Draft dated 20 October 2026. This notice is not yet in force. Text marked [LEGAL REVIEW] must be checked by a qualified legal adviser before publication.
1. Who we are
This website is operated by PT. Nusa Rendra Jayatama, trading as Nusa Safety ("we", "us"). For the personal data described in this notice we act as the personal data controller within the meaning of Law No. 27 of 2022 on Personal Data Protection (UU 27/2022).
Head office: Jl. Imam Bonjol 36 RT 03/01 Kudaile, Slawi, Tegal, Central Java, Indonesia.
Privacy contact: admin@nusasafety.co.id
[LEGAL REVIEW: confirm whether a data protection officer must be appointed under UU 27/2022 Article 53 and, if so, add the officer's contact details.]
2. What this notice covers
This notice explains how we handle personal data collected through nusasafety.co.id, including the contact form, the customer survey, and the AI assistant. It does not cover data we process when delivering a contracted service. That processing is described in the contract or a separate notice.
3. Personal data we collect
3.1 Contact form
Name, company, email address, phone number, the service you are interested in, and the content of your message.
3.2 Customer survey
Name, job title or role, company, email address, phone number, the service you used and when, your ratings and comments, your likelihood to recommend us, and your choices on whether we may quote you as a testimonial and whether we may contact you to follow up.
3.3 AI assistant
When you use the AI assistant, we collect the messages you type, the replies generated, and basic technical information about the session, such as time and the page you were on.
Contact details are handled separately. If you choose to leave your name, company, email, or phone number so that we can follow up, these are entered in a separate form field, stored on our own systems, and are not sent to the AI model. Please do not type contact details or other personal data into the chat itself. If you do, that text will be sent to the AI provider as part of the conversation.
3.4 WhatsApp and email
If you contact us through a WhatsApp link or by email, we receive the data you choose to send, such as your name, number, and message. WhatsApp conversations are also subject to the terms and privacy policy of WhatsApp.
3.5 Technical data and cookies
Our server records technical data needed to run and secure the site, such as IP address, browser type, requested pages, and time of access. The site uses a small number of cookies, for example to remember your language choice and to keep administrators signed in. We do not use advertising cookies.
Our pages load fonts from Google Fonts. When a page loads, your browser connects to Google servers, which receive your IP address and browser information.
[LEGAL REVIEW: confirm the final list of cookies and analytics tools after the technical team completes its work, including whether Google Analytics or Search Console tags will be added, and whether a separate cookie notice is needed.]
3.6 Data we do not seek
We do not ask for specific personal data as defined in UU 27/2022 Article 4(2), such as health data, biometric data, or financial data, through this website. Please do not send such data through the forms or the AI assistant.
4. Why we use personal data
1. To reply to your enquiry and prepare a proposal or quotation you asked for.
2. To deliver and follow up services you have engaged us for.
3. To understand and improve our services, using survey results.
4. To publish your feedback as a testimonial, only where you have given separate consent.
5. To run the AI assistant, so that it can answer general questions and help you describe your needs before we contact you.
6. To keep the website secure, prevent spam and abuse, and keep records required by law.
We do not sell personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.
5. Legal basis for processing
Under UU 27/2022 Article 20 we rely on the following bases:
| Purpose | Basis |
|---|---|
| Replying to enquiries and preparing proposals | Steps taken at your request before entering into a contract, and performance of a contract |
| Delivering contracted services | Performance of a contract |
| Survey responses and follow-up contact | Your consent |
| Publishing a testimonial | Your explicit, separate consent |
| AI assistant conversations | Your consent, given before the chat starts |
| Security, spam prevention, record keeping | Our legitimate interests and compliance with legal obligations |
You may withdraw consent at any time by writing to admin@nusasafety.co.id. Withdrawal does not affect processing carried out before it.
[LEGAL REVIEW: confirm the mapping of each purpose to the bases listed in Article 20(2), and confirm the consent wording and record-keeping required by Articles 22 to 24.]
6. AI assistant and transfer of data outside Indonesia
The AI assistant uses a large language model service provided by Anthropic, PBC, a company based in the United States. The messages you type in the chat are sent to Anthropic's servers outside Indonesia to generate a reply. This is a transfer of personal data outside the jurisdiction of Indonesia within the meaning of UU 27/2022 Article 56, to the extent that your messages contain personal data.
