Privacy Policy
This Privacy Policy explains how RumahYa("we", "us", "our") collects, uses, stores, and protects your personal data when you visit rumahya.com(the "Site") or interact with our services. We are committed to protecting your privacy and complying with applicable data protection laws, including the EU General Data Protection Regulation (GDPR), the United Kingdom GDPR, the California Consumer Privacy Act (CCPA / CPRA), and Indonesian Personal Data Protection Law No. 27 of 2022 (UU PDP).
1. Data we collect
We only collect data you provide voluntarily or that is required for the Site to work.
| Category | Data | Source | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|---|---|
| Contact form | Name, email, phone (optional), message, type of interest | You — contact / lead form | Reply to your enquiry, send property information | Consent / pre-contractual measures |
| Property enquiries | Property reference, your name, email, message | You — listing detail page | Coordinate viewings, share owner details | Pre-contractual measures |
| Analytics | Anonymised IP, page views, device, browser, country, referrer; cookies _ga, _ga_* | Google Analytics 4 | Understand site usage and improve content | Consent (only after you accept the banner) |
| Maps | Approximate location, browser data while loading map tiles | Google Maps embedded on the /map page | Display interactive property map | Consent / legitimate interest |
| Hosting logs | IP address, request URL, timestamp, user-agent | Vercel (our hosting provider) | Site security, abuse prevention, debugging | Legitimate interest (Art. 6(1)(f)) |
| Admin authentication | Email, password hash, session cookies | Internal staff only — Supabase Auth | Manage listings and back-office | Contractual necessity |
We do not collect: government IDs, payment card details, banking credentials, biometric data, or special-category data (health, religion, political views, etc.).
2. Cookies and similar technologies
We classify cookies in two strict categories:
- Strictly necessary — required for the Site to function (page rendering, form submission, language preference). Always on. No consent required under GDPR Art. 5(3) ePrivacy.
- Analytics — Google Analytics 4 cookies (
_ga,_ga_*). Disabled by default. Loaded only after you click "Accept all" in our consent banner. We use Google Consent Mode v2 with a default state ofdenied.
You can change your choice at any time by clearing your browser's site data for rumahya.com or by emailing us.
3. How long we keep data
- Contact form messages — 24 months from last contact, then deleted.
- Lead enquiries (active negotiation) — duration of the relationship + 5 years (Indonesian commercial law).
- Analytics data — 14 months in Google Analytics, then aggregated.
- Hosting logs — up to 30 days.
- Admin accounts — duration of employment + 3 months.
4. Who we share data with
We share data only with processors strictly necessary to operate the Site. None of our processors sell your data.
| Processor | Role | Location |
|---|---|---|
| Supabase Inc. | Database, authentication, file storage | EU / US |
| Vercel Inc. | Hosting, edge network, deployment | EU / US |
| Resend (Plus Five Five Inc.) | Transactional email delivery | US |
| Google LLC | Analytics 4, Maps, Fonts | EU / US |
We do not sell, rent, or trade your personal data with third parties for marketing purposes.
5. International transfers
Some processors are located outside your country. When data leaves the EU/EEA, we rely on the European Commission's Standard Contractual Clauses (SCCs) and additional safeguards published by each processor. You can request a copy of the SCCs by emailing info@rumahya.com.
6. Your rights
Depending on where you live, you have the following rights:
- Access — request a copy of the data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure ("right to be forgotten") — request deletion.
- Restriction — limit how we process your data.
- Portability — receive your data in a machine-readable format.
- Objection — object to processing based on legitimate interest.
- Withdraw consent — at any time, without affecting prior processing.
- California residents (CCPA / CPRA)— right to know, delete, correct, opt-out of "sale" or "sharing" (we do neither), and non-discrimination.
- Indonesian residents (UU PDP) — equivalent rights of access, rectification, deletion, and withdrawal of consent.
To exercise any right, email info@rumahya.com. We respond within 30 days.
7. Right to lodge a complaint
If you believe we have not handled your data properly, you can complain to your local data protection authority. Examples: CNIL (France), AEPD (Spain), ICO (UK), Personal Data Protection Agency (Indonesia).
8. Security
We use HTTPS everywhere, encrypted databases, hashed passwords, role-based access control, and least-privilege permissions. We review our security posture regularly. No system is 100% secure — if we ever experience a breach affecting your data, we will notify you and the relevant authority within 72 hours, in line with GDPR Art. 33–34.
9. Children
The Site is not directed at children under 16. We do not knowingly collect data from minors. If you believe a minor has submitted data, contact us and we will delete it.
10. Automated decision-making
We do not use automated decision-making, profiling, or AI systems that produce legal or similarly significant effects on you.
11. Changes to this policy
We may update this policy from time to time. Material changes will be announced on the Site homepage at least 30 days before they take effect. The "Last updated" date at the top of this page reflects the current version.
12. Contact
Questions, complaints, or rights requests: info@rumahya.com.