Privacy policy.

Who is responsible for your data

DIFOUMA is operated by PT DIFOUMA DIGITAL INDONESIA, registered in Indonesia under business identification number (NIB) 0510260083599, based in Yogyakarta, Indonesia.

PT DIFOUMA DIGITAL INDONESIA is responsible for the personal data described on this page. Anything to do with your data goes to dimas@difouma.com — it reaches a person, not a ticket queue.

Information you provide

When you submit the contact form, we collect:

• Your name and email address, so we can reply.
• Your company name or website, if you give it.
• Your monthly advertising-spend range.
• The advertising channels you run.
• Whatever you write in the business-goal field.

We use this to answer your enquiry, to work out whether we are a fit for what you need at all, and to prepare for a consultation if there is going to be one.

We do not ask for payment-card details anywhere on this site, and there is no account to create. If a page ever asks you for a card number, it is not us.

Attribution and referral information

When you arrive, we capture the information that explains how you got here:

• The campaign parameters on the link you followed — utm_source, utm_medium, utm_campaign, utm_content and utm_term.
• The advertising click identifiers — gclid, gbraid, wbraid, fbclid, ttclid and msclkid.
• The first page you landed on.
• The site that referred you, if any.

This is kept in your browser for up to 90 days and sent to us if you submit an enquiry. If you tap a WhatsApp button we also record it at that moment, together with a short reference code shown at the top of the draft message — the code is what lets us match a conversation to the campaign that started it, so the identifiers above never have to travel through WhatsApp itself. Tapping the button is enough to create that record; you do not have to send the message.

That record goes to two places: the Google Sheet described below, and our lead CRM at crm.difouma.com. The CRM copy also holds your IP address, your browser's user agent, and Meta's advertising cookies (_fbp and _fbc) if your browser has them. We keep those so that, if the conversation becomes a qualified lead or a sale, we can tell Meta which ad produced it without sending them your WhatsApp number in readable form.

Technical and usage information

The site and the providers that run it process the ordinary technical data any website receives when your browser asks for a page:

• Your IP address.
• The page requested, and the date and time of the request.
• Your browser, operating system and device identifiers.
• Page views and interactions with the site.
• Security and error logs.

This is in the server logs whether we want it or not. It is what makes it possible to serve you a page, to notice when the site or the contact form is being attacked, and to find the errors that would otherwise go unfixed.

Legal basis for processing

Depending on the activity, we rely on one or more of the following grounds:

• Answering your request, and taking the steps that come before a possible agreement.
• Performing an agreement with you.
• Complying with a legal obligation.
• Our legitimate interests in site security, fraud prevention, business administration and improving the service.
• Your consent, where consent is required for non-essential analytics or advertising technologies.

Where we rely on consent, you can withdraw it at any time. Withdrawing it does not affect processing that was lawful before you did.

Analytics, local storage and cookies

We use Google Tag Manager to load the site's measurement. Tag Manager itself does not set analytics cookies, but the tags inside it may — typically analytics cookies that count visits and show us which pages people actually read. Those tools tell us that a page was viewed; they do not tell us who you are.

If you are visiting from the EEA, the UK or Switzerland, a consent bar appears on your first visit and analytics storage stays denied until you accept it. Rejecting is one tap, in a button the same size as the one that accepts. Everywhere else, measurement runs by default — which is the honest description of what we do, and you can still switch it off from Cookie settings in the footer.

Your choice is remembered in your browser, and Cookie settings in the footer reopens it wherever you are, whatever you answered. Withdrawing consent takes effect immediately and does not affect anything that was lawful before you withdrew it.

To make this work we send Google a consent signal, which the Google tags read before they store anything. Two other things are worth saying plainly about it. It governs the tags in our container, not the whole internet, and only the tags built to read it: our Google tags do, and our Meta advertising pixel currently does not, so it sets its own cookie whatever you answer. And it is not the only control you have: every current browser lets you block or delete cookies and site data, and browser-level tracking protection or an ad blocker will stop these scripts loading at all. Nothing on this site depends on measurement to work.

