BatamWebHosting
Legal

Privacy Policy

What data we collect, why, who we share it with, and your rights over it.

Last updated: 1 October 2026

1. Data controller

The personal data controller is CV BATAM IDEA TEKNOLOGI (BatamWebHosting), Citramas Indah Blok A, Batu Besar, Nongsa, Kota Batam, Kepulauan Riau 29431, Indonesia. This policy is prepared with reference to Law No. 27 of 2022 on Personal Data Protection (the PDP Law).

2. Data we collect

  • Identity and contact: name, company, email, phone number, address.
  • Billing data: invoice and payment details. Card data is processed by the payment provider and is not stored by us.
  • Domain contact data: registrant, administrative, and technical contact data required to register domains.
  • Communications: support messages, tickets, WhatsApp, and email.
  • Technical data: server and application logs, including IP address.
  • Analytics usage data: pages viewed, domain-name searches, plan and WhatsApp clicks, successful quote submissions, browser/device category, and approximate location. Names, email addresses, phone numbers, messages, and quote-form contents are not sent to Google Analytics.
  • Transaction data for conversion measurement: invoice number, total value, and currency (IDR).

3. Purposes and legal basis

We process data for the following purposes, on the appropriate legal basis:

  • Providing the services and handling orders, payments, and renewals (basis: contract).
  • Registering and managing domains under registry rules (basis: contract and legal obligation).
  • Meeting tax and accounting obligations and valid requests from authorities (basis: legal obligation).
  • Security, abuse prevention, and improving our services (basis: legitimate interest).
  • Contacting you about the service, renewal reminders, and support (basis: contract and legitimate interest).
  • Measuring site usage and ad conversions through Google Analytics 4 and Google Ads to evaluate marketing (basis: legitimate interest; consent where required).
  • Anything else that requires your consent, which we will ask for separately (basis: consent).

4. Sharing

We do not sell your personal data. We share it only as needed with:

  • domain registries and registrars: PANDI, ResellerClub, and SRS-X;
  • the upstream hosting and VPS providers that run your service;
  • payment processors (payment gateway and banks);
  • Google for Google Analytics 4 and Google Ads conversion measurement;
  • competent authorities where required by law.

5. Domain WHOIS/RDAP

Registering a domain involves registrant contact data held by the registry. Some of it may appear in public WHOIS/RDAP according to each registry’s rules; many registries now redact some personal data by default. Whether redaction is available depends on the domain extension and the registry’s policy.

6. Retention

We keep data while your account is active, and afterwards for as long as tax and accounting law requires. After that it is deleted or anonymised.

7. Security

We apply reasonable safeguards, including access limited to personnel who need it, encrypted connections (HTTPS) on the site and client area, and regular system updates. No system is completely secure; if a personal data protection failure occurs, we will follow up and notify the relevant parties as required by applicable rules.

8. Your rights

Under the PDP Law, you have the right to:

  • access your personal data and obtain a copy;
  • correct inaccurate data;
  • request deletion of your data, where this does not conflict with our legal obligations;
  • object to certain processing;
  • withdraw consent you have given.

9. Cookies, analytics, and conversion measurement

The client area and billing system use essential cookies needed for login sessions to work. The marketing site and billing system also use Google Analytics 4 (GA4), which may set first-party analytics cookies on both domains to distinguish browsers and sessions. Cross-domain linking helps measure navigation from the marketing site to billing.

GA4 receives page and general activity data—including the domain name searched, plan selections, WhatsApp clicks as a channel, and successful quote submissions—plus browser/device category and approximate location. Quote-form contents (name, email, phone number, and message) are not sent to GA4. Invoice measurement events include the invoice number, total value, and IDR currency. The purchase event fires when a newly created, unpaid invoice page is viewed within 30 minutes of creation; it records invoice creation, not successful payment. GA4 is linked to Google Ads for conversion measurement and attribution. GA4 event-data retention is set to 14 months; the reset-on-new-activity option is enabled and extends retention only for user-level data.

You can reject or delete cookies in your browser settings. You can also use the Google Analytics opt-out add-on and manage Google ad personalisation. Blocking cookies may affect client-area login sessions.

10. International transfers

Our hosting and VPS servers are outside Indonesia, international domain registrars are located abroad, and Google may process analytics/conversion data in data centres outside Indonesia. Your data may therefore be processed outside Indonesia. We only work with providers that apply adequate data protection.

11. Privacy requests

To exercise your rights or ask about this policy, email andhika@batamwebhosting.com from the email address registered on your account. We may ask to verify your identity and will respond within a reasonable time.

12. Changes

We may update this policy. The latest version is always available on this page with its update date.

This page is available in Indonesian and English. The English version is a translation; if there is any difference, the Indonesian version prevails.