Privacy Policy

1. Introduction

DFD Agency ("we", "our", or "us") respects your privacy and is committed to protecting your personal data. This privacy policy will inform you as to how we look after your personal data when you visit our website (regardless of where you visit it from) and tell you about your privacy rights and how the law protects you.

2. The Data We Collect

We may collect, use, store and transfer different kinds of personal data about you:

• Identity Data: Name, business name, and professional credentials provided during lead generation or project briefing.
• Contact Data: WhatsApp number, email address, and billing address.
• Transaction Data: Details about payments to and from you and other details of products and services you have purchased from us.
• Technical Data: IP address, login data, browser type and version, and platform data via session cookies.

3. How We Use Your Data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• To execute a contract we are about to enter into or have entered into with you (Project Delivery).
• To communicate project updates via WhatsApp or the Project Tracking Dashboard.
• Where it is necessary for our legitimate interests (or those of a third party).
• To comply with a legal or regulatory obligation.

4. Third-Party Integrations

To provide elite digital services, we share specific data with trusted third-party providers:

• Midtrans: For secure payment processing. We do not store your credit card or bank details on our servers.
• Google Gemini: To generate AI-assisted project copy and initial design conceptualization.
• Cloudinary: For hosting and optimization of project assets and thumbnails.

5. Cookies & Authentication

We use session-based authentication. Your login token (JWT) is stored in HttpOnly, Secure, SameSite=Strict cookies. This ensures maximum security against XSS and CSRF attacks. We do not use persistent tracking cookies for marketing without your explicit consent.

6. Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. Access to your project data via "Magic Links" is strictly limited to users with the unique project identification code.

7. Data Retention

We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

8. Your Legal Rights

You have rights under data protection laws in relation to your personal data, including the right to request access, correction, erasure, or restriction of processing of your personal data.