Your information should be handled with care and clarity.

Who is responsible for your data

PT Lumara Karya Nusantara ("Lumara", "we", "us", or "our") is the data controller for personal data processed through this website and the contact channels described in this notice.

We are based in Bali, Indonesia. Our privacy contact details are provided below so you can submit a request or ask a question about how your data is handled.

Personal data we collect

When you complete the WhatsApp form or book a consultation through the embedded Cal.com calendar, we collect the information you choose to provide:

• full name;
• company type;
• email address;
• optional phone or WhatsApp number;
• services you select; and
• your written inquiry.

The website and its service providers may also create basic technical records needed to deliver and secure the site, such as an IP address, browser or device information, requested pages, and timestamps. Please do not send financial account details, identity documents, tax credentials, employee data, or other sensitive information through the public form unless Lumara specifically asks for it through an appropriate secure channel.

Purposes and legal grounds

We process personal data only for clear and limited purposes, including to:

• respond to your inquiry and discuss services you request;
• prepare a quotation or take steps at your request before entering into a service agreement;
• communicate with you about your request and keep appropriate business records;
• protect the website, prevent abuse, and investigate suspected fraud or security incidents; and
• measure general website use through Google Analytics only when you give separate analytics consent and analytics is configured.

Depending on the context, processing may be based on the permission you provide, steps you ask us to take before a contract, our legitimate business needs, or a legal obligation. We will not use inquiry information for unrelated marketing without an appropriate legal ground and, where required, your consent.

Consent and your choices

The WhatsApp form cannot be submitted until you confirm that Lumara may use the details you provide to respond to your inquiry. That confirmation is included with the inquiry notification. You may withdraw consent or ask us to stop or limit processing by contacting us, although withdrawal does not affect processing already carried out lawfully and may mean that we cannot continue responding to your request.

Analytics is separate from the WhatsApp form. Google Analytics is not loaded until you choose Allow analytics. Your preference is stored in your browser’s local storage, and you can change it at any time through Cookie preferences in the footer. Advertising storage, advertising user data, and advertising personalization remain disabled. If analytics is enabled, Google Analytics may set analytics cookies and its account-level retention settings apply. Lumara does not send names, email addresses, phone numbers, or inquiry messages to Analytics.

How inquiry information is shared

The application does not write inquiries or booking alerts to its own database. After server-side validation, WhatsApp form submissions are sent to Lumara’s configured business email address through Resend, an email delivery provider, and to Lumara’s configured private Slack leads channel through Slack Incoming Webhooks. Booking details submitted through the embedded Cal.com calendar are received through an authenticated Cal.com webhook and forwarded to the same private Slack leads channel. Lumara may then access the information through its business email account and Slack workspace, and share it internally only as needed to respond, prepare services, provide services, or meet legal and operational requirements.

After that capture succeeds, your browser opens WhatsApp with a prepared message containing the details you provided. Any information you choose to send through WhatsApp is then processed under WhatsApp’s own terms and privacy practices.

The website may also use hosting, security, Cal.com, email delivery, Slack, WhatsApp, and optional analytics providers to operate the features described here. Lumara does not sell or rent the personal information submitted through the WhatsApp form or Cal.com calendar.

International transfers

Cal.com, Resend, Slack, WhatsApp, Google Analytics, and the hosting or security provider may process personal data outside Indonesia. When personal data is transferred outside Indonesia, Lumara will use the provider arrangements and safeguards required by applicable law.

Third-party services have their own privacy notices and transfer practices. Contact Lumara if you need current information about the providers used for a particular interaction.

Retention and deletion

Lumara keeps inquiry information only for as long as reasonably necessary to respond to you, discuss or provide services, maintain appropriate business and accounting records, resolve disputes, and establish or defend legal claims. If an inquiry becomes a client relationship, related records may be retained for the period required for that relationship and by applicable law. When information is no longer needed, Lumara will delete or securely dispose of it.

Provider logs, business email records, Slack messages, WhatsApp messages, and analytics data may be subject to the retention controls of the relevant provider or account. A deletion request may be limited where continued retention is required by law or necessary for a legal claim.

Your rights

Depending on applicable law and the circumstances, you may ask Lumara to:

• confirm whether we process your personal data and provide access to it;
• correct inaccurate, incomplete, or outdated information;
• delete or destroy information that is no longer needed or is processed unlawfully;
• stop, limit, or postpone processing in appropriate circumstances;
• withdraw consent where processing is based on consent;
• receive your data in a commonly used, machine-readable format where applicable; and
• raise an objection or complaint about processing and seek remedies available under applicable law.

Send requests to the privacy contact below. We may need to verify your identity before acting on a request, and we will explain if a request cannot be completed because of a legal or operational exception.

Security and data incidents

Lumara uses reasonable technical and organisational measures appropriate to the nature and risk of the data, including server-side form validation, access controls, and secure transmission where available. No internet transmission or storage system can be guaranteed completely secure.

If Lumara discovers a personal data incident, we will investigate it, take steps to contain and recover from it, and provide notifications where required by applicable law.

Children’s data

This website is intended for business users and is not directed to children. Lumara does not knowingly request personal data from children through the WhatsApp form. If you believe a child has provided personal data, please contact us so we can review and delete it where appropriate.

Updates and contact

We may update this notice when our website, providers, business practices, or legal requirements change. We will publish the updated version and its last updated date on this page.

Privacy requests: Jacqueline@lumara.id