Who we are and scope

This Policy does not replace any applicable confidentiality agreement, service contract, or specific privacy notice. Where we process data on a customer's instructions, each party's responsibilities follow its actual processing role, the relevant agreement, and applicable law. Websites or platforms operated by others have their own policies.

Data we receive

• Contact and business relationship information: your name, email address, telephone number, company or organization name, and job title if you provide it.
• Service requirement information: project descriptions, site locations, consultancy or technology needs, the identity of the person in charge, and supporting documents you submit. Technical information constitutes personal data where it contains or can be linked to an individual's identity.
• Interaction records: inquiries, responses, quotation follow-ups, complaints, and communication preferences relevant to your relationship with us.
• Technical website usage data, to the extent processed by the systems in use: IP address, device or browser type, access times, pages visited, referring pages, performance measurements, and error or security logs. Cookies may also store session, language, and time-zone preferences. The Cookies section describes the relevant technologies.

We generally receive data from you. Your organization or colleagues may also provide contact details to coordinate services for a lawful purpose. Anyone providing such data must have the appropriate authority and basis to do so. We do not request unnecessary sensitive data through general inquiry forms; please limit submitted documents to what your request requires.

Purposes and lawful bases for processing

We determine the basis for processing for each purpose. Consent is not the only basis, and visiting the website does not, by itself, constitute consent.

• Responding to inquiries and preparing quotations: to take steps at your request before entering into an agreement where you will be a party to it; or on the basis of legitimate interests in business communications where you represent an organization, taking account of the necessity of processing and your rights.
• Delivering and administering agreed services: where necessary to perform an agreement to which you are a party, or on the basis of legitimate interests in coordinating with customer representatives. Processing required by law is based on the relevant legal obligation.
• Maintaining website security and reliability, preventing misuse, and resolving technical issues: on the basis of legitimate interests assessed proportionately and without overriding your rights.
• Sending promotions, newsletters, or marketing invitations to events: on the basis of separate consent that you may withdraw. Making a service inquiry does not automatically add you to a marketing list.
• Handling personal data rights requests, administrative obligations, or requests from competent authorities: on the basis of legal obligations. Handling legal claims relies on an appropriate basis and is limited to what is relevant and necessary.

If a new purpose is incompatible with the original purpose, we will first provide notice and establish a lawful basis for processing. Where consent is required, we will request it separately. Fields that are required for a particular request will be identified; without that information, we may be unable to follow up on your request.

Who may receive data

Internal access is restricted to personnel who need the data for their duties. Outside the company, limited data may be received by hosting providers, website administrators, communication or administrative system providers, and delivery partners actually involved in your services. Recipients acting on our instructions must follow those instructions, maintain confidentiality, and apply appropriate safeguards.

Odoo (website platform and hosting): Odoo hosts our website and database and supports sessions, preferences, and contact forms. Odoo and its relevant service providers may process submitted contact details, inquiries, technical records, and backups to provide the service under the applicable agreements and safeguards.

Microsoft 365 (company email): Microsoft processes sender and recipient details, messages, attachments, and delivery or security information to send, receive, and store our company email. Website forms may first be processed through Odoo before reaching our Microsoft 365 mailboxes; the delivery route can involve both services.
Cloudflare: the website uses Cloudflare infrastructure and a Cloudflare Real User Monitoring (RUM) beacon. Cloudflare handles technical request information for delivery and protection of the website; the beacon measures page performance, such as loading times and referring pages. The RUM beacon does not use cookies, browser storage, or device fingerprinting to identify individual visitors.

Google Analytics 4: a Google tag is configured for website usage measurement. When analytics processing is enabled, Google may receive page and event information, browser or device information, and analytics identifiers. Analytics is separate from the session functions needed to operate the website and is subject to the choices described below.

Ganeca's relationship with companies within Ganeca Group does not mean that your data is automatically shared throughout the group. Disclosure to PT Akalab Mahardika Indonesia or other affiliates takes place only where necessary for a stated purpose, supported by a lawful basis, and limited to relevant data. Separate consent will be requested where required, including for marketing by another entity.

We do not sell your personal data. We may also disclose data to meet a legal obligation or a lawful request from a competent authority, after checking the authority and scope of the request.

Confidentiality of project and customer information

Environmental documents, designs, monitoring data, site locations, and customers' commercial information may be confidential even where they are not personal data. Their confidentiality is governed by the relevant service or confidentiality agreement. Submitting documents for consultation does not, by itself, authorize us to publish them as portfolio or marketing material.

Cookies and similar technologies

Cookies are small files or identifiers used by a website to support particular functions. Essential technologies may be needed to operate features you request and keep sessions secure. Analytics, advertising, and third-party tracking technologies should not be treated as essential functions merely because they are used on a website.

