Privacy Policy

1. Who is responsible

PT Mega Nusa Teknologi is the data controller for personal data processed through https://meganusatek.id. Our registered details are below.

This policy is written in line with Law No. 27 of 2022 on Personal Data Protection (UU PDP).

2. Personal data we collect

We collect only what a given interaction requires.

• Enquiries: your name, phone number, email address, and the content of what you send us, when you contact us by WhatsApp or email.
• Orders: the billing details required to issue a valid invoice — organisation name, billing address, contact name, email, and where applicable a tax identification number.
• Service delivery: any information you choose to share with us so we can perform the work, including access credentials, which we handle under our confidentiality obligations.
• Technical logs: IP address, timestamp, requested URL, response status, and user agent, recorded automatically by our web server.

3. What we do not collect

This Website sets no advertising cookies, no analytics cookies, and no cross-site tracking of any kind. There is no third-party tag, pixel, or session recorder on it.

We never receive your card number, CVV, or bank credentials. Those go directly to our payment provider.

We do not knowingly collect sensitive personal data as defined by UU PDP, and we ask you not to send us any.

4. Your cart

The contents of your cart are stored only in your own browser, using local storage. They are never transmitted to us, we cannot read them, and they are not personal data in our hands. Clearing your browser data removes them.

5. Why we process your data, and on what basis

• To respond to your enquiry and to prepare a quotation — on the basis of steps taken at your request before entering a contract.
• To perform the contract, deliver what you ordered, and provide support — on the basis of contractual necessity.
• To issue invoices and meet accounting, tax, and reporting obligations — on the basis of legal obligation.
• To keep the Website and our systems secure, detect abuse, and troubleshoot faults — on the basis of our legitimate interest in operating a secure service.
• To send occasional operational messages about a service you use — on the basis of contractual necessity. We do not send marketing email without your consent.

6. Payment data

Payments are processed by our third-party payment provider on their own secure page. Your card or bank credentials never reach our servers, and we neither see nor store them.

We receive only what we need to reconcile the order: the amount, the currency, the time, a transaction reference, and whether the payment succeeded.

The provider processes your payment data as an independent controller, under its own privacy policy and the applicable card scheme rules.

7. Who we share data with

We do not sell personal data, and we do not share it for anyone else’s marketing.

We share it only with the providers we need to run the business, and only to the extent required:

• Our payment provider, to take payment and handle refunds
• Our hosting and infrastructure providers, which store the data at rest
• Our accountant and tax advisers, for invoicing and statutory reporting
• Subcontractors bound by equivalent confidentiality and security obligations, where they take part in delivering your project
• A public authority or court, where we are legally required to disclose

8. International transfers

Some providers process data outside Indonesia. Where that happens, we transfer data only to jurisdictions offering an adequate level of protection, or under contractual safeguards providing protection consistent with UU PDP.

9. How long we keep it

• Enquiries that do not lead to a contract: up to 24 months, then deleted
• Client records and correspondence: for the duration of the relationship and 5 years afterwards
• Invoices and accounting records: 10 years, as required by Indonesian company and tax law
• Web server logs: rotated regularly and retained for a limited period, then deleted
• Project material and credentials: deleted or returned at your request on completion, subject to any legal retention obligation

10. Security

The Website is served exclusively over HTTPS with HSTS, a strict Content Security Policy, and standard security headers. It is a static site: it has no database, no server-side interpreter, and no login, which removes entire categories of risk.

Access to our internal systems is limited to the people who need it, protected by strong authentication, and reviewed periodically. Credentials you share with us are stored in a dedicated secret manager, never in plain text.

No system is perfectly secure. If a personal data breach occurs that is likely to create a risk to you, we will notify you and the competent authority within 3 × 24 hours, as required by UU PDP.

11. Your rights

Under UU PDP, you have the right to:

• Be informed about how your data is processed and for how long
• Access your data and obtain a copy
• Have inaccurate or incomplete data corrected
• Have your data deleted, where no legal retention obligation applies
• Withdraw a consent you previously gave, without affecting processing already carried out
• Object to processing based on our legitimate interest
• Obtain your data in a structured, commonly used format, and have it transmitted to another controller where technically feasible
• Lodge a complaint with the competent supervisory authority

12. How to exercise your rights

Write to admin [at] meganusatek.id . We acknowledge within 3 business days and respond within 30 days. We may ask you to confirm your identity before acting, to make sure we do not disclose data to the wrong person.

Exercising these rights is free. We may charge a reasonable fee only for manifestly excessive or repetitive requests, and we will tell you before doing so.

13. Children

Our services are aimed at businesses and are not directed at children. We do not knowingly collect data from anyone under 18. If you believe we hold such data, contact us and we will delete it.

14. Changes to this policy

We may update this policy. The current version is always published here with its date. Where a change materially affects your rights, we will notify affected clients directly.

Last updated: 2026-09-09.

15. Contact

Questions, requests, or complaints about privacy: admin [at] meganusatek.id , or by WhatsApp at +62 822 2005 0093.