Privacy Policy

1. Data Controller

The data controller for this website is Drevani, operating from:

Questions regarding data handling on this website may be directed to the above email address. Drevani operates in accordance with applicable Indonesian personal data protection legislation, including Law No. 27 of 2022 concerning Personal Data Protection (UU PDP).

2. What Information We Collect

Drevani collects personal information only when it is voluntarily submitted by users through the website. This includes:

• —Contact form submissions: name, email address, subject selection, and message content submitted through the contact form on contact.php.
• —Enquiry correspondence: email communications sent directly to [email protected].
• —Technical data: IP address, browser type, operating system, referring URL, and pages visited — collected automatically through server logs and analytics tools.
• —Cookie data: data stored via cookies as described in the Cookie Policy.

Drevani does not collect sensitive personal data such as identity document numbers, financial account details, biometric data, or data related to health conditions.

3. How We Use the Information

Personal information collected through this website is used for the following purposes:

• —Responding to enquiries submitted through the contact form or by email.
• —Processing wholesale or distribution enquiries and batch documentation requests.
• —Maintaining internal records of correspondence for business continuity purposes.
• —Analysing website usage to improve navigation, content, and overall site performance.
• —Complying with applicable legal obligations.

Drevani does not use personal data for automated decision-making, profiling, or targeted advertising. Personal data is not sold or transferred to third parties for marketing purposes.

4. Legal Basis for Processing

Processing of personal data on this website is conducted on the following legal bases under applicable data protection law:

• —Consent: where the user has voluntarily submitted information through the contact form or by email.
• —Legitimate interest: for technical data collected via server logs and analytics, to maintain site security and improve user experience.
• —Legal obligation: where retention of correspondence or records is required under applicable Indonesian business or tax law.

5. Data Retention

Personal data submitted through the contact form is retained for the duration necessary to process and respond to the enquiry, and for a period thereafter as required by applicable record-keeping obligations. Correspondence records are typically retained for a period of five years.

Technical data collected through server logs is retained for a period of twelve months. Cookie data retention periods are defined in the Cookie Policy. Upon expiry of the applicable retention period, personal data is deleted or anonymised.

6. Third-Party Service Providers

Drevani uses a limited number of third-party services to operate this website. These include web hosting infrastructure, analytics tools, and email delivery services. These providers may process data on behalf of Drevani as data processors. Drevani does not share personal data with these providers beyond what is required for the stated operational purpose.

This website embeds a Google Maps iframe on the contact page. Google's own privacy terms apply to data processed through that embed. Drevani does not receive or store data from the Maps embed independently.

7. Your Rights

Under applicable Indonesian personal data protection law (UU PDP), individuals whose data is processed by Drevani have the following rights:

• —Right to access: to request confirmation of whether Drevani processes your personal data and to receive a copy.
• —Right to correction: to request correction of inaccurate personal data.
• —Right to deletion: to request deletion of personal data, subject to any overriding legal retention obligations.
• —Right to object: to object to processing based on legitimate interest.
• —Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of prior processing.

Requests relating to any of the above rights may be submitted to [email protected]. Drevani will respond within a reasonable timeframe and no later than thirty calendar days of receipt.

8. Data Security

Drevani implements reasonable technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include encrypted data transmission (HTTPS), access controls on internal systems, and regular review of security practices.

No transmission over the internet or electronic storage method is entirely secure. Drevani cannot guarantee absolute security but will notify affected users of any confirmed data breach as required by applicable law.

9. Product Classification Notice

Drevani products are nutritional food-supplements registered with the applicable local regulatory authority under food-supplement classification. Products meet compositional and labelling requirements for nutritional supplement categories. This Privacy Policy pertains to the processing of personal data on this website only, and does not constitute product labelling or regulatory documentation.

10. Changes to This Policy

Drevani may update this Privacy Policy from time to time to reflect changes in practices or applicable law. The date at the top of this document will be updated accordingly. Continued use of the website following any update constitutes acceptance of the revised policy.

For questions about this policy or about how personal data is handled on this website, contact us at [email protected].