Privacy Policy

01Who is responsible

Muhammad Fikri Gunawan is the data controller for personal data processed through this Website. You can reach me at contact@mufigu.com. I am an individual and have not appointed a separate data protection officer, so privacy questions go to the same address.

02Personal data I collect

• Contact form and email: your name, email address and the content of your message, plus anything else you choose to include.
• Technical data and logs: IP address, browser and device type, pages requested, date and time, and error information, recorded automatically by the server for security and operation. The contact form also uses your IP address briefly to limit abuse (rate limiting).
• Language preference: a small cookie that remembers whether you chose English or Indonesian.
• Cookie choice: your consent decision, stored in your browser (local storage).
• Analytics data (only if you accept): if analytics is enabled and you accept, Google Tag Manager and Google Analytics may collect usage data such as pages viewed, approximate location, device information, referrer, searches made in the site search and clicks on key buttons, using cookies or similar identifiers.

I do not collect payment details, I do not require accounts, and I do not knowingly collect sensitive personal data.

03Why I use it and on what basis

• To reply to your enquiry and, if you ask, prepare a proposal. Basis: steps taken at your request before entering into a contract, and my legitimate interests.
• To keep the Website secure and prevent spam and abuse. Basis: my legitimate interests and legal obligations.
• To remember your language and your cookie choice. Basis: strictly necessary for the functions you request, and my legitimate interests.
• To understand how the Website is used and improve it. Basis: your consent, which you can withdraw at any time.
• To comply with legal obligations and respond to lawful requests. Basis: legal obligation.

Under the Indonesian Personal Data Protection Law, I process personal data on the basis of your consent or another lawful basis recognised by that law.

04Cookies and similar technologies

• NEXT_LOCALE (cookie, functional): remembers your chosen language. Kept for up to one year.
• consent-v1 (local storage, functional): stores whether you accepted or declined analytics cookies. Kept until you clear your browser data.
• Google Analytics and Tag Manager cookies, for example _ga and _ga_* (analytics): set only after you accept, to measure usage. Typically kept for up to two years.

Analytics storage is denied by default using Google Consent Mode, and analytics cookies are only used after you accept. If analytics is enabled, a banner lets you accept or decline. Declining does not limit your access to the Website. You can change your choice at any time by clearing this site’s data in your browser settings, after which the banner appears again, or by using your browser’s cookie controls.

05Who I share data with

I do not sell your personal data, and I do not share it for cross-context behavioural advertising. I share data only with service providers that process it for me under appropriate safeguards:

• hosting and infrastructure providers that run the Website and its servers;
• email or backend services used to receive and store messages sent through the contact form;
• Cloudflare Turnstile, if enabled, to detect bots on the contact form; and
• Google (Tag Manager and Analytics), only if analytics is enabled and you accept.

I may also disclose data when required by law, a court order or a valid request from authorities, or to protect rights, safety and security.

06International transfers

My service providers may process data in countries other than the one where you live, including outside Indonesia and the EU/UK. Where required, I rely on appropriate safeguards such as standard contractual clauses or adequacy decisions, and I choose providers that commit to protecting personal data.

07How long I keep data

I keep personal data only as long as needed for the purposes above:

• Contact messages: as long as needed to handle your enquiry and keep a reasonable record of our correspondence, generally no longer than 24 months after the last contact, unless a project or a legal obligation requires longer.
• Server logs: for a limited period set by the hosting provider, typically up to 90 days.
• Analytics data: according to the retention setting of the analytics account, up to 14 months.

08Your rights

Depending on where you live, you have rights over your personal data, including the right to:

• access the personal data I hold about you and get a copy;
• correct inaccurate or incomplete data;
• ask me to delete your data;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw your consent at any time, without affecting earlier processing; and
• lodge a complaint with a supervisory authority, such as the authority designated under the Indonesian Personal Data Protection Law or your local data protection authority in the EU/UK.

To use these rights, email contact@mufigu.com. I may need to verify your identity, and I will respond promptly and within the time limits set by applicable law.

09California residents

Under the CCPA/CPRA you may ask to know what personal information I collect, to delete or correct it, and to opt out of the sale or sharing of personal information. I do not sell or share personal information as those terms are defined, and I will not discriminate against you for exercising your rights.

10Children

The Website is not directed to children under 16, and I do not knowingly collect their personal data. If you believe a child has sent me personal data, please contact me and I will delete it.

11Security

I use reasonable technical and organisational measures, including HTTPS encryption, security headers, input validation, spam and rate-limit protection and restricted access to systems. No method of transmission or storage is completely secure, so I cannot guarantee absolute security. If a personal data breach affects you, I will notify you and the authorities as required by law.

12Third-party links

The Website links to other sites such as social networks, client websites and sharing services. They have their own privacy practices, which this policy does not cover. Share buttons are plain links and send no data to those services until you click them.

13Changes to this policy

I may update this policy from time to time. The “Last updated” date shows the latest version. For material changes I will take reasonable steps to let you know, such as a notice on the Website.

14Contact

Privacy questions, requests or complaints: contact@mufigu.com.