Privacy Policy

Effective Date: January 1, 2026
Last Updated: October 2026
Governing Entity: PT Aksi Cethokaryo Bersama (Yogyakarta, Indonesia)

Welcome to Cethokaryo. We build high-voltage digital engineering platforms, web architecture, and ecommerce ecosystems. We take personal data privacy with maximum engineering seriousness, adhering strictly to the Indonesian Personal Data Protection Law (UU PDP No. 27/2022) and global data protection standards (GDPR).

1. Information We Collect

We only collect data necessary to provide our digital agency, software products, and event ticketing services:

Identity & Contact Details: Full name, corporate email address, phone number, and mailing address when submitting inquiries, requesting quotes, or creating an account.
Account & Security Information: Argon2id encrypted passwords, two-factor authentication secret seeds (TOTP), and session telemetry.
Transaction & Payment Data: Order identifiers, purchased product/ticket references, and fulfillment records. Payment card data, virtual accounts, and e-wallets are processed through PCI-DSS Level 1 certified gateway partner Xendit; Cethokaryo never stores raw credit card credentials on our servers.
Career Applicant Data: Resumes, portfolios, LinkedIn profiles, and job application letters submitted to our career portal.
Automated Telemetry: IP address, browser type, device information, and anti-abuse verification signals via Cloudflare Turnstile.

2. How We Use Your Data

We process your information strictly for legitimate commercial and operational purposes:

Engineering Service Delivery: Scoping bespoke web applications, communicating architectural milestones, and delivering project deliverables.
Order & Ticket Fulfillment: Delivering digital asset downloads, issuing cryptographically verified event tickets with QR codes, and processing invoices.
Account Protection & Fraud Prevention: Safeguarding accounts via multi-factor authentication, anomaly detection, and rate limiting.
Talent Recruitment: Evaluating candidates for open engineering and design roles.

3. Data Protection & Encryption

All user and client data is protected with enterprise-grade cryptographic controls:

In Transit: TLS 1.3 encryption with Perfect Forward Secrecy across all endpoints.
At Rest: Industry-standard database storage and AES-256 encryption for sensitive credentials.
Access Control: Role-based access controls (RBAC) ensuring only authorized administrative personnel can access order and applicant records.

4. Third-Party Data Processors

We partner exclusively with reputable infrastructure and payment providers:

Xendit (PT Sinar Digital Terdepan): Payment gateway processing virtual accounts, QRIS, e-wallets, and credit cards.
Cloudflare Inc.: Bot mitigation, Turnstile human verification, and CDN edge caching.
Google Cloud Platform: Hosting infrastructure and secure database clusters.

We do not sell, rent, or trade your personal information to data brokers or advertising networks.

5. Your Rights Under UU PDP & GDPR

Under applicable data protection regulations, you have the right to:

Access: Request a copy of the personal information we hold about you.
Rectification: Update or correct inaccurate or incomplete details via the Console Profile settings.
Erasure: Request deletion of your account and personal history, subject to statutory tax and bookkeeping requirements.
Data Portability: Request an export of your digital orders and event registrations.

To exercise these rights, email our Data Protection Officer at privacy@cethokaryo.com or write to us at:

PT Aksi Cethokaryo Bersama
Jl. Mangkubumi No. 12, Gowongan, Jetis, Yogyakarta 55233, Indonesia
Contact: hello@cethokaryo.com | +62 812-3456-7890