Regulatory Reference
This Privacy Policy is prepared with reference to Law Number 27 of 2022 concerning Personal Data Protection (PDP Law) and its implementing regulations, explaining how PT SUCOFINDO (PERSERO) as a Personal Data Controller collects, uses, stores, discloses, and protects your personal data.
Information We Collect
We may collect the following types of information:
Personal Identification Data: Name, job title, company name, business email address, phone number, and physical mailing address provided when submitting inquiry forms, requesting price quotes, or downloading service booklets.
Account & Transaction Data: Login credentials for client portals, service requests, payment details, and billing history.
Technical & Usage Data: IP address, browser type, operating system, device identifier, and page interaction data collected automatically via cookies and tracking technologies.
How We Use Your Information
We process your personal data for the following business purposes:
Providing and managing our TIC (Testing, Inspection, Certification), consulting, and certification services.
Processing service inquiries, partnership proposals, and customer support requests.
Sending official business communications, service updates, and regulatory compliance notices.
Sending marketing updates, newsletters, and industry reports (only if consent has been granted).
Improving website functionality, performance, and user experience.
Ensuring compliance with applicable laws, regulations, and corporate governance standards.
Legal Basis for Processing
SUCOFINDO processes personal data based on one or more of the following legal bases:
Valid and explicit consent from you for specific purposes, including marketing;
Fulfillment of contractual obligations with you, including the provision of testing, inspection, certification, and consulting services;
Fulfillment of SUCOFINDO's legal obligations;
Protection of your vital interests;
Performance of tasks in the context of public interest or public service;
SUCOFINDO’s legitimate interests, taking into account the balance against your rights.
Data Processing in the Territory of Indonesia
All personal data collected by SUCOFINDO is stored and processed within the jurisdiction of Indonesia, including by technology service providers and partners acting on behalf of SUCOFINDO. SUCOFINDO does not transfer personal data outside the territory of Indonesia. If such transfer becomes necessary in the future, SUCOFINDO will ensure equivalent protection in accordance with the PDP Law and update this Privacy Policy beforehand.
Data Sharing & Disclosure to Third Parties
We do not sell or rent your personal information to third parties. We may share your data under the following conditions:
Authorized Service Providers: Trusted partners, laboratory networks, and IT infrastructure vendors acting on our behalf under strict confidentiality agreements.
Regulatory & Government Bodies: When required by law, court orders, or official regulatory requirements governing the TIC industry.
Corporate Transactions: In connection with corporate restructuring or official holding directives under the IDSurvey / SOE (BUMN) framework.
Consent and Marketing Communications
Opt-in. SUCOFINDO only sends marketing materials, newsletters, or promotional information if you have actively given consent, such as by checking an unchecked consent box on our forms. Marketing consent is requested separately from consent for service provision, and your refusal does not affect the services you receive.
Opt-out. You can stop receiving marketing communications at any time via the "unsubscribe" link in any marketing email, or by contacting the official channels below. We will stop sending marketing communications once your request is processed. Operational communications, such as service confirmations or compliance notices, may still be sent.
Data Retention
SUCOFINDO retains personal data while you use our services and for 1 month after the service relationship ends, or longer if required by laws and regulations, such as taxation and archiving provisions. After the retention period ends, personal data will be deleted, destroyed, or anonymized so that it can no longer identify you.
Your Rights
In accordance with the PDP Law, you have the following rights:
Right to information: obtain clarity regarding the identity, legal basis, purpose, and accountability of the processing of your personal data.
Right of access and copy: access and obtain a copy of your personal data that we store.
Right to update and correction: complete, update, and/or correct inaccurate or incomplete personal data.
Right to deletion: request the cessation of processing, deletion, and/or destruction of your personal data, provided it does not conflict with storage obligations under laws and regulations.
Right to data portability: obtain your personal data in a structured format commonly used and readable by electronic systems, and request the transfer of such data to another Personal Data Controller, provided the systems can securely communicate with each other.
Right to withdraw consent: withdraw consent given at any time, without affecting the legality of processing prior to withdrawal.
Right to objection and restriction: object to certain processing, including automated decision-making that has legal consequences or significant impacts on you, and request the suspension or proportional restriction of processing.
Right to file a complaint: submit a complaint to SUCOFINDO and, if unresolved, to the personal data protection supervisory institution in accordance with applicable provisions.
Request Submission Procedure
Requests to exercise rights can be submitted in writing through the channels listed in the Contact section. To protect your data, we will verify the applicant's identity before processing the request. SUCOFINDO will follow up on requests within the timeframe stipulated by the PDP Law. For data access and update requests, follow-up will be provided no later than 3 x 24 hours from receipt of a complete request. If a request cannot be fulfilled, we will convey the reasons in writing.
Personal Data Protection Failures
In the event of a personal data protection failure, SUCOFINDO will provide written notification to you and the authorized institution no later than 3 x 24 hours from the time the incident is known. The notification will contain the affected personal data, the time and manner of the incident, and the handling and recovery steps taken.
Children's Personal Data
SUCOFINDO's services are intended for business clients and adult users. We do not knowingly collect personal data from children. If the processing of children's data is necessary, it is done with parental or guardian consent in accordance with laws and regulations.
Cookie Policy
We use cookies to enhance your browsing experience, analyze site traffic, and present personalized content tailored to your industry needs. By clicking 'Accept Cookies', you agree to the use of cookies stored on your device for up to 1 month. Read our Privacy Policy to learn more.
Data Privacy Service Contact
PT SUCOFINDO has appointed the Information and Technology Division as the unit responsible for personal data protection management. For questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:
Email: helpdeskisb@sucofindo.co.id
Phone: +62 21 7983666 Ext. 1502
Address: Graha SUCOFINDO, Jl. Raya Pasar Minggu Kav. 34, Jakarta 12780
Policy Changes
SUCOFINDO may update this Privacy Policy from time to time to adapt to service or regulatory changes. Material changes will be informed through this website and/or via email before taking effect.
Effective Date: October 22, 2026 | Last Updated: October 22, 2026