This policy explains what personal data Apexsoft Digital Agency collects, why, and what you can do about it. It applies to apexsoftdigital.com and to the client portal at the same domain.
- Who we are
- What we collect
- Why we use it
- How long we keep it
- Who else sees it
- Your rights
- Security
- Changes
Who we are
Apexsoft Digital Agency, Bali, Indonesia. For anything in this policy, write to info@apexsoftdigital.com.
We are the data controller for personal data collected through this website. Where we process data on behalf of a client — for example, records inside a system we built and host for them — that client is the controller and we act as processor under a written agreement.
What we collect
When you contact us or request a quote. Your name, email address, and optionally your phone number, company name and website. Whatever you write in the message field. We also record the language you were browsing in, your IP address and your browser’s user-agent string.
When you join the Apex Labs waitlist. Your email address, and your name if you give it.
When you hold a client portal account. Your name, email, password (stored only as a hash), your organisation, and the records associated with your account — services, domains, invoices, projects and support messages.
Automatically, on every visit. Standard server logs: IP address, request path, timestamp, referrer and user-agent. Your language and theme preference are stored in cookies on your own device.
We do not collect special-category data, and you should not send it to us through these forms.
Why we use it
| Purpose | Legal basis |
|---|---|
| Replying to your enquiry or quote request | Steps taken at your request before entering a contract |
| Delivering services you have engaged us for | Performance of a contract |
| Operating and securing the client portal | Performance of a contract; legitimate interests |
| Sending the Apex Labs announcement | Your consent |
| Keeping accounting and tax records | Legal obligation |
| Preventing form abuse and fraud | Legitimate interests |
We do not sell personal data, and we do not use it for automated decision-making or profiling.
How long we keep it
- Quote requests and contact messages — 24 months from last contact, then deleted.
- Waitlist subscriptions — until you unsubscribe, and then removed within 30 days.
- Client records — for the life of the engagement plus 10 years, as Indonesian bookkeeping rules require.
- Server logs — 90 days.
Who else sees it
Only the people at Apexsoft who need it, and the service providers that run our infrastructure: hosting and backups, email delivery, error monitoring, and payment processing where relevant. Each is bound by a contract that limits them to processing data on our instructions.
Some of these providers operate outside Indonesia. Where personal data is transferred abroad we rely on the protections required by Article 56 of Law No. 27 of 2022, and on standard contractual clauses where the recipient is covered by the GDPR.
We will also disclose data where a law or a valid order from a competent authority requires it.
Your rights
You may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or provide it in a portable format. Where we rely on consent you may withdraw it at any time, and doing so does not affect what we did beforehand.
Write to info@apexsoftdigital.com. We respond within 30 days. If you are not satisfied you may complain to the Indonesian data protection authority, or — if you are in the EU or UK — to your local supervisory authority.
Security
Traffic is encrypted in transit. Passwords are hashed, never stored in a readable form. Access to production systems is restricted, individually credentialed and logged. Backups are encrypted. We will notify you and the relevant authority within 72 hours of becoming aware of a breach that affects your data.
No system is perfectly secure, and we will not claim otherwise.
Changes
We will post any revision here and update the date at the top. If a change materially affects your rights, we will contact account holders directly rather than relying on you to notice.