Privacy Policy

This policy explains what personal data Galuh Dwi Pranoto ("I", "me") collects on galuhdwipranoto.com, why, and what rights you have. It applies to visitors in the European Union, the UK and Switzerland under the GDPR, and to visitors in Indonesia under Law No. 27 of 2022 on Personal Data Protection (UU PDP).

Who is responsible

The controller of your personal data is Galuh Dwi Pranoto. You can reach me at [email protected] for any privacy question or request.

Data you give me

When you send the project brief or the contact form, I store:

• your name, email address, company, website address and country;
• the details you choose to share (services, budget range, timeline, message);
• whether you agreed to the privacy notice and, separately, to receive occasional emails;
• the page you came from and campaign parameters (UTM) in the link you used.

I use this data only to reply to you, prepare a proposal and manage our work together. The legal basis is steps taken at your request before entering into a contract (GDPR Art. 6(1)(b)) and, for emails you opted into, your consent (Art. 6(1)(a)).

Form submissions are processed in my own CRM on a server I operate. An automation tool (n8n, self-hosted) may summarise and prioritise new enquiries and notify me by email or WhatsApp. No enquiry is sold or shared for marketing.

Spam protection

Forms are protected by Cloudflare Turnstile, which checks whether a request comes from a person. Turnstile processes technical data such as your IP address and browser characteristics. I also store a one-way hash of your IP address with your submission to limit abuse.

Analytics and cookies

With your consent (where consent is required), this site uses:

• Google Analytics 4 to measure visits and which pages lead to enquiries. Google Consent Mode is used: until you agree, Google receives only cookieless signals.
• Microsoft Clarity to understand how pages are used (scrolling, clicks). Clarity only loads after you agree to analytics.
• Google AdSense on blog articles, once advertising is enabled, to show ads. With your consent Google may use cookies to personalise ads. You can manage ad personalisation at Google Ads Settings.

Visitors in the EEA, the UK and Switzerland see a consent banner and can change their choice at any time with "Cookie settings" in the footer. Details of each cookie are in the Cookie Policy.

How long data is kept

Enquiries and related CRM records are deleted or anonymised 24 months after our last contact, unless we work together and longer retention is required for accounting. Analytics data is kept according to the retention settings of the respective tools (14 months for Google Analytics).

Where data is processed

The site and CRM run on a virtual server rented from a hosting provider. Google, Microsoft and Cloudflare may process data outside your country, including in the United States; they rely on the EU Standard Contractual Clauses and the EU-US Data Privacy Framework where applicable.

Your rights

You can ask for access to your data, correction, deletion, restriction, a copy in a portable format, or object to processing. Where processing is based on consent, you can withdraw it at any time. Under UU PDP you have comparable rights, including to access, correct and delete your data and to withdraw consent.

Send requests to [email protected]. If you are in the EU, you can also complain to your local data protection authority.

Changes

I will update this page when the site or the tools it uses change. The date at the top shows the latest version.