How inquiry, client, product, project, support, and operational data is handled from the first message through delivery and maintenance.
Scope of this policy
This Privacy & Product Policy explains how Northkind Studio collects, uses, stores, shares, and protects personal data through northkind.id, project inquiries, product purchases, demonstrations, delivery, hosting, setup, and maintenance.
This policy is intended to support applicable Indonesian data-protection and electronic-system requirements, including Law No. 27 of 2022 on Personal Data Protection. Project-specific agreements may add more detailed obligations.
Data we collect
- Identity and contact data, such as name, work email, phone or WhatsApp number, company, and role.
- Inquiry and project data, including project type, budget range, messages, requirements, feedback, files, and communication history.
- Commercial and operational data, such as quotations, invoices, payment status, selected editions, license records, domains, hosting, and support history.
- Technical data that may be generated by servers and security systems, such as IP address, request time, browser or device information, logs, and suspected-abuse signals.
- Language preference stored locally and in an essential cookie so the website can remember the selected language.
Why we process data
We process personal data when needed to respond to a request, prepare or perform a contract, provide a product or service, comply with law, protect legitimate business and security interests, or based on consent where consent is the appropriate legal basis.
- Respond to inquiries, prepare proposals, and communicate about products or projects.
- Process orders, licenses, delivery, deployment, maintenance, and support.
- Secure the website, prevent abuse, investigate incidents, and maintain operational records.
- Meet accounting, tax, legal, and dispute-resolution obligations.
- Improve our services using aggregated or appropriately de-identified information where practical.
Data inside client products
When a client operates a purchased or custom system, the client generally decides which personal data is collected and why. The client is responsible for lawful notices, permissions, user rights, access controls, retention, accuracy, and security for that operational data.
Northkind accesses client-system data only when necessary and authorized for setup, migration, troubleshooting, hosting, maintenance, or support. Where required, the parties should use a separate data-processing agreement defining roles and instructions.
Attendance systems may process location, face, or biometric-related data, which can require heightened protection. A purchasing organization must configure and use those features only with a valid legal basis, proportionate purpose, clear notice, strict access, and suitable retention controls.
How data may be shared
We do not sell personal data. We may share only what is reasonably necessary with infrastructure, database, storage, email, communication, domain, payment, security, professional-adviser, or authorized contractor providers supporting the requested service.
We may also disclose data when required by law, a valid authority request, legal claims, security protection, or a business restructuring with appropriate confidentiality and data-protection measures.
Storage and retention
We keep personal data only as long as reasonably needed for the stated purpose, an active inquiry or contract, support, security, accounting, legal obligations, or dispute records. Retention periods vary by record type and may be extended when law or a legal hold requires it.
When data is no longer required, we will delete, anonymize, or securely dispose of it where reasonably possible. Backup copies may remain for a limited cycle before being overwritten.
Security and incidents
We use reasonable technical and organizational safeguards appropriate to the service, such as access limitation, private storage where configured, protected credentials, transport encryption, logging, backups, and service-provider controls. No method can guarantee absolute security.
If a personal-data incident occurs, we will investigate, mitigate, document, and provide notifications required by applicable law and the parties' respective roles.
Your privacy rights
Subject to applicable law and verification, you may request information about processing, access, correction, completion, deletion, withdrawal of consent where consent applies, objection or restriction in relevant circumstances, and other rights available under Indonesian personal-data law.
Some requests may be limited when data must be retained for contracts, security, legal obligations, evidentiary needs, or another lawful basis. For data controlled by a client-operated product, requests should first be directed to that client organization.
Cookies, links, and demos
The website uses essential local storage and a cookie to remember language preference. We may add analytics or other optional technology in the future only with an updated notice and controls when required.
External links and live demos may operate under separate providers or environments. Do not enter real, confidential, biometric, financial, or production data into a public demo unless it is expressly designated for that purpose.
Updates and contact
We may update this policy when services, providers, or legal requirements change. The current version and effective date will remain available on this page, and material changes will be communicated when required.
For privacy questions or rights requests, contact hello@northkind.studio and include enough information for us to verify and understand the request without sending unnecessary sensitive data.