Privacy policy

This policy explains what personal data Saffron Kite collects, why, who we share it with and what you can ask us to do with it. It applies to saffronkite.com, to our WhatsApp and email conversations, and to the projects we build for clients.

Who we are

Saffron Kite is a web design studio based in Batam, Indonesia. We build websites for small businesses in Indonesia, Singapore, Malaysia and the United States. Saffron Kite decides how your personal data is used for the purposes below, so we are responsible for it (the “organisation”, “data user/controller” or pengendali data pribadi under the laws below).

Email

hello@saffronkite.com

WhatsApp

+62 811-7008-0027

Location

Batam, Riau Islands (Kepulauan Riau), Indonesia

Data Protection Officer

hello@saffronkite.com (subject “Data protection”)

What we collect

• When you contact us by WhatsApp, email or phone: your name, business name, phone or WhatsApp number, email address, city or country, and whatever you choose to send, such as messages, photos, your logo, menu or price list, and links to your Instagram or website.
• When you become a client: the details we need for the project and the invoice, such as the name and address to put on the invoice, the content for your website, and the details needed to register your domain in your name.
• When you pay: payment is handled by your bank or the payment provider. We receive a confirmation (amount, date, method, status), never your full card number or banking password.
• Business contact details that are already public: we sometimes contact a business first, using contact details the business has published (for example on Google Maps, Instagram or its website), to introduce our services or offer a free mockup.

We don’t ask for NRIC, MyKad, Social Security or other identity numbers, card numbers or health information. Please don’t send them to us. Our services are for businesses and are not directed at children; we don’t knowingly collect personal data from children under 13.

Website statistics and cookies

We count visits with our own simple statistics tool, not Google Analytics or advertising pixels. For each page view it records: the page address, the website you came from (domain only), your country (worked out by our host from your IP address), whether you use a phone or a computer, and a visitor code. The visitor code is a one-way hash of your IP address, browser identifier and the date, so it changes every day. We don’t store your IP address, we don’t use cookies for statistics, and we can’t follow you from one day to the next or across other websites.

• Cookies: we set one functional cookie, sk_region, only if you choose to view all regions (a link ending in ?region=all). It lasts 30 days and stops us sending you to your country’s page. We use no advertising or tracking cookies, so there is no cookie banner.
• Opt out of statistics: open any page with ?nostat at the end of the address (for example saffronkite.com/?nostat). Your browser then stores a small note (sk_nostat) on your device and your visits are no longer counted.
• Fonts: our pages load fonts from Google Fonts, so your browser connects to Google’s servers, which receive your IP address and browser details to deliver the fonts.
• Sample sites: the forms and carts on our sample (demo) websites don’t send anything to us. They only open WhatsApp or show a demo message; the cart and language choice stay in your own browser.

Why we use it

• To reply to your enquiry and prepare a free mockup and a quote (based on your request).
• To build, launch and look after your website, register your domain in your name, and send invoices and receipts (to perform our agreement with you).
• To keep accounting and tax records and meet other legal obligations.
• To keep our website working and secure and to understand, in aggregate, which pages are useful (our legitimate interests, using statistics that can’t identify you).
• To introduce our services to businesses, using published business contact details. We don’t send newsletters or bulk marketing. Reply “STOP” or email us, and we won’t send you marketing again.

Giving us your details is voluntary. Without a way to contact you, though, we can’t reply to you or deliver a project. We only use your data for these purposes or for a new purpose we tell you about first and, where needed, ask your consent for.

Who we share it with

We don’t sell or rent personal data, and we don’t share it for advertising. We share it only with the service providers we need, and only what they need:

• Cloudflare: hosts our website and our statistics database, protects it from attacks, and forwards email sent to our address.
• WhatsApp (Meta): if you message us on WhatsApp, your messages go through WhatsApp under its own privacy policy.
• Our email provider: stores the emails you send us.
• Payments: Midtrans (Indonesia) for invoices in Indonesian rupiah; PayPal if you choose to pay by card or PayPal; and the banks involved in a bank transfer.
• Domain registrars and registries: when we register a domain in your name, your registrant details go to the registrar and the registry (for example SGNIC for .sg or MYNIC for .my), under their own rules.
• Professional advisers and authorities: an accountant or lawyer when needed, and a government authority or court when the law requires it.

