home page, which contains the contact form, runs the Cloudflare Turnstile check that tells people from automated programs. For this check Cloudflare receives your IP address and information about your browser and device (such as the browser identification string and the parameters of the encrypted connection) together with the address of this website. We receive only the result of the check.
- Rate limit: to limit how many messages can be sent from one address, our server keeps the IP address and the time of each message in its working memory until 10 minutes after the last message from that address (or until the server restarts, if sooner). It is not written to disk and is not included in the email.
- Your cookie choice: one record in your browser's storage. It stays on your device and is not sent to us. The Cookie Policy describes it.
We do not use analytics, advertising or tracking tools, and we do not obtain data about you from other sources. We do not ask for sensitive data such as health or financial details; please do not include it in your message.
Why we process it and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Answering your enquiry and corresponding with you about a possible project | Enquiry data | Steps taken at your request before entering into a contract (GDPR Art. 6(1)(b)); our legitimate interest in answering messages addressed to us (GDPR Art. 6(1)(f)) |
| Delivering your message from the form to our mailbox by email | Enquiry data, the language and page of the form, the time it was sent | As for answering your enquiry (GDPR Art. 6(1)(b) and (f)) |
| Protecting the contact form from spam and automated abuse | Security check data, rate limit data | Our legitimate interest in receiving genuine enquiries and keeping the form usable (GDPR Art. 6(1)(f)) |
| Keeping the website working and secure | Technical data | Our legitimate interest in a secure, working website (GDPR Art. 6(1)(f)) |
| Remembering your cookie choice | Cookie choice record | Storage that is strictly necessary to respect the choice you made |
| Meeting legal obligations, for example keeping records if a contract follows | Enquiry data, where relevant | Legal obligation (GDPR Art. 6(1)(c)) |
Scroll the table sideways to see all columns.
Under Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP), the same processing rests on the corresponding bases in that law: fulfilling your request before a contract is made, our legitimate interest, and our legal obligations.
We would ask for your consent before using any optional storage or tools. There are none on this website today.
Who receives your data
We do not sell personal data and we do not pass it on for advertising. It may be received by:
- Cloudflare, Inc. (United States): delivers this website through its network and protects it (technical data), and runs the Turnstile security check on the contact form (security check data). Cloudflare states that it processes Turnstile data on the website operator's behalf and, in addition, as an independent controller to improve its bot detection;
- Google LLC (United States): our outgoing email account (Gmail) sends the message from the form to our mailbox. Google receives the enquiry data contained in the email and keeps a copy in the account's sent mail;
- Proton AG (Switzerland): hosts the mailboxes on the mahkotaglobalasia.com domain, where your message arrives and where we correspond with you;
- HOSTKEY B.V. (the Netherlands): provides the virtual server in Germany on which this website runs (technical data);
- public authorities, where the law obliges us to disclose data.
These providers process the data to provide their services to us. We do not share your data with them for advertising.
Transfers to other countries
The company is established in Indonesia. The server that runs this website is located in Germany (European Union) and is provided by HOSTKEY B.V. (the Netherlands). The other providers named above are established in the United States (Cloudflare, Google) and in Switzerland (Proton), and may process data in other countries where they operate. If you write to us from the European Economic Area, from Indonesia or from another country, your data leaves your country, and the data protection rules in the countries where it is processed may differ from the rules where you live.
- Germany and the Netherlands are in the European Union, where the GDPR applies directly.
- Switzerland is recognised by the European Commission as providing an adequate level of data protection.
- For the United States and other countries, the transfer relies on the safeguards that the providers offer in their terms for international transfers, where these apply, and otherwise on the fact that it is needed to deal with the request you sent us.
Write to us if you would like more information about a transfer and the safeguards that apply to it.
How long we keep it
- Enquiry data: for as long as we correspond with you and need the correspondence to deal with your request. If no project follows, we delete it once it is no longer needed for that purpose. If a contract follows, we keep the records for the period the law requires. This applies to the message in our mailbox and to the copy in the sending account's sent mail.
- Security check data: we do not store it; Cloudflare keeps it under its own policies. The rate limit record is erased from our server's memory 10 minutes after the last message from that address, or earlier on a server restart.
- Technical data in server logs: our web server does not keep access logs. Application and system logs on the server, which may contain an IP address and the time of a request, are kept for 14 days and then deleted automatically. Cloudflare keeps its own logs under its own policies.
- Your cookie choice: the record counts for 12 months from your choice. After that, or when the Cookie Policy changes, the website deletes it on your next visit and asks again. You can delete it earlier by clearing the site data in your browser.
Your rights
Depending on the law that applies to you, you have the right to:
- be told how your data is used and who is responsible for it;
- get access to your data and receive a copy of it;
- have inaccurate or incomplete data corrected;
- have your data erased;
- have the processing restricted or suspended;
- object to processing that is based on our legitimate interest;
- receive the data you gave us in a commonly used format and pass it to another controller;
- withdraw consent at any time, where processing is based on consent; this does not affect processing carried out before the withdrawal;
- object to decisions based solely on automated processing;
- claim compensation for a breach of the rules on personal data, as the law provides.
To use any of these rights, write to the address below. We may ask you to confirm that the request comes from you. We answer within the time limit set by the law that applies to your request: under the GDPR, within one month of receiving it (this can be extended by two further months for complex or numerous requests, and we would tell you so within the first month); under Indonesian Law No. 27 of 2022, within 3 × 24 hours of receiving it where that law sets this limit.
Complaints
If you think we handle your data unlawfully, please tell us first so that we can put it right. You can also lodge a complaint with a supervisory authority: in the European Economic Area, with the data protection authority of the country where you live or work; in Indonesia, with the personal data protection authority provided for by Law No. 27 of 2022 and with the other authorities competent under Indonesian law.
Whether you have to provide data; automated decisions
You are not obliged to give us any data. Your name, email address and message are needed to answer you: without them we cannot reply. The company name is optional.
We do not make decisions based solely on automated processing, and we do not profile visitors.
Security
The website is served only over an encrypted connection (HTTPS, with TLS provided by Cloudflare) and restricts what the browser may load from it: the only third-party script is the Cloudflare Turnstile check on the page with the contact form. Our server hands messages from the form to the email service over an encrypted connection. If a personal data breach occurs that is likely to affect you, we will notify you and the competent authority in writing within the time the applicable law sets: no later than 3 × 24 hours under Indonesian Law No. 27 of 2022, and, where the GDPR applies, the supervisory authority within 72 hours of becoming aware of the breach and you without undue delay.
Changes to this policy
We update this policy when the way we process data changes, for example when a new service provider is connected. The date at the top of the page shows which version is current.
This document is published in English and Indonesian. If the two versions differ, the English version prevails.