Privacy Policy

We may collect the following categories of personal data when you interact with our website or engage our services: • **Contact information** — name, email address, phone number, company name, and job title submitted via contact forms or consultation booking. • **Usage data** — pages visited, time spent on pages, referring URL, browser type, device type, and IP address collected automatically via cookies and analytics tools. • **Engagement data** — information you provide during the course of a professional engagement, which is governed by the applicable engagement letter and mutual NDA.

We use your personal data for the following purposes: • To respond to enquiries and schedule consultations. • To deliver professional services under an engagement agreement. • To send periodic updates, newsletters, or compliance calendars you have opted in to receive. • To improve our website, content, and user experience through aggregated analytics. • To comply with applicable legal and regulatory obligations.

We process personal data on the following legal bases: • **Consent** — where you have provided explicit consent (e.g., subscribing to a newsletter). • **Contractual necessity** — where processing is required to perform services under an engagement letter. • **Legitimate interest** — where processing is necessary for our legitimate business interests (e.g., website analytics, security), provided those interests are not overridden by your rights. • **Legal obligation** — where processing is required to comply with applicable law.

This website uses Google Analytics 4 (GA4) to collect anonymised usage data. GA4 uses first-party cookies to distinguish unique users and sessions. No personally identifiable information is transmitted to Google in a way that identifies individual visitors. You may disable cookies through your browser settings. Doing so may affect certain website functionality.

We do not sell, rent, or trade your personal data to third parties. We may share data with: • **Service providers** — hosting, email delivery, and analytics providers who process data on our behalf under appropriate data processing agreements. • **Professional obligations** — where required by law, regulation, court order, or professional body directive. • **With your consent** — where you have explicitly authorised disclosure.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Contact form submissions are retained for 24 months. Engagement data is retained in accordance with professional and regulatory retention requirements applicable in Indonesia and India.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These include encryption in transit (TLS), access controls, and regular review of security practices.

Depending on your jurisdiction, you may have the right to: • Access the personal data we hold about you. • Request correction of inaccurate or incomplete data. • Request deletion of your personal data. • Object to or restrict certain processing activities. • Withdraw consent at any time where processing is based on consent. To exercise any of these rights, contact us at **[email protected]**.

JCSS operates across multiple jurisdictions including Indonesia and India. Where personal data is transferred across borders, we ensure appropriate safeguards are in place in compliance with applicable data protection laws, including Indonesia's UU PDP (Law No. 27 of 2022 on Personal Data Protection).

We may update this Privacy Policy from time to time. The revised version will be posted on this page with an updated effective date. We encourage you to review this page periodically.

For questions or concerns regarding this Privacy Policy or your personal data, contact: **JCSS Indonesia** #502K, EpiWalk Lifestyle, Rasuna Epicentrum Jl. HR. Rasuna Said, Jakarta Selatan 12940, Indonesia Email: **[email protected]**