·Legal · Privacy Notice

Privacy Notice.

How PT AltEsc Solusi Indonesia collects, uses, stores, and protects your personal data, aligned with Indonesia's UU PDP No. 27/2022 and applicable international standards.

Last updated · 6 May 2026 · Version 1.0

1. Who we are

The data controller is PT AltEsc Solusi Indonesia ("AltEsc," "we," "us"), an Indonesian limited liability company with registered office at RSG, 3rd Floor, 405 E, Pertokoan Graha Niaga Sanur, Jl. Bypass Ngurah Rai No. 4, Sanur Kauh, Denpasar 80221, Bali, Indonesia. We operate the website at altesc.com and provide compliance, platform management, concierge, and capital services for hospitality assets in Bali.

For all privacy matters, the contact channel is hello@altesc.com.

2. Data we collect

We collect only what we need to respond to your enquiry or perform a service you have engaged us for.

From you, when you submit a form or contact us

• Identity: full name, organisation (where given)
• Contact: email address, WhatsApp or phone number
• Asset / enquiry details: villa location, current status, capital ticket size, project type, only the fields you complete
• Free-text message content

When you submit a form, we send you a confirmation email at the address you provided so you have a written acknowledgement that your enquiry reached us. The email is sent on AltEsc's behalf by our email-delivery processor (Resend, see section 5) from the address hello@altesc.com; we do not use it for marketing.

Automatically, when you visit the site

• IP address, user-agent, request timestamp (server / CDN logs via Cloudflare)
• Approximate geographic region (country / city level)
• Pages visited and HTTP referrer

From third parties

• If a partner refers you, we may receive an attribution token (the altesc_ref cookie described in section 8) so we can correctly credit the referral.

We do not collect special-category data (health, biometric, religious, political) and we do not ask for it on any form.

3. Why we use it

1. To respond to your enquiry and continue the conversation through email, WhatsApp, or phone.
2. To assess fit, prepare a proposal, or onboard you as a client, partner, or capital partner.
3. To comply with legal obligations including, where applicable, anti-money-laundering (PPATK / OJK frameworks), tax (DJP), and corporate record-keeping under Indonesian company law.
4. To detect and prevent fraud, abuse, or unauthorised use of the site.
5. To improve the website's reliability and user experience based on aggregate usage patterns.

We do not use your data for advertising, profiling, automated decision-making with legal effect, or sale to third parties. Ever.

4. Legal basis (UU PDP)

Under Indonesia's Undang-Undang No. 27 Tahun 2022 tentang Pelindungan Data Pribadi (UU PDP), we process personal data on the following grounds:

• Consent, when you submit a form or initiate contact, you consent to our processing of the data you have provided for the stated purpose.
• Contract, to take steps prior to entering into, or to perform, a contract with you.
• Legal obligation, where Indonesian law (tax, AML, corporate record-keeping) requires us to retain or disclose data.
• Legitimate interest, to operate, secure, and improve our services in a way that does not override your rights and freedoms.

5. Sharing & processors

We do not sell or rent personal data. We share it only with the following categories of recipients, and only when needed:

• Form handling: form submissions are processed by a Cloudflare Worker that we operate, hosted on Cloudflare infrastructure. The submission data is held only in transit; it is not stored on a third-party form dashboard.
• Email delivery: Resend (Resend Inc., United States) delivers the auto-reply we send you and the internal notification we send to ourselves. Your email address and the contents of your enquiry pass through Resend's infrastructure for delivery. Resend privacy policy.
• Hosting / CDN / DNS / email routing: Cloudflare, Inc. (United States) hosts the website, runs the Worker that handles form submissions, provides CDN and DNS, and routes incoming mail addressed to hello@altesc.com to our team mailbox. Cloudflare privacy policy.
• Communications: WhatsApp (Meta Platforms Ireland) when you contact us via the WhatsApp number; standard Meta data practices apply.
• Professional advisors: Indonesian counsel (Notaris/PPAT, IFLR1000-ranked counsel) and tax advisors, where engagement on your matter requires it, under professional-confidentiality obligations.
• Indonesian regulators / authorities: on lawful request, DJP (tax), OJK / PPATK (financial / AML), KADIN, BKPM, or competent courts.
• Acquirer in a corporate event: in the unlikely event of a merger, acquisition, or asset sale of AltEsc, personal data may transfer as part of the deal under equivalent protections.

6. International transfer

Some processors named above (Resend, Cloudflare, WhatsApp/Meta) are based outside Indonesia, primarily in the United States and European Union. Where personal data is transferred outside Indonesia, we rely on the receiving party's contractual commitments and the legal-basis grounds in section 4. You may request details of the safeguards in place by contacting hello@altesc.com.

7. Retention

• Enquiry data (form submissions, emails), kept for up to 24 months from last contact, then deleted, unless a commercial relationship continues.
• Client data, kept for the duration of the engagement plus 10 years after termination, to comply with Indonesian tax and corporate record-keeping requirements.
• Capital partner / LP data, kept for the duration of the SPV plus 10 years after final wind-up, for AML and audit compliance.
• Server / CDN logs, typically 30–90 days, then aggregated or deleted.
• Marketing or follow-up consent, until you withdraw it.

8. Cookies & local storage

We use the minimum cookies and local-storage entries needed for the site to function. We do not run advertising trackers, pixels, fingerprinting scripts, or third-party analytics.

• altesc_ref (cookie), set when you arrive via a referral link with a ?ref= parameter, used to correctly attribute the partner. Lifetime: 30 days. Strictly necessary for the partner program.
• ck (browser localStorage entry), records your acknowledgement of the cookie banner so we don't show it again. Stored locally in your browser; not transmitted to us.

Server / CDN logs (Cloudflare) are required for security, abuse prevention, and operational reliability, and operate independently of cookies.

9. Security

We protect personal data using industry-standard measures: HTTPS/TLS in transit, access controls on stored data, principle of least privilege among the founding team, and encryption at rest where the underlying processor (Resend, Cloudflare) supports it. No system is perfectly secure; if we become aware of a personal-data breach affecting your data, we will notify you and the relevant Indonesian authority within the timelines required by UU PDP.

10. Your rights

Under UU PDP and applicable international law, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete data, subject to retention obligations in section 7
• Restrict or object to certain processing
• Withdraw consent at any time, without affecting the lawfulness of prior processing
• Receive a copy of your data in a portable format
• Lodge a complaint with the Indonesian data protection authority

To exercise any right, email hello@altesc.com with the request and we will respond within 14 calendar days, or sooner where the law requires it.

11. Contact & complaints

If you are unsatisfied with our response, you may lodge a complaint with the Indonesian data protection authority designated under UU PDP, or, where you are based outside Indonesia, with your local data protection regulator.

12. Changes to this notice

We may update this notice as our services or the law evolves. The version and last-updated date at the top of this page reflect the current iteration. Material changes will be communicated to active clients and capital partners directly; for general visitors, the notice on this page is authoritative.

See also: Terms of Use