LEGAL — PRIVACY NOTICE

Privacy — Laluvirtual

What we collect, why we collect it, how long we keep it, and the rights you have over your data. Plain language, no fine print buried in a footnote.

DOCLEGALEFFECTIVE 01 JANUARY 2026

PRIVACY — LALUVIRTUAL

INFORMATION WE COLLECT

We collect only the information necessary to deliver and operate the Laluvirtual hosting, web development and related services you have requested. This includes account identifiers such as your name, business name, billing email, and a password hash; technical identifiers such as IP address, browser fingerprint, access timestamps, and request logs; and service-specific data such as the contents of your hosting control panel, the source code you upload for development engagements, and the content of any CMS you operate on our infrastructure. Payment instruments themselves are never stored on our systems — they are tokenized and held by our PCI-DSS-compliant payment partners. We do not purchase third-party contact lists, and we do not scrape personal data from public sources for marketing purposes.

Where you submit content to us — for example by opening a support ticket, sending email to [email protected], or filling out the project intake form — that content is retained for the purpose of resolving your request and for quality assurance. Logs of HTTP requests, application errors and security events are retained on a rolling basis according to the schedule published in our service documentation. If at any time you would like a copy of the personal data we hold about you, or you would like it corrected, contact [email protected] and we will respond within ten business days.

HOW WE USE YOUR INFORMATION

Your information is used for four well-defined purposes: provisioning and operating the services you have subscribed to; communicating with you about incidents, maintenance, renewals, and security advisories that affect your account; fulfilling our legal, tax and accounting obligations under Indonesian and applicable international law; and producing aggregated, anonymized statistics that help us improve the network, the support process, and the product roadmap. We do not sell, rent, barter, or otherwise transfer your personal data to third parties for their own marketing purposes — this is a hard, non-negotiable line for us.

Where a third party needs to process personal data on our behalf — for example a CDN edge provider, a payment processor, an outbound email relay, or a ticketing tool — we engage them under a written data processing agreement that limits their use of the data to the specific purpose we have authorized, requires them to maintain appropriate technical and organizational measures, and prohibits any secondary use or disclosure. We maintain an up-to-date list of these sub-processors and the categories of data they handle, available on request.

COOKIES AND LOCAL STORAGE

Laluvirtual uses a small number of strictly necessary cookies and localStorage entries: a session cookie that authenticates you to the client portal after login, a CSRF token that protects forms from cross-site request forgery, a notice-dismissal flag that remembers you have closed the Indonesia notice bar, and an analytics entry that records the page route so we can diagnose routing errors. These items are required for the site to function and are not used for cross-site behavioral advertising. We do not embed third-party advertising pixels, and we do not use tracking cookies that follow you across other websites.

If you would prefer not to carry the session or CSRF entries, you can clear them from your browser at any time — the public marketing pages will continue to function normally. The client portal, however, requires these entries to operate securely, and disabling them will prevent login. Where applicable law requires it, we will request your explicit opt-in before placing any non-essential cookie on your device, and we will honor a clean opt-out signal such as a Global Privacy Control header.

DATA RETENTION

We retain personal data only as long as is necessary to fulfill the purposes outlined in this notice, to comply with our legal obligations, and to resolve disputes. Account data is retained for the lifetime of your account plus three years thereafter, to allow for tax and audit requirements. Server-side logs are rotated every ninety days, with security event logs retained for twelve months. Source code and database backups associated with development engagements are retained for ninety days after final delivery, after which they are purged unless you have purchased an extended retention add-on or instructed us in writing to retain them.

If you would like us to delete your personal data earlier than the standard retention schedule allows, you may submit a deletion request to [email protected]. We will action verifiable requests within thirty days, with the exception of data that we are legally required to retain for tax, audit, or ongoing-litigation purposes, which we will hold under restricted access until the legal hold is lifted and then delete promptly.

YOUR RIGHTS

Depending on the jurisdiction in which you reside, you may have the right to access, correct, port, restrict, or delete the personal data we hold about you, as well as the right to object to certain processing activities and the right to withdraw consent for processing that was based on consent. To exercise any of these rights, contact [email protected] with a clear description of your request. We will respond within the time limit required by applicable law — ten business days under Indonesian Personal Data Protection Law, and one month under the EU General Data Protection Regulation.

Where we have relied on consent as a lawful basis for processing — for example, for the dispatch of marketing newsletters — you may withdraw that consent at any time by clicking the unsubscribe link contained in the email itself, or by replying to the email and asking to be removed. Withdrawing consent will not affect the lawfulness of processing that took place before the withdrawal, and we will continue to process your data where we have an independent legal obligation to do so.

INTERNATIONAL TRANSFERS

Laluvirtual operates infrastructure in multiple countries to serve a global client base. Your data may be processed on servers located in Indonesia, Singapore, the Netherlands, the United States, and other jurisdictions where we maintain hosting nodes. Where data is transferred from a jurisdiction with strong data protection law to a jurisdiction with weaker protection, we rely on appropriate safeguards such as standard contractual clauses, binding corporate rules where applicable, or an recognized certification framework. We also monitor active legal challenges to these mechanisms and will adjust our transfer mechanisms to maintain compliance.

If you would prefer that your data not leave a particular jurisdiction — for example because you are subject to a residency requirement or a sectoral regulation — we can accommodate this through our regional hosting plans. Select the appropriate region at sign-up or contact support to migrate an existing account. Note that some metadata, such as billing records and abuse-handling correspondence, may still need to be accessible from our headquarters in Yogyakarta regardless of where the primary data is stored.

SECURITY MEASURES

We protect your data with layered technical and organizational measures: TLS 1.3 for data in transit, AES-256 at rest, per-customer isolation on NVMe-backed storage, mandatory multi-factor authentication for staff access to production systems, role-based authorization enforced at the application layer, and a bug bounty program for responsible disclosure. Internal access follows a strict need-to-know model, and access to customer source code or databases is logged and reviewed monthly. We maintain an incident response plan and commit to notifying affected customers of confirmed security incidents without undue delay, and in any case within seventy-two hours of confirmation where required by law.

Despite our best efforts, no system can be guaranteed to be perfectly secure. We therefore recommend that you maintain your own encrypted backups of source code and databases, that you use strong and unique passwords, and that you enable multi-factor authentication on your client portal account. If you become aware of a security issue affecting Laluvirtual services, please report it promptly to [email protected] — we will acknowledge receipt within one business day and work with you to validate and remediate the issue.

CHANGES TO THIS NOTICE

We may update this Privacy Notice from time to time to reflect changes in our practices, our services, or applicable law. When we make material changes — for example the introduction of a new category of data processing, a new sub-processor in a new jurisdiction, or a change to your rights — we will notify you by email to the primary address on file at least thirty days before the change takes effect, and we will maintain an archived version of each prior notice on this page for your reference. The effective date displayed above reflects the most recent revision.

If you do not agree with a proposed change, you may close your account before the effective date and we will action the deletion of your data under the retention schedule described in section 04. Continued use of the services after the effective date constitutes acceptance of the updated notice, to the extent permitted by applicable law. For any questions about a specific revision, contact [email protected] and we will be happy to walk you through what changed and why.