Legal

Privacy Policy

Last updated: 4 November 2026

PT. Soon Poh Technologies ("Soon Poh", "we", "us") respects your privacy. This Privacy Policy explains how we process personal data through this website, soonpoh.co.id (the "Website"), in accordance with Law No. 27 of 2022 on Personal Data Protection (the "PDP Law"), Law No. 11 of 2008 on Electronic Information and Transactions as last amended by Law No. 1 of 2024 (the "EIT Law"), Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and Transactions, and their implementing regulations.

1. Who we are (data controller)

For personal data collected through the Website, Soon Poh acts as the personal data controller (Pengendali Data Pribadi) within the meaning of the PDP Law:

PT. Soon Poh Technologies
Jl. Prof. Dr. Saharjo No.104, RT.2/RW.7, Menteng Atas, Kec. Setiabudi, Jakarta Selatan, DKI Jakarta 12960, Indonesia
Email: santy.riana@soonpoh.co.id · Phone: (021) 3882 6886

2. Personal data we process

We keep the personal data we collect to a minimum.

Data you give us. When you contact us by email, through the enquiry form (which opens your own email application) or by phone, we receive your name, email address, phone number, organisation, job title and the content of your message. When you apply for a job, we receive your CV and the information you choose to include in it.
Technical data. When you visit the Website, our hosting and content delivery providers automatically process technical data such as your IP address, browser type, device information, the pages requested and the date and time of the request. This is needed to deliver the Website securely.
Your cookie choice. We store your cookie preference in your browser so we do not ask you again on every visit (see our Cookie Policy).

We do not intentionally collect specific personal data (data pribadi yang bersifat spesifik) as defined in Article 4(2) of the PDP Law, such as health, biometric, genetic, criminal record or financial data. Please do not send us such data unless we specifically ask for it.

3. Purposes and legal bases

We process personal data only for specified, lawful purposes and on a legal basis under Article 20 of the PDP Law:

Responding to enquiries and preparing proposals or quotations. Legal basis: your consent, given when you contact us, and steps taken at your request before entering into a contract.
Performing contracts with our clients and partners, including licence administration and support. Legal basis: performance of a contract.
Recruitment, to assess your application and contact you about it. Legal basis: your consent and steps prior to an employment contract.
Operating and securing the Website, including preventing abuse and attacks. Legal basis: our legitimate interests, balanced against your rights.
Complying with law, including tax, accounting and requests from competent authorities. Legal basis: fulfilment of a legal obligation.

We do not sell personal data, use it for automated decision-making or profiling, or send you marketing without your consent.

4. Who we share data with

We share personal data only where necessary for the purposes above:

Service providers (data processors) that act on our instructions, such as website hosting and content delivery (including Cloudflare, Inc.), web font delivery (Google Fonts, Google LLC) and email providers. They are bound to protect personal data and use it only for the services they provide to us.
Our group companies, including our parent company Soon Poh Investments Pte Ltd in Singapore, where needed to handle your enquiry or a project.
Technology partners, such as BeLive Technology Pte. Ltd., only where your enquiry concerns their products and only to the extent needed to answer it.
Authorities, where required by Indonesian law or a lawful order.

5. Transfers outside Indonesia

Some of our service providers and our parent company are located, or store data, outside Indonesia (for example in Singapore or the United States). In line with Article 56 of the PDP Law, we transfer personal data abroad only where the receiving country has an equal or higher level of protection, or where adequate and binding safeguards are in place, or otherwise with your consent.

6. How long we keep data

We keep personal data only as long as needed for the purpose it was collected for:

Enquiries that do not lead to a contract: up to 2 years after our last contact.
Client and contract records: for the duration of the relationship and afterwards for as long as required by Indonesian law, including the 10-year retention of company documents under Law No. 8 of 1997 on Company Documents.
Job applications: up to 1 year after the recruitment process ends, unless you agree to a longer period.
Technical logs: for a short period set by our hosting providers, normally not more than 30 days, unless needed to investigate a security incident.

When the retention period ends, we delete or anonymise the data.

7. Your rights

As a data subject (Subjek Data Pribadi), you have rights under Articles 5 to 13 of the PDP Law, including the right to:

obtain information about the identity of the controller, the legal basis and purpose of processing, and our accountability;
access and obtain a copy of your personal data;
complete, update or correct inaccurate personal data;
end processing and have your personal data deleted or destroyed;
withdraw consent you have given;
object to decisions based solely on automated processing, including profiling;
delay or restrict processing;
receive or transfer your personal data in a commonly used format; and
sue and receive compensation for violations of the processing of your personal data, in accordance with the law.

To exercise these rights, email santy.riana@soonpoh.co.id. We may need to verify your identity. We will respond within the time limits set by the PDP Law and its implementing regulations. Withdrawing consent does not affect processing carried out before the withdrawal.

8. Security

We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), access controls and reputable service providers. No method of transmission over the internet is completely secure. If a personal data breach occurs, we will notify affected data subjects and the relevant authority in writing no later than 3 x 24 hours after we become aware of it, as required by Article 46 of the PDP Law.

9. Children

The Website is intended for businesses and professionals. We do not knowingly collect personal data from children. Where processing of a child's personal data is required, it will only take place with the consent of a parent or legal guardian, as required by Article 25 of the PDP Law.

10. Third-party links

The Website may link to third-party websites. We are not responsible for their privacy practices. Please read their privacy policies.

11. Changes to this policy

We may update this Privacy Policy from time to time. The latest version is always published on this page with its "last updated" date. Material changes will be highlighted on the Website.

12. Contact and complaints

For questions, requests or complaints about personal data, contact us:

If you are not satisfied with our response, you may lodge a complaint with the Indonesian personal data protection authority or the Ministry responsible for communications and digital affairs.

Language

This document is published in English. In line with Law No. 24 of 2009 on the National Flag, Language, Coat of Arms and Anthem, an Indonesian-language version may be made available. If there is any inconsistency between the two versions, the Indonesian version prevails to the extent required by law.