The following cookie information describes the Odoo website reviewed on 28 August 2026. First-party cookies are associated with the website hostname you visit. Expiry may be renewed when a cookie is set again; the actual expiry can be checked in your browser.

You can view, delete, or block cookies through your browser's privacy settings. Blocking session cookies may prevent requested functions from working. A language or time-zone preference is not an advertising identifier. Cloudflare's RUM beacon operates without cookies, so blocking cookies does not necessarily stop that performance measurement. Contact us using the details below for questions or applicable data rights requests.

Where nonessential analytics or tracking requires consent, we will request it before the relevant processing begins and provide a way to refuse or withdraw that choice. Visiting the website or continuing to browse is not consent. A cookie consent control applies only to the services it actually manages; browser controls and consent controls may have different effects.

Processing and retention periods

Processing begins when data is received for a stated purpose and ends when that purpose has been fulfilled or the basis for processing no longer applies. Retention is limited by the categories below; keeping data does not mean that it continues to be used for every purpose.

• Inquiries and quotations that do not result in a contract: up to 24 months from the last substantive interaction or closure of the request, unless a shorter period is appropriate.
• Customer contact details and ordinary service correspondence: for the service relationship, then up to 5 years after services end. This proposed period does not override category-specific legal, contractual, or claim-related requirements.
• Accounting and tax records: records supporting Indonesian bookkeeping or tax reporting are retained for the applicable 10-year period with the required storage in Indonesia. Other regulated, project, or laboratory records follow their category-specific requirements; general retention periods do not override mandatory obligations.
• Website access and security logs under our control: up to 90 days from recording, except for records required for an incident investigation or a legal obligation. Any different provider retention must be assessed and reflected in the applicable notice.
• Marketing data: while consent remains valid and the purpose remains relevant, with a review after 24 months without a substantive response or interaction. Evidence of consent is retained for up to 3 years after its withdrawal or the last processing relying on it. We retain only the minimum suppression record needed for as long as necessary to honor an opt-out.

When no longer needed, data will be deleted, destroyed, or adequately anonymized. Residual backup or recovery copies follow the applicable Odoo and Microsoft 365 rotation and deletion cycles, which we document and review. Access and use remain restricted. Following restoration, deletion and suppression instructions must be reapplied. Extensions for legal obligations or relevant claims are limited to what is necessary.

Processing outside Indonesia

We use international services including Odoo, Microsoft 365, and Cloudflare; Ganeca also uses a Google Analytics tag. Contact details, correspondence, hosted database information, and technical data may be processed outside Indonesia. Locations depend on hosting, tenant configuration, and support access. We assess the arrangements and safeguards before authorizing transfers. Contact us for further information.

Where data is transferred outside Indonesia, we apply the relevant data protection requirements: ensuring that the recipient country provides an equivalent or higher level of protection; if that condition is not met, ensuring adequate and binding safeguards; and if neither condition is met, obtaining the required consent. Visiting the website is not treated as consent to cross-border transfers.

Security and incident response

We apply technical and organizational measures appropriate to the nature and risks of the data, including access restrictions, account management, confidentiality obligations, and oversight of parties processing data on our instructions. No system is free of risk; this does not reduce our obligation to protect personal data.

If a personal data protection breach occurs, we will respond and notify the parties who must be informed, following the content requirements, procedures, and deadlines prescribed by applicable law.

Your rights and choices

Subject to applicable law and the relevant conditions, you may request to:

• Receive information about processing, access and obtain copies of your data, and update or correct inaccurate data.
• End processing, request deletion or destruction, and suspend or restrict processing in accordance with applicable requirements.
• Withdraw consent for processing based on consent and stop receiving marketing communications. Withdrawal does not invalidate lawful processing carried out before consent was withdrawn.
• Obtain or transfer data in an available format where portability requirements are met; object to decisions based solely on automated processing that have legal effects or a significant impact; and pursue available complaints and legal remedies.

We handle requests within the applicable statutory deadlines. If a request cannot be fulfilled in full, we will explain the reasons and limitations as required, for example to protect another person's rights or meet a legal obligation. Nothing in this Policy removes your rights under the law.

Children and third-party services

This website is intended for professional and business purposes, not to collect children's data. If processing children's data is necessary, we will apply the relevant special requirements, including parental or guardian consent as required by law. Please contact us if you become aware of children's data submitted without an appropriate basis.

Links to WhatsApp, social media, recruitment platforms, or other external services take you to services operated by others with their own policies. This Policy still applies to data subsequently received and handled by us. A specific notice will be provided where an additional service requires processing not described here.

Changes to this Policy

Changes are identified by the updated date. For material changes, including changes to information about processing based on consent, we provide notice before implementation as required by law. If fresh consent is needed, we will request it; publishing a new version is not a substitute for that consent.

PT Ganeca Environmental Services

Email: inquiry@ganeca.co.id

Current website contact page: https://ganeca.co.id/contactus

Contact Us