Privacy Policy

A privacy policy is a document that outlines how an organization collects, uses, discloses, and protects the personal information of individuals. It serves as a clear and transparent statement that informs individuals about their privacy rights and how their personal data is handled by the organization. It typically includes details on the types of information collected, the purposes for which it is collected, the methods of data collection, and the measures taken to ensure data security. It also specifies how individuals can access, update, or request the deletion of their personal information. Privacy policies are crucial in establishing trust between organizations and individuals, as they demonstrate a commitment to respecting privacy and complying with applicable privacy laws and regulations. By providing clarity and transparency, it helps individuals make informed decisions about sharing their personal information and promotes responsible data handling practices.

Using it is essential for organizations to establish a clear framework for handling personal information and respecting individual privacy rights. It outlines the Terms and Conditions regarding the collection, use, and disclosure of personal data. By implementing the document, organizations demonstrate their commitment to safeguarding personal information and complying with applicable privacy laws and regulations. This helps build trust with customers, clients, and users by assuring them that their data will be handled responsibly and securely. It provide individuals with important information about the purposes for which their data is collected, how it will be used, who it may be shared with, and the measures taken to protect it. It also informs individuals of their rights regarding their personal data, such as the right to access, correct, or delete their information. By using a privacy policy, organizations not only fulfill legal requirements but also prioritise transparency, trust, and the protection of individual privacy.

Clearly specify the types of personal information that may be collected, such as names, contact details, or financial data.

Explain the purposes for which the information is collected and how it will be used, whether for customer service, marketing, or other legitimate business activities.

Indicate whether the information will be shared with third parties and, if so, the reasons and conditions under which this may occur.

Outline the measures in place to protect personal information from unauthorized access, loss, or misuse, such as encryption or firewalls.

Inform individuals of their rights regarding their personal data, including the ability to access, correct, or delete their information.

If applicable, include a separate section explaining the use of cookies on the website or application and how users can manage their preferences.

Specify the legal basis for processing personal information, such as consent, legitimate interest, or compliance with legal obligations.

State how the document may be updated or modified, and how individuals will be notified of any changes.

Provide contact details for individuals to reach out with questions, concerns, or requests related to their personal information.

By including these elements, the document can effectively inform individuals about the organization’s data practices, their rights, and the measures taken to protect their personal information.

A privacy policy, such as the one provided by Themis Partners, complies with privacy regulations by clearly outlining how an organization collects, uses, discloses, and protects personal information of individuals in accordance with the Personal Data Protection Law (PDPA) No. 27 of 2022 in Indonesia. The policy serves as a transparent and informative statement that informs individuals about their rights, the purposes for which their personal data is collected, and how it will be used and protected. It also provides details on how the organization complies with the law, including how consent is obtained, how data accuracy is ensured, how data security measures are implemented, how data breaches are notified, and how individual rights are respected. The privacy policy is designed to be easily understandable and accessible, ensuring that individuals are well-informed about how their personal data is handled.

Not having a privacy policy can have various implications for individuals and organizations in Indonesia. Without it, an organization may lack clear guidelines and transparency regarding the collection, use, and protection of personal information. This can lead to confusion and concerns among individuals who entrust their data to the organization. Furthermore, the absence of the document may indicate a lack of compliance with Indonesia’s Personal Data Protection Law (PDPA) No. 27 of 2022. Non-compliance with this law can result in legal consequences, including administrative sanctions such as written warnings, temporary suspension of personal data processing activities, deletion or destruction of personal data, indemnification of losses, and fines of up to 2% of the annual revenue of the data controller. Additionally, not having a privacy policy can erode trust and credibility, as individuals may question the organization’s commitment to data privacy and security. Implementing a privacy policy is crucial to establish a transparent and accountable approach to handling personal information, protect individuals’ privacy rights, and demonstrate compliance with Indonesia’s PDPA.

In Indonesia, a privacy policy addresses personal data collection in accordance with Law No. 27 of 2022 on Personal Data Protection (PDP Law). The privacy policy must clearly state the types of personal data collected, which can include general data such as name, gender, nationality, religion, and marital status, as well as specific personal data like medical information, biometrics, genetics, criminal records, child data, and personal financial data. The methods of collection, whether through electronic or non-electronic systems, should also be specified.

The privacy policy must explain the purposes for which the data is collected, such as for business operations or service improvements. It should also detail the legal basis for collecting data, such as obtaining consent from the data subject or having a legitimate interest.

Furthermore, the privacy policy should inform individuals about their rights under the PDP Law. These rights include the right to obtain information concerning the identity and accountability of the party that requests or collects their personal data, the right to know the purpose and usage of such request or collection, the right to alter, update or change their personal data, as well as end, terminate and/or erase their personal data.

A privacy policy addresses cookie consent by clearly stating that the website uses cookies and explaining what cookies are. It informs users that cookies are small text files that are downloaded onto their device when they visit the site. These files allow the website to recognize the user’s device and store details about their preferences.

The policy should specify the types of cookies used, such as session cookies, persistent cookies, first-party cookies, or third-party cookies, and explain their purposes. This can include enhancing the user experience, analyzing site usage for improvements, and delivering targeted advertising.

Importantly, the privacy policy must inform users that they have the right to consent to the use of cookies. It should provide instructions on how users can manage their cookie preferences, such as enabling, disabling, or deleting cookies.