Privacy Policy

In these cases, you will be informed of the type of data captured and the purpose for which the data is to be processed before you submit your personal information. In addition, you will be asked to give your consent which can be revoked at any time.

The personal data captured by our website and social media accounts will only be shared with companies within the corporate group and sales partners where this is necessary for data processing and where you have given your consent.

For users in Indonesia, the sections H.-M. below (Indonesia Privacy Policy Addendum, International Transfers, Your Rights as a Data Subject under Indonesian Law, Language) apply in addition to this Privacy Policy.

 

B. Other Data

We do not collect any other personal data aside from the data described in Section A. We only collect general information about your computer or mobile device so that we can improve the usability and visibility of our services. This information includes screen resolution, operating system and version number, browser. The cookies and social plug-ins we use are described in our Cookie Policy. On the Indonesia site and social media accounts, additional transparency regarding consent choices and tool-specific processing is available via the Privacy Settings.

 

C. Data Security

Appropriate technical and organizational measures ensure that the data stored on our website, social media accounts and other systems is protected against loss, destruction, unauthorized access, manipulation and disclosure. However, despite regular checks, it is impossible to provide complete protection against online threats.

Some processing is performed by contracted processors that provide social media and messaging management, monitoring and analytics, customer engagement, and service integrations (the “Platform Services”). We ensure appropriate contractual safeguards, security measures, and – where applicable – cross-border transfer mechanisms as set out in Section G. and the Indonesia Privacy Addendum (Section H.).

 

D. Links to Other Providers

Our website and social media accounts include further relevant information from other providers. The content linked to our digital platforms is produced by third parties over whom we exercise no control. We are not responsible for the content of external sites or social media accounts. This Privacy does not apply to linked websites, platforms, or social media accounts.

 

E. Information, Correction & Deletion (and additional rights for Indonesia)

If you would like to know what personal information we have about you, ask for a copy of your information. Any mistakes can be corrected and personal data can be deleted if requested. In addition, the right to restrict access to data and the right to data portability is applied on a case-by-case basis. Please send your inquiries to privacy@blum.com.

For users in Indonesia, the full catalogue of rights under the Indonesian PDP Law applies as set out verbatim in Section I (“Your Rights as a Data Subject under Indonesian Law”), together with instructions on how to exercise these rights. We will respond in accordance with applicable laws and within statutory timeframes.

 

F. Questions, Ideas & Comments

If you have any questions about the Blum Privacy Policy, any ideas or comments, please contact privacy@blum.com.

 

G. International Data Transfers (Indonesia – Article 56 PDP Law)

Where personal data is transferred outside the Republic of Indonesia, we comply with Article 56 PDP Law by ensuring one of the following:

(1) the destination jurisdiction ensures an equivalent or higher level of protection (Art. 56 Section 2 PDP Law); or

(2) appropriate and binding safeguards are in place to achieve equivalent protection (Art. 56 Section 3 PDP Law); or

(3) where neither is available, we transfer only on the basis of your explicit, informed consent (Art. 56 Section 4 PDP Law).

For information on safeguards or destination countries, contact us at […].

 

H. Indonesia Privacy Addendum (PDP Law – Law No. 27/2022)

This Addendum applies to users in Indonesia and supplements Sections A.-G.

1. Controller and Contact (Art. 21 Section 1 PDP Law)

For users in Indonesia, the data controller is: […, Full legal name and Indonesian address], Email: […]. If appointed, our Data Protection Officer or Indonesian contact point can be reached at: […]

2. Purposes and Legal Bases for Processing (Art. 21 Section 1, lit. b), c); Art. 20 Section 1, lit. a), c) PDP Law)

We use digital tools that support social media and messaging management, monitoring and analytics, customer engagement and service integrations (the “Platform Services”). These services process persona data such as interaction/engagement metadata, publicly available social media content, and contact details you submit. We process personal data for publishing/support and engagement/community management across social and messaging channels, social listening/monitoring and related analytics, marketing/lead management and customer support workflows, service optimization, performance measurement and security. Legal bases under Indonesian law include consent where required (Art. 20 Section 1 lit. a) PDP Law) and compliance with legal obligations where applicable (Art. 20 Section 1 lit c) PDP Law).