We limit this transfer as follows:
1. Contact details you leave for follow-up are stored on our own systems and are not sent to the model.
2. We ask you not to type personal data into the chat, and the assistant is instructed not to request it.
3. We send only the conversation needed to generate a reply, not your form submissions or survey answers.
4. We use the provider's commercial API service. Under the provider's commercial terms at the time of writing, content sent through that service is not used to train its models.
[LEGAL REVIEW: (a) confirm which Article 56 safeguard applies: equivalent protection in the destination country, an adequate and binding agreement, or the data subject's consent; (b) confirm the current Anthropic commercial terms, data processing addendum, and retention period, and state the retention period here; (c) confirm whether implementing regulations on cross-border transfer have been issued and impose further requirements.]
7. Who we share personal data with
1. Service providers that host and run our website, database, and email, acting on our instructions. [LEGAL REVIEW: owner to confirm the hosting provider and the country where the servers are located, and whether this is a further cross-border transfer.]
2. Anthropic, PBC, for the AI assistant, as described in Section 6.
3. Licensed partners, such as PJK3 training or inspection companies and BNSP-licensed certification bodies (LSP), only when you ask us to enrol you or your staff in a certified programme or to arrange statutory inspection. We tell you which partner will receive the data.
4. Government authorities, courts, or law enforcement, when the law requires it.
8. How long we keep personal data
| Data | Retention |
|---|---|
| Contact form enquiries with no resulting contract | 2 years after our last contact |
| Data relating to a contract | For the contract period and the record-keeping period required by law |
| Survey responses | 3 years after submission |
| Testimonials | Until you withdraw consent, after which we remove the testimonial from the website within a reasonable time |
| AI assistant conversations stored on our systems | 12 months after the conversation |
| Server security logs | 90 days |
After these periods we delete or anonymise the data, unless the law requires us to keep it longer.
[LEGAL REVIEW: owner and legal adviser to confirm each retention period against business needs and UU 27/2022 Articles 42 to 44.]
9. Security
We use reasonable technical and organisational measures to protect personal data, including encrypted connections (HTTPS), restricted administrator access, and limits on what is sent to third parties. No method of transmission or storage is completely secure.
If a personal data breach occurs that affects you, we will notify you and the relevant authority in writing as required by UU 27/2022 Article 46.
[LEGAL REVIEW: confirm the notification deadline (the law refers to 3 x 24 hours) and the authority to be notified once the personal data protection agency is operating.]
10. Your rights
Subject to the conditions in UU 27/2022, you have the right to:
1. Obtain information about who is processing your data, why, and on what basis.
2. Complete, update, or correct inaccurate data.
3. Access and obtain a copy of your data.
4. End processing and ask us to delete or destroy your data.
5. Withdraw consent you have given.
6. Object to decisions based solely on automated processing that significantly affect you.
7. Delay or restrict processing.
8. Claim compensation for a breach of the law in processing your data.
9. Obtain and use your data in a commonly used, machine-readable format, and ask that it be sent to another controller.
To use any of these rights, write to admin@nusasafety.co.id with your name and the request. We may ask you to confirm your identity. We will respond within the time limits set by UU 27/2022.
[LEGAL REVIEW: confirm the list against Articles 5 to 13 and the exceptions in Article 15, and confirm the response deadlines in Articles 32 to 41.]
11. Children
This website is intended for business users. We do not knowingly collect personal data from children. If you believe a child has sent us personal data, please contact us and we will delete it.
12. Changes to this notice
We may update this notice when our services, tools, or the law change. The date at the top shows the latest version. Significant changes will be highlighted on the website.
13. Contact
PT. Nusa Rendra Jayatama (Nusa Safety)
Jl. Imam Bonjol 36 RT 03/01 Kudaile, Slawi, Tegal, Central Java, Indonesia
Email: admin@nusasafety.co.id
If you are not satisfied with our response, you may also contact the authority responsible for personal data protection in Indonesia.
[LEGAL REVIEW: name the competent authority once established under UU 27/2022 Article 58.]
