Privacy Policy

This Privacy Policy applies to personal data processed through our website at salviora.co and its subpages (the "Site"), and through communications you start with us, such as the free initial assessment form and emails to our published addresses.

It does not cover the VioraONE and VioraGO products, which are offered on their own sites (vioraone.salviora.co and viorago.salviora.co) under their own privacy policies. It also does not cover personal data we process on behalf of clients under a services agreement; that processing is governed by the agreement with the client concerned.

The data controller for the Site is PT Salviora Synapse Ultima ("Salviora", "we", "us"), a limited liability company established under the laws of the Republic of Indonesia, with its office at Gedung Wirausaha Lt.1 unit 104, Jl. H.R Rasuna Said Kav C-5, Karet Setiabudi, Jakarta 12920, Indonesia.

For any question about this policy or your personal data, contact us at hello@salviora.co with the subject line "Personal data".

Data you provide

When you submit the assessment form or write to us, we collect:

• Full name
• Company name
• Work email address
• Phone number, if you choose to provide it
• The contents of your message, such as the number of sites and users, your current vendor and the issues you describe
• Any further information you share during follow-up calls, meetings or site visits

Data collected automatically

When you visit the Site, our hosting provider records technical data needed to deliver and secure it: IP address, browser and device type, operating system, pages requested, referring page, and the date and time of each request. We use this data in aggregate and for security purposes, and do not use it to build profiles of individual visitors.

Data stored on your device

The Site stores your language preference (English or Bahasa Indonesia) in your browser's local storage so the Site opens in the same language next time. This value stays on your device and is not used for tracking. The Site does not currently use advertising or analytics cookies.

Specific personal data

We do not ask for, and ask you not to send through the Site, specific personal data as defined in the PDP Law, such as health data, biometric or genetic data, criminal records, children's data or personal financial data.

We process personal data only for the following purposes, each on a lawful basis under Article 20 of the PDP Law:

• Responding to your request, scheduling and carrying out the initial assessment, and preparing proposals. Basis: steps taken at your request before entering into an agreement, and performance of the agreement once one exists.
• Communicating with you about your request and our services, including follow-up after the assessment. Basis: our legitimate interest in responding to business enquiries. We will send marketing communications unrelated to your request only with your consent, which you may withdraw at any time.
• Operating, maintaining and securing the Site, including preventing spam, abuse and fraud. Basis: our legitimate interest in keeping the Site available and secure.
• Complying with legal obligations, such as tax and accounting record-keeping, and responding to lawful requests from authorities. Basis: legal obligation.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.

We do not sell or rent personal data. We share it only as needed for the purposes above, with:

• Service providers that process data on our behalf under written agreements, including our website hosting provider, our transactional email provider (used to deliver form submissions and confirmation emails) and our business email provider.
• Google, when you view the embedded map on the Site. Loading the map sends your IP address and browser data to Google, which processes it under its own privacy policy.
• Professional advisers, such as lawyers, auditors and accountants, who are bound by a duty of confidentiality.
• Government authorities, courts or law enforcement, where the law requires it or where needed to protect our legal rights.
• A successor entity in the event of a merger, acquisition or transfer of all or part of our business, subject to this policy and with notice to you as required by the PDP Law.

Some of our service providers store or process data on servers outside Indonesia. When personal data is transferred abroad, we do so in accordance with Article 56 of the PDP Law: to a country with an equal or higher level of personal data protection, or with adequate and binding safeguards in place, or otherwise with your consent.

• Enquiry and assessment data: up to 24 months after our last contact with you if no agreement is concluded, so we can answer follow-up questions.
• Client and contract data: for the duration of the agreement and afterwards for as long as required by applicable law, including company document retention obligations.
• Server and security logs: up to 90 days, unless needed longer to investigate a security incident.

When the retention period ends, we delete or anonymise the data.

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit (HTTPS/TLS), access limited to personnel who need it, multi-factor authentication on our accounts, and service providers bound by confidentiality and security obligations.

No method of transmission or storage is completely secure. If a personal data breach occurs, we will notify affected individuals and the relevant authority in writing in accordance with the PDP Law, including within 3 x 24 hours where the PDP Law requires it.

Under the PDP Law, you have the right to:

• Obtain information about the identity of the controller, the legal basis and purpose of the processing, and our accountability
• Access and obtain a copy of your personal data
• Correct or update data that is inaccurate or incomplete
• Have your personal data deleted or destroyed
• Withdraw consent you have given, without affecting processing carried out before the withdrawal
• Object to decisions based solely on automated processing, including profiling
• Delay or restrict the processing of your personal data
• Obtain and transfer your personal data in a commonly used, machine-readable format
• File a complaint and claim compensation for violations of the PDP Law

To exercise any of these rights, email hello@salviora.co with the subject line "Personal data request". We may ask you to verify your identity before acting on the request, and will respond within the time limits set by the PDP Law. Some rights may be limited where the law allows, for example where we must keep data to meet a legal obligation.

The Site links to other websites, including VioraONE, VioraGO and Google Maps. Their operators are responsible for their own privacy practices. Please read their policies before giving them personal data.

The Site is intended for businesses and their representatives. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, contact us and we will delete it.

We may update this policy when our practices or the law change, for example if we introduce analytics on the Site. The effective date at the top of this page shows when it was last revised. Where a change materially affects how we use personal data you have already given us, we will notify you by email or through the Site.

PT Salviora Synapse Ultima, Gedung Wirausaha Lt.1 unit 104, Jl. H.R Rasuna Said Kav C-5, Karet Setiabudi, Jakarta 12920, Indonesia. Email: hello@salviora.co.

This policy is available in English and Bahasa Indonesia. In the event of any inconsistency, the Bahasa Indonesia version prevails.