Finetune.id is a brand of PT Kona Koni Kreatif, part of the Konakorp group (konakorp.co). This policy explains what personal data PT Kona Koni Kreatif ("Finetune", "we") collects through finetune.id, why, and what you can ask us to do with it. It is written for visitors everywhere, and in particular meets the EU and UK General Data Protection Regulation (GDPR), Indonesia's Personal Data Protection Law (UU PDP, No. 27 of 2022), Singapore's Personal Data Protection Act 2012 (PDPA) and Australia's Privacy Act 1988 with the Australian Privacy Principles.
1. Who we are
PT Kona Koni Kreatif (Konakorp), Jakarta, Indonesia, operating the Finetune.id brand, is the controller of the personal data described here. Our data protection officer handles privacy questions and requests: lets@finetune.id (subject "Privacy request").
2. What we collect
- What you send us. When you fill in a contact, brief or partnership form: your name, work email, phone or WhatsApp number, company, role, website, budget range and the message you write. When you email or WhatsApp us: what you put in that message.
- Where you came from. With each form we receive the page you sent it from, and the campaign tags (UTM) and referring site of that visit. With marketing consent we also remember, for 90 days, the ad or site that first and last brought you here, including an ad click ID.
- How you use the site. Only with your consent: pages viewed, clicks on buttons such as "Send a brief" or WhatsApp, approximate location from your IP address, device and browser type, through the tools in section 6.
- Visit counts. Without cookies or anything stored on your device, our own server counts page views: the page, the referring site or campaign tag, country, device type (from screen width) and the ad platform a visit came from (never its click ID). To tell visits apart for one day, it keeps a one-way hash of your IP address and browser, made with a key that changes daily and is then deleted, so visits cannot be linked across days or traced back to you.
- Security data. Cloudflare and our server process your IP address and browser details to deliver the site and block abuse and spam.
We do not ask for sensitive data (health, religion, biometrics and the like). Please do not send it to us.
3. Why we use it, and on what basis
- To reply to your inquiry and prepare a proposal or contract. Steps you asked for before a contract, and our legitimate interest in answering business inquiries.
- To know which campaigns bring inquiries. Our legitimate interest for the page and campaign tags sent with a form; your consent for anything stored on your device and for ad click IDs.
- Analytics and ad measurement. Your consent, given in the cookie banner. You can withdraw it at any time, without affecting what happened before.
- Visit counts. Our legitimate interest in knowing how the site is used. Nothing is stored on your device and only aggregated numbers are kept.
- Security and spam prevention. Our legitimate interest in keeping the site and forms safe.
- Legal obligations, such as tax records once you become a client.
We do not sell personal data, and we do not send marketing emails unless you ask for them. Every marketing message we send has a way to opt out.
5. Who we share it with
Our team, and service providers who process data for us under contract and only on our instructions. When a project needs a partner (for example a developer under NDA), we share only what that work needs. We disclose data to authorities only where the law requires it.
| Provider | What for | Location |
|---|---|---|
| Google (Tag Manager, Analytics, Ads) | Measurement and ads, only with your consent | USA and others |
| Meta Platforms (Pixel, Conversions API, WhatsApp) | Ad measurement with your consent; WhatsApp when you message us | USA and others |
| Cloudflare | Content delivery, security and form spam checks | Global network |
| Lark (Lark Technologies) | Email and the inbox where our team reads inquiries | Singapore and others |
| Our hosting provider | Runs the website and stores form submissions | See "Where your data goes" |
6. Where your data goes
We are based in Indonesia, and some providers above process data in other countries, including Singapore, the United States and the EU. When data leaves the country it was collected in, we rely on the safeguards the relevant law asks for: adequacy decisions or the EU Standard Contractual Clauses for GDPR, a level of protection equal to or higher than UU PDP or contractual safeguards for Indonesia, comparable protection under PDPA for Singapore, and reasonable steps under APP 8 for Australia.
7. How long we keep it
- Form submissions: 24 months after you send them, then deleted automatically. Inquiry emails and chats: 24 months after we last heard from you, unless you become a client.
- Client records: as long as the contract runs, plus the period tax and company law require.
- Analytics data: 14 months. Stored traffic source: 90 days. Your cookie choice: 6 months. Visit counts: the daily hash is deleted within 2 days; only aggregated totals are kept.
8. Your rights
Depending on where you live, you can ask us to:
- tell you what personal data we hold about you and give you a copy, in a portable format where applicable;
- correct data that is wrong or incomplete;
- delete it, or stop or restrict how we use it;
- object to processing based on legitimate interest, and to direct marketing at any time;
- withdraw consent at any time (for cookies, use ).
Email lets@finetune.id. We may ask you to confirm who you are. We answer within the time the law sets: one month under GDPR, 3 × 24 hours to act on a UU PDP request where we can, and as soon as reasonably possible (usually within 30 days) under PDPA and the APPs. It is free unless a request is clearly excessive.
If you are not happy with our answer you can complain to your data protection authority, for example your EU or UK supervisory authority, Indonesia's personal data protection authority (Kementerian Komunikasi dan Digital until the PDP agency is in place), Singapore's Personal Data Protection Commission (PDPC) or the Office of the Australian Information Commissioner (OAIC).
9. Security and data breaches
We use HTTPS everywhere, access controls and passkey sign-in on our admin, and keep only what we need. If a breach puts your data at risk, we notify the authority and you within the time the law sets: 72 hours under GDPR, 3 × 24 hours under UU PDP, 3 days to the PDPC under PDPA, and as soon as practicable under Australia's Notifiable Data Breaches scheme.
10. Children
This site is for businesses and is not meant for anyone under 18. We do not knowingly collect children's data; if you think we have, email us and we will delete it.
11. Changes
When we change this policy we update the date at the top. If a change affects what we do with data you already gave us, or adds a new tracking tool, we ask for your consent again.