This Privacy Policy is issued by PT Delapan Pilar Membangun (“Bukit Ciater”, “we”, “us”, “our”), a legal entity established under the laws of the Republic of Indonesia, in connection with your use of the website bukitciaterresort.com (the “Site”) and the services we provide, including the provision of information regarding Bukit Ciater resort and villa units marketed and sold by PT Delapan Pilar Membangun (the “Services”).

This Policy is prepared with reference to Law of the Republic of Indonesia No. 27 of 2022 on Personal Data Protection (“PDP Law”) and internationally recognized data protection principles.

By accessing or using the Site and/or Services, including by submitting the form on the investment page, you (“User”, “you”) acknowledge that you have read, understood, and agreed to the practices described in this Privacy Policy.

1. Definitions

• Personal Data: data about an identified or identifiable individual, whether directly or indirectly, individually or in combination with other information, through electronic or non-electronic systems.

• Data Controller: PT Delapan Pilar Membangun, which determines the purposes and means of processing Personal Data.

• Processing: any operation performed on Personal Data, including collection, recording, storage, correction, updating, disclosure, transfer, and erasure/destruction.

• Prospective Buyer/Investor: an individual or business entity who submits the form on the investment page, or who otherwise communicates with us to obtain information about Bukit Ciater resort or villa units.

2. Information We Collect

We may collect the following categories of data depending on how you interact with us:

2.1 Information you provide directly

When you submit the form on the investment page, or contact us via live chat, WhatsApp, or telephone, we may collect personal information you voluntarily provide, including:

• Full name

• Email address

• Phone number/WhatsApp number (by providing your WhatsApp number, you explicitly consent to receive information about resort/villa units, responses to your inquiries, offers, and other related business communications via WhatsApp)

• City/place of residence

• The villa/resort unit or type you are interested in, including budget preferences or purpose of purchase (personal residence or investment)

• The content of messages or inquiries submitted through the form, live chat, or WhatsApp Business

• Identity and payment information (KTP/NPWP, account/payment details) for Prospective Buyers who proceed to the booking or transaction stage

2.2 Information collected automatically

• IP address

• Browser/device type and version

• Pages visited, time spent, and referral source

• Cookies and similar tracking technologies (see Section 7)

2.3 Information from Third Parties

We may receive Personal Data from advertising platforms (e.g., Meta Ads, Google Ads, TikTok Ads) when you interact with Bukit Ciater's advertisements or marketing, as well as from property marketing partners (marketing agents/brokers) who cooperate with us to market Bukit Ciater resort or villa units.

3. Purposes and Legal Basis for Processing

We process Personal Data for the following purposes, with legal bases aligned to the PDP Law:

4. How We Share Your Data

We do not sell your Personal Data. We may share data with:

• PT Delapan Pilar Membangun's internal sales and marketing team, including officially appointed property agents/marketing representatives, to follow up on your request for information about Bukit Ciater resort/villa units.

• Third-party service providers who support our operations (e.g., hosting, CRM systems, email/WhatsApp marketing tools, payment gateways, analytics tools such as Google Analytics/Meta Pixel), bound by contractual confidentiality obligations.

• Advertising platform partners (Meta, Google, TikTok) to the extent necessary to run Bukit Ciater's marketing campaigns.

• Notaries/land deed officials (PPAT), financing institutions (banks/mortgage providers), and other relevant parties necessary to process a unit purchase transaction, should you proceed to booking or purchase.

• Regulators or authorities, where required by law, court order, or an official government request.

• A prospective buyer or successor of the business, in the event of a merger, acquisition, or asset transfer, with prior notice to you.

Custom Audiences and Data Matching: We may share securely hashed (encrypted), non-identifying versions of your email address or phone number with advertising platforms (such as Google, Meta, and TikTok) to create “Custom Audiences” or “Customer Match” lists to serve relevant advertising about Bukit Ciater. These platforms only use the hashed data for the matching process and are prohibited from sharing it with other third parties or using it for other purposes.

5. Data Retention and Security

• Data is retained for as long as necessary to fulfill the purposes described above, meet legal obligations, or resolve disputes, including the retention periods applicable to property transaction documents under applicable regulations.

• We implement reasonable technical and organizational measures (encryption, access controls, authentication) to protect Personal Data against unauthorized access, loss, or misuse.

• No method of transmission over the internet is completely secure; we cannot guarantee absolute security.

• In the event of a personal data breach, we will notify affected individuals and the relevant Indonesian authorities within the timeframe stipulated by the PDP Law (typically within 3x24 hours), detailing the nature of the breach and the mitigation steps taken.

6. Your Rights as a Data Subject

Under the PDP Law, you have the right to:

1. Obtain clarity on our identity, legal basis, purpose, and use of your Personal Data;

2. Complete, update, and/or correct inaccurate Personal Data;

3. Access and obtain a copy of your Personal Data;

4. Terminate processing, delete, and/or destroy your Personal Data;

5. Withdraw consent for processing;

6. Object to automated decision-making (including profiling);

7. Request suspension or restriction of processing;

8. Lodge a complaint regarding an alleged violation of your data rights.

WhatsApp Communications Opt-Out: If you have opted in to receive communications from us via WhatsApp Business, you retain the right to withdraw this consent at any time. You can opt out by replying “STOP” or “BERHENTI” to any WhatsApp message you receive from us, and we will immediately cease sending promotional or automated messages to your number.

To exercise these rights, please contact us using the details in Section 11.

7. Cookies and Tracking Technologies

Our Site uses cookies to:

• Remember your preferences

• Analyze traffic and user behavior (e.g., Google Analytics)

• Measure the effectiveness of advertising campaigns for the Bukit Ciater project (e.g., Meta Pixel, TikTok Pixel, Google Ads Tag)

You may opt out of personalized advertising by visiting the settings of the relevant platform (e.g., Google Ads Settings, Meta Ad Preferences) or by using browser add-ons such as the Google Analytics Opt-out Browser Add-on. You can also configure your browser to reject cookies, though some Site features may not function properly as a result.

8. Third-Party Links and Services

Our Site and Services may contain links to third-party websites or utilize third-party platforms (e.g., Meta, Google, WhatsApp). We do not control and are not responsible for the privacy practices, data security, or content of these external platforms. We encourage you to review the respective privacy policies of these third parties before providing your Personal Data.

9. Cross-Border Data Transfers

Where we use service providers whose servers are located outside Indonesia (e.g., Google, Meta, cloud/hosting providers), your Personal Data may be transferred to and processed in those jurisdictions. We take reasonable steps to ensure such providers maintain data protection standards consistent with the PDP Law.

10. Children's Privacy

Our Services are intended for users aged 18 and above, or business entities. We do not knowingly collect Personal Data from minors without appropriate parental or guardian consent as required by applicable law.

11. Contact Us

If you have questions, wish to exercise your rights, or have a complaint regarding this Privacy Policy, please contact our Data Protection representative at:

PT Delapan Pilar Membangun (Bukit Ciater)

Attn: Data Protection Officer (DPO) / Legal & Compliance Department

Email: dpilarmembangun@gmail.com

Address: Jl. Taman Surya III Blok J.1 No. 07, Desa/Kelurahan Pegadungan, Kec. Kalideres, Kota Adm. Jakarta Barat, Provinsi DKI Jakarta, Kode Pos: 11830

Website: https://bukitciaterresort.com

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable legal requirements. Material changes will be communicated via the Site prior to taking effect. The “Last updated” date above reflects the most recent revision.

Note: sections marked with square brackets [ ] need to be completed with PT Delapan Pilar Membangun's official details (email address and office address) before this document is published.