1. Introduction

This Privacy Policy explains how PT Super Beton Persada ("we", "us", or "our") collects, uses, stores, and protects your personal data when you visit superbetonpersada.com or interact with our online services.

We process personal data in accordance with Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP), Law No. 11 of 2008 on Electronic Information and Transactions as amended (UU ITE), and other applicable regulations in the Republic of Indonesia.

This notice is provided to fulfil our transparency obligations under Article 21 of the UU PDP. Where an English translation differs from the Indonesian version, the Indonesian version on the id-ID locale of this website prevails.

Effective date: 12 June 2026.

2. Data Controller

The data controller responsible for your personal data is:

• Legal entity: PT Super Beton Persada
• Registered address: Jl. Example No. 1, Jakarta 10110, Indonesia
• Website: https://superbetonpersada.com
• General contact: jakarta@superbetonpersada.example
• Privacy enquiries: privacy@superbetonpersada.com
• Telephone: +62 21 1234 5678

3. Scope

This policy applies to personal data collected through:

• This website and its subpages
• Contact and inquiry forms
• Career application forms and uploaded documents
• Email and messaging channels initiated via this website
• Cookies and similar technologies used on this website

4. Legal Basis for Processing

Under Article 20 of the UU PDP, we process personal data only when we have a valid legal basis, including:

• Your explicit consent — for example, when you submit a career application and agree to our PDP notice, or when you accept non-essential cookies
• Performance of a contract or steps at your request before entering a contract — for example, responding to your inquiry or processing your job application
• Compliance with legal obligations — for example, employment, tax, or regulatory record-keeping requirements
• Legitimate interests — for example, securing our website, preventing fraud and abuse, and improving our services, balanced against your rights
• Vital interests or public interest — only where required by applicable law

5. Personal Data We Collect

The types and relevance of personal data we process depend on how you interact with us. We may collect:

• Identity and contact data: full name, email address, telephone or WhatsApp number, and message content submitted through contact forms
• Recruitment data: full name, email, WhatsApp number, curriculum vitae (CV), cover letter, position applied for, and any information you include in application documents
• Technical and usage data: IP address, browser type, device information, pages visited, referring URL, locale preference, and timestamps collected automatically when you use the website
• Security data: information processed by Cloudflare Turnstile to verify that form submissions are made by humans and to protect against automated abuse
• Communication records: copies of messages we send or receive in connection with your inquiries or applications

5.1 Sensitive Personal Data

We do not intentionally collect specific (sensitive) personal data unless you voluntarily include it in free-text fields or documents you submit. Please avoid submitting sensitive data unless it is necessary for your request.

6. Purposes of Processing

We process personal data for the following purposes:

• Responding to inquiries submitted through our contact form
• Receiving, reviewing, and managing career applications
• Sending transactional emails such as application acknowledgements or responses to your messages
• Operating, maintaining, and securing the website
• Detecting, preventing, and addressing fraud, spam, and security incidents
• Complying with legal and regulatory obligations
• Improving website performance and user experience where permitted by law and your choices

7. Processing Period and Retention

Personal data is processed for as long as necessary to fulfil the purposes described above and in line with applicable law.

• Contact form submissions: up to 2 (two) years from the date of last correspondence, unless a longer period is required to resolve an ongoing matter
• Career applications: up to 2 (two) years from the date of application for unsuccessful candidates; for hired candidates, employment records are retained according to applicable labour and company policies
• Technical logs and security records: typically up to 12 (twelve) months, unless needed for incident investigation
• Cookie data: according to the lifetime stated for each cookie category in Section 8 below

When retention periods expire, we delete or anonymise personal data unless continued storage is required by law or for the establishment, exercise, or defence of legal claims.

8. Cookies and Similar Technologies

Our website uses cookies and similar technologies to enable core functionality, remember preferences, and protect forms.

• Strictly necessary cookies: required for website operation, security, load balancing, and Turnstile verification. These cannot be disabled through our site without affecting functionality
• Preference cookies: remember choices such as language or locale where applicable
• Analytics or performance cookies: used only if enabled and where permitted by law; you may manage non-essential cookies through cookie settings where available

You can also control cookies through your browser settings. Disabling certain cookies may limit some website features. Where consent is required under the UU PDP, we request your consent before placing non-essential cookies.

9. Third Parties and Data Processors

We may share personal data with trusted service providers who process data on our behalf and only according to our instructions, including:

• Hosting and infrastructure providers that operate this website and database
• Cloudflare, Inc. for Turnstile bot protection and related security services
• Resend (email delivery via SMTP) and our email infrastructure for transactional messages
• Professional advisers, auditors, or authorities where required by law

We require processors to implement appropriate security measures and process data only for specified purposes. We do not sell your personal data.

If personal data is transferred outside Indonesia, we take steps required under the UU PDP, including ensuring an adequate level of protection or appropriate safeguards such as contractual commitments with recipients.

10. Security

We implement technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction, consistent with Article 16 of the UU PDP. Measures include access controls, encryption in transit where supported, monitoring, and staff confidentiality obligations.

No method of transmission over the internet is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

11. Your Rights as a Data Subject

Under the UU PDP (Articles 5–14), you have the following rights in relation to your personal data, subject to applicable exceptions:

• Right to be informed — to receive clear information about identity of the controller, legal basis, purpose, and accountability (Article 5)
• Right to rectify — to complete, update, or correct inaccurate personal data (Article 6)
• Right of access — to access and obtain a copy of your personal data (Article 7)
• Right to erasure — to terminate processing, delete, or destroy your personal data in accordance with law (Article 8)
• Right to withdraw consent — where processing is based on consent (Article 9)
• Right to object — to automated decision-making that produces legal or significant effects, where applicable (Article 10)
• Right to restrict processing — to delay or limit processing proportionally to the purpose (Article 11)
• Right to compensation — to claim damages for unlawful processing in accordance with law (Article 12)
• Right to data portability — where applicable under implementing regulations (Article 13)

To exercise your rights, submit a recorded request electronically or non-electronically to the contact details in Section 14. We may need to verify your identity before responding. We will respond within the timeframe required by applicable law.

Certain rights may be limited where permitted under Article 15 of the UU PDP, including for national security, law enforcement, public interest, or statistical and scientific research carried out under law.

12. Children

Our website and career services are not directed at children under 18 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will take appropriate steps to delete it.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in law, technology, or our practices. If we make material changes, we will notify you through this page before the changes take effect, as required by Article 21(2) of the UU PDP.

Please review this page periodically for the latest information.

14. Contact Us

For questions about this Privacy Policy or to exercise your rights as a data subject, contact:

• Email: privacy@superbetonpersada.com
• Postal address: PT Super Beton Persada, Jl. Example No. 1, Jakarta 10110, Indonesia
• Telephone: +62 21 1234 5678

If you are not satisfied with our response, you may lodge a complaint with the authorised personal data protection authority in Indonesia once designated and operational under the UU PDP.