Privacy Policy

01 About This Policy

This Privacy Policy describes how PT. Erik Prima Sejati ("we", "us", "our", or "the Company"), a company registered and operating in the Republic of Indonesia, handles personal data collected through our website at PTErikPrimaSejati.com, our telephone and marketing services, and any other interaction you have with us.

By using our website or engaging our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our website or services.

This policy applies to:

• Visitors to our website
• Prospective and existing clients of our marketing and lead qualification services
• Individuals whose contact details are provided to us by our clients as part of lead qualification campaigns
• Job applicants and business partners

02 Information We Collect

Information you provide directly

• Full name, job title, and company name
• Email address and telephone number
• Business address and website
• Information submitted through contact forms, campaign briefs, or email correspondence
• Payment and invoicing details for client accounts

Information collected automatically

• IP address and approximate geographic location
• Browser type, device type, and operating system
• Pages visited, time spent on pages, and referring URLs
• Cookie identifiers and analytics data (see Section 9)

Information from campaign activities

When we conduct telephone lead qualification or outbound marketing on behalf of our clients, we may collect and process the personal data of individual prospects including their name, contact details, company information, and responses provided during calls. This data is collected under contract with our clients, who are responsible for ensuring their prospect data was lawfully obtained.

Information from third parties

• Publicly available business directories and professional networks
• Data provided by clients as part of campaign prospect lists
• Referrals from partners or existing clients

03 How We Use Your Information

We use personal data for the following purposes:

Service delivery

• Managing client accounts and delivering contracted marketing and lead qualification services
• Conducting outbound telephone campaigns on behalf of clients
• Scheduling and confirming appointments on behalf of clients
• Producing campaign reports, call recordings, and performance analytics

Communication

• Responding to enquiries submitted through our website or by telephone
• Sending service updates, invoices, and contractual notices to clients
• Sending marketing communications about our services where you have given consent or where we have a legitimate business interest

Legal and compliance

• Complying with applicable Indonesian laws and regulations
• Exercising or defending legal rights and claims
• Fraud prevention and security monitoring

Website improvement

• Analysing website usage to improve content and user experience
• Diagnosing technical issues and monitoring site performance

04 Legal Basis for Processing

We process personal data on the following legal grounds under Indonesia's Personal Data Protection Law (UU PDP No. 27 of 2022) and, where applicable, under international frameworks:

• Contractual necessity — to perform services under a contract with you or your organisation
• Consent — where you have explicitly given consent for a specific processing activity, including receiving marketing communications
• Legitimate interests — where processing is necessary for our genuine business purposes and does not override your fundamental rights and freedoms
• Legal obligation — where processing is required to comply with applicable Indonesian law or regulatory requirements

05 Data Sharing & Disclosure

We do not sell your personal data. We may share personal data only in the following circumstances:

With clients

Qualified lead information, call notes, recordings, and campaign data are shared with the client on whose behalf a campaign is conducted, as described in our service agreement with that client.

With service providers

We engage trusted third-party service providers for CRM software, cloud storage, telephony systems, and analytics. These providers are bound by data processing agreements and may only process personal data as instructed by us.

For legal reasons

We may disclose personal data where required by Indonesian law, court order, regulatory authority, or where we reasonably believe disclosure is necessary to protect the rights, safety, or property of PT. Erik Prima Sejati, our clients, or the public.

Business transfers

In the event of a merger, acquisition, or sale of all or part of our business, personal data may be transferred as part of that transaction. Affected individuals will be notified.

06 Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy, or as required by law. Our general retention guidelines are:

• Client account and contract data: 5 years after the end of the client relationship
• Campaign data and call recordings: 2 years after campaign completion, unless a client requests earlier deletion
• Prospect data collected during campaigns: deleted or returned to the client within 90 days of campaign completion
• Website enquiry data: 2 years from the date of submission
• Financial and invoicing records: 7 years as required by Indonesian tax law

When data is no longer required, it is securely deleted or anonymised.

07 Your Rights

Under Indonesia's UU PDP No. 27/2022, you have the following rights regarding your personal data:

• Right of access — to request a copy of the personal data we hold about you
• Right to rectification — to request correction of inaccurate or incomplete data
• Right to erasure — to request deletion of your personal data, subject to legal retention requirements
• Right to restrict processing — to request that we limit how we use your data in certain circumstances
• Right to object — to object to processing based on legitimate interests, including direct marketing
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to withdraw consent — to withdraw consent at any time where processing is based on consent, without affecting prior processing

To exercise any of these rights, please contact us using the details in Section 13. We will respond within 30 days. We may need to verify your identity before processing your request.

08 Data Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit using TLS/HTTPS protocols
• Access controls and role-based permissions for all systems containing personal data
• Regular security assessments and staff training on data protection
• Secure disposal of physical documents and electronic records
• Incident response procedures for data breaches

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant authorities and affected individuals as required by law.

No method of electronic transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee absolute security.

09 Cookies & Tracking

Our website uses cookies and similar tracking technologies to enhance your browsing experience and gather analytics data. Types of cookies we use:

• Essential cookies — required for basic website functionality; cannot be disabled
• Analytics cookies — help us understand how visitors use our website (e.g. Google Analytics)
• Preference cookies — remember your settings and preferences across visits

You can manage or disable non-essential cookies through your browser settings. Disabling cookies may affect the functionality of some parts of our website.

10 International Data Transfers

PT. Erik Prima Sejati is based in Indonesia and primarily processes data within Indonesia. Where we use third-party service providers located outside Indonesia (for example, cloud infrastructure), we ensure appropriate safeguards are in place, including contractual data protection clauses that meet or exceed the requirements of UU PDP No. 27/2022.

For international clients, data related to their campaigns may be shared with them in their country of operation. By engaging our services, international clients confirm they have a lawful basis for receiving this data in their jurisdiction.

11 Children's Privacy

Our services are directed exclusively at businesses and professionals. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will take steps to delete it promptly.

12 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Post a notice on our website for a reasonable period
• Notify active clients by email where the changes materially affect how we process their data

We encourage you to review this policy periodically. Continued use of our website or services after changes are posted constitutes acceptance of the revised policy.

13 Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to raise a concern about how we handle your personal data, please contact us:

We aim to respond to all data rights requests and privacy enquiries within 30 business days.