3. Processing, Storage, Recipients, and Security (Art. 16, 29, 30, 55 PDP Law et seq.)

We describe categories of data, recipients, and security in Sections A.-C. and E. We retain personal data for the purposes above. We retain data only as long as necessary for the purposes above or as required by law, followed by deletion or anonymization. Categories of recipients include our contracted processors that provide Platform Services, affiliated companies, and authorities where required.

4. Transparency and Consent Management (Privacy Settings)

On the Indonesia site and social media accounts, our Privacy Settings provide individual toggles under “Marketing” and “Services” for each Platform Service. Each toggle/drop-down discloses the service purpose, categories of data, legal basis (Art. 20 s. 1 lit. a/c PDP Law), storage/retention, international transfers under Art. 56 PDP Law, and links to this Addendum. You may withdraw or change your choices at any time via the Privacy Settings without affecting prior lawful processing.

5. International Transfers (Art. 56 PDP Law)

International transfers follow Section G.

6. Language

This Addendum is provided in English and Bahasa Indonesia. For Indonesian compliance, the Bahasa Indonesia version prevails.

 

I. Your Rights as a Data Subject under Indonesian Law

Under the Indonesian Personal Data Protection Law (PDP Law, Law No. 27/2022), you have the following rights regarding your personal data:

1. Right to Information (Art. 5 PDP Law)

You have the right to be informed about the identity and contact details of the data controller, the purposes and legal basis for processing your personal data, the types of data collected, retention periods, recipients or categories of recipients, details regarding cross-border transfers, and your rights under applicable law.

2. Right of Access (Art. 7 PDP Law)

You may request confirmation as to whether we process your personal data and obtain access to such data, including information on how it is used.

3. Right of Rectification (Art. 6 PDP Law)

You have the right to request correction or updating of inaccurate or incomplete personal data that we hold about you.

4. Right to Erasure (Art. 8 PDP Law)

You may request deletion or destruction of your personal data in certain circumstances, such as when consent is withdrawn, when processing is no longer necessary for its original purpose, or when processing is unlawful.

5. Right to Restrict Processing (Art. 11 PDP Law)

You may request that we restrict the processing of your personal data in certain situations (for example, if you contest its accuracy or lawfulness).

6. Right to Object (Art. 10 Section 1 PDP Law)

You have the right to object to certain types of processing, including direct marketing or profiling activities.

7. Right to Data Portability (Art. 13 PDP Law)

Where technically feasible, you may request a copy of your personal data in a structured and commonly used format for transfer to another service provider.

8. Right to Withdraw Consent (Art. 9 PDP Law)

Where processing is based on your consent, you may withdraw that consent at any time without affecting prior lawful processing.

9. Right Not To Be Subjected Solely To Automated Decision-Making (Art. 10 Section 1 PDP Law)

You have the right not to be subject solely to decisions based on automated processing that produce legal effects or significantly affect you.

10. Right to Lodge a Complaint (Art. 12 Section 1 PDP Law)

If you believe your rights have been violated, you may file a complaint with the relevant supervisory authority or seek remedies through available dispute resolution mechanisms.

11. How to Exercise Your Rights

To exercise any of these rights or if you have questions about how we process your personal data, please contact us at: […]

We will respond to your request in accordance with applicable laws and within statutory timeframes.

 

J. Amendments to the Blum Privacy Policy

Should any changes be made to our Privacy Policy, the amended version and date of the most recent version will appear on this page. For Indonesian users, we will update Sections G-I as needed to reflect changes in Indonesian law and to cover any new Platform Services with similar functions. The Indonesia Addendum and relevant notices will be available in English and Bahasa Indonesia and will be accessible from the Indonesia homepage, social media accounts and the Privacy Settings.

 

K. Availability of Bahasa Indonesia Version (Indonesia)

A Bahasa Indonesia version of this Privacy Policy (including Section G.-I.) is available on our Indonesia homepage and social media accounts. In case of any discrepancy for local compliance, the Bahasa Indonesia version prevails.