Data outside your country

We work from Indonesia, and our providers run servers in several countries, including the United States and Singapore. So your data may be transferred to and stored outside your country. We use established providers with security commitments and take reasonable steps to make sure your data gets a standard of protection comparable to the law of the country it came from.

How long we keep it

• Enquiries that don’t become a project: we delete them within 12 months of our last contact.
• Client projects, invoices and payment records: for as long as we work together, then for 10 years, because Indonesian tax law requires us to keep bookkeeping records that long. Website files we no longer need are deleted.
• Statistics: kept for long-term trends; they can’t identify you.

Security

Our website runs only over HTTPS. Access to client data is limited to the people who work on your project, our accounts are password-protected, and we use providers with strong security. No system is perfectly secure. If a data breach affects you, we will tell you and the relevant authority as the law requires, including within 3 × 24 hours where the Indonesian PDP Law requires it.

Your rights

Depending on where you live, you can ask us to:

• tell you what personal data we hold about you, how we use it and who we share it with, and give you a copy;
• correct or complete it;
• delete it, or stop or limit how we use it;
• withdraw your consent, or stop marketing messages;
• give you your data in a common electronic format to take elsewhere (portability).

Email hello@saffronkite.com or message us on WhatsApp. We may ask you to confirm who you are. We reply as soon as possible and within the time limit set by the law that applies to you. Requests are free, unless the law allows a reasonable fee for a large request, and we will tell you before charging anything. If you’re not happy with our answer, you can complain to your data protection authority (listed below).

Singapore, Malaysia, United States, Indonesia

Singapore: Personal Data Protection Act 2012 (PDPA)

Our Data Protection Officer can be reached at hello@saffronkite.com (subject “Data protection”). You can withdraw consent at any time by telling us; we will explain what that means for any ongoing project. If you’re not satisfied with our reply, you can contact the Personal Data Protection Commission (PDPC) at pdpc.gov.sg.

Malaysia: Personal Data Protection Act 2010 (notice)

This notice is available in English and in Bahasa Melayu. It explains the personal data we process, the purposes, where it comes from (from you, or from business details you have published), the third parties we disclose it to, your right to access and correct it, and how to limit its processing, including stopping direct marketing. Giving us your data is voluntary; without contact details we can’t reply to you or deliver a project. Questions and complaints: hello@saffronkite.com. You may also contact the Personal Data Protection Commissioner (JPDP) at pdp.gov.my.

United States: California Online Privacy Protection Act (CalOPPA)

The categories of personal information we collect and the third parties we share it with are listed above. You can review and correct your information by emailing hello@saffronkite.com. We don’t sell or share personal information for cross-context behavioural advertising.

Do Not Track: our website does not respond differently to “Do Not Track” browser signals, because we don’t track visitors over time or across other websites. We don’t allow third parties to collect personal information about your online activities over time and across websites through our site; the only third-party content our pages load is fonts from Google Fonts.

Indonesia: Personal Data Protection Law (UU No. 27 Tahun 2022)

Saffron Kite is based in Indonesia, so the PDP Law applies to everything in this policy. We rely on your consent, on performing a contract with you (or steps you ask for before one), on our legal obligations, and on our legitimate interests weighed against your rights. Your rights include information, access and a copy, correction, deletion, withdrawing consent, objecting to decisions made only by automated processing, delaying or limiting processing, portability and, where the law provides, compensation. You can complain to the Indonesian personal data protection authority.

Data on websites we build for clients

When we build or look after a website for a client, the client decides what data their site collects (for example an order, booking or enquiry form) and is responsible for it under the law. We handle that data only to provide our services to the client, keep it secure, don’t keep it longer than needed, and tell the client promptly if a data breach happens. If you are a customer of one of our clients, please contact that business first.

Changes and contact

We may update this policy when our services or the law change. The date at the top always shows the latest version. If we make a significant change, we will tell current clients by email or WhatsApp.

Questions or requests: hello@saffronkite.com · WhatsApp +62 811-7008-0027 · Saffron Kite, Batam, Indonesia.