Separately from anything Google sets, this site stores three things in your own browser:

• difouma.attribution — the campaign parameters and click IDs described above, in local storage, for 90 days.
• difouma.consent — your answer to the consent bar, in local storage, so you are not asked again on every page.
• difouma_region — a cookie holding either eu or row, so we know whether the consent bar applies to you. It is worked out from your IP address at the edge and holds no country, city or address.

None of the three is used for advertising, and clearing your site data removes all of them immediately.

What happens to an enquiry

The form sends your submission to an endpoint on this site, which passes it to a Google Apps Script webhook. From there it is:

• Written as a row in a Google Sheet, which is the enquiry record.
• Sent through Gmail as a notification to Dimas Yudha Pratama.
• Read and answered by Dimas himself.

We do not add you to a mailing list because you filled in a contact form — if there is ever a newsletter, you will have to ask for it. We do not sell your information, and we do not hand it to data brokers.

Service providers

The providers we depend on to run and measure this site may process your data:

• Vercel, for hosting and server infrastructure.
• Google Apps Script, Google Sheets and Gmail, for handling and storing enquiries.
• Supabase, which stores our lead CRM's database on servers in Japan, and Vercel, which runs the CRM.
• Google Tag Manager and Google Analytics, for measurement where enabled.
• WhatsApp and Meta, if you choose to start a conversation on WhatsApp.
• The advertising platforms behind any measurement tags that are enabled.

Each of them acts under its own contractual and privacy terms. Past that list, nobody else gets your details — no partner lists, no exceptions. The one thing that would override this is a valid legal order or a requirement of applicable law.

International processing

Some of those providers process personal data outside Indonesia, and outside whichever country you are in. Where it is required, we assess whether the destination offers an appropriate level of protection, or whether contractual safeguards, another lawful transfer mechanism or your consent has to come first.

Retention

Enquiries are kept while there is a live conversation, and for up to 24 months afterwards so we can pick up where we left off if you come back. They go sooner if they are no longer needed, or if you ask.

If an enquiry becomes a client engagement, the business and transaction records that come with it may be kept longer where that is necessary to perform the agreement, resolve a dispute or satisfy a legal obligation.

WhatsApp tap records in the CRM, with the IP address and browser details they arrived with, are kept for up to 12 months after the last activity on them, then deleted or stripped of anything that identifies you.

Attribution stored in your browser expires after 90 days. Analytics and server-log retention follows each provider's configuration, and is kept only for as long as measurement, security and operations need it.

Your rights

Subject to the law that applies to you, you can ask us to:

• Confirm whether we hold personal data about you.
• Give you access to it.
• Correct anything incomplete or wrong.
• Delete what is no longer needed.
• Restrict or stop a particular use.
• Send you a portable copy, where that applies.
• Record your objection to a particular use.
• Withdraw your consent.

Ask by emailing dimas@difouma.com. We will not charge you for it, and we will not make you explain yourself. Requests are handled inside the period the applicable law allows — including the 3 × 24-hour deadlines that apply to certain requests under Indonesia's Personal Data Protection Law.

We may need to verify who you are before handing over, changing or deleting personal information. That is there to stop your data going to the wrong person.

If you are in the EU or UK you can also complain to your national data protection authority; if you are in Indonesia, to the supervisory authority under the Personal Data Protection Law. We would rather you came to us first, but it is your call.

Security

The site is served over HTTPS, so what you type into the contact form is encrypted in transit. Access to enquiries is limited to Dimas Yudha Pratama and the providers listed above.

We use technical and organisational controls meant to protect information against unauthorised access, alteration, disclosure, loss or destruction. No system is perfect, and anyone who tells you otherwise is selling something — but if there is ever a failure that puts you at risk, we will investigate it, contain it, and give the notifications the law requires inside the applicable period, including the 3 × 24 hours Indonesian law allows.

Children

This is a business-to-business site and it is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has sent us something, email dimas@difouma.com and we will look into it and delete it.

Changes to this policy

When this policy changes, the date at the top changes with it. If a change materially affects what we do with data we already hold, we will say so rather than quietly editing the page.