Privacy policy
This policy explains how Palmus handles personal information when you browse our editorial website, contact the desk or interact with optional measurement tools. It is written for readers in Indonesia and is intended to make our practices understandable. Palmus is an informational publisher, not a clinical service. We collect only information needed to operate, secure and improve the site.
1. Scope and controller
This policy applies to Palmus pages, forms and communications connected with this website. The responsible contact is Palmus at Jl. Raya Cilandak KKO No.17, RT.1/RW.5, Ragunan, Ps. Minggu, Kota Jakarta Selatan, Daerah Khusus Ibukota Jakarta 12560, Indonesia. The policy does not govern third-party sites linked from our pages. We review the document when our services or legal obligations change. It covers readers who browse articles, people who submit the contact form, and anyone who writes to the editorial desk or telephones the published number. The same rules apply whether you use a desktop browser, a phone or a tablet, and whether you are reading from Jakarta or from another city. Our approach is framed around Indonesia’s Law No. 27 of 2022 on Personal Data Protection and related rules on electronic systems, and where two requirements overlap we follow the stricter one.
- (a) The Palmus editorial desk acts as the controller for contact messages and site security logs.
- (b) Hosting and security providers act as processors and follow our written instructions.
- (c) When you leave Palmus through an external link, the privacy notice of that site applies instead of this one.
2. Information collected
We may receive a name, email address and the content of a message when you use the contact form. Server logs may record an IP address, browser type, device information, requested page and timestamp for security and reliability. We do not request health records, biometric identifiers or payment details through the editorial site. Please do not send sensitive medical information in a general enquiry. Palmus has no reader accounts, so there is no password database or profile page behind the site. If you paste a training log or a wearable report into a message, we receive it exactly as written, and we may delete the attachment portion if it is not needed to answer your question. Information you give about another person should be limited to what is necessary and should not identify them without their agreement.
- (a) Contact form: name, email address, subject line, message text and the time of submission.
- (b) Server logs: IP address, browser user agent, referring page, requested address and response status.
- (c) Browser storage: the optional cookieChoice value that remembers your cookie decision.
- (d) Telephone: the caller number and brief handwritten notes, kept only when a follow-up is needed.
3. Purposes
Information is used to answer enquiries, review corrections, maintain site security, understand aggregate readership and meet legal obligations. Editorial messages may be routed to the small team member responsible for the relevant topic. We do not use contact submissions to make automated decisions about a person. We do not sell personal information to data brokers. A question about interval training, for instance, may be read by the editor who covers cardiovascular endurance and answered by email. Aggregate readership figures help us decide which explainers need clearer wording, and they are reviewed as totals rather than as individual reading histories. We do not use your details for unrelated mailing lists, and we do not add you to a newsletter unless you separately ask for one.
- (a) Responding to questions, accessibility reports and requests for corrections.
- (b) Detecting spam, repeated failed submissions and other abuse of the contact form.
- (c) Producing aggregate counts of page use for editorial planning.
- (d) Responding to lawful requests from Indonesian authorities where the request is valid and specific.
4. Legal basis and consent
We rely on consent where you choose optional cookies or submit a voluntary message, and on legitimate operational interests for security logs and basic service administration. You may withdraw optional cookie consent through your browser controls or by contacting us. Withdrawal does not affect processing already completed lawfully. Where Indonesian law requires a different basis, we apply the applicable requirement. Consent is requested through the cookie banner in plain language, and the reject option is presented with the same prominence as accept. Sending a message is a voluntary act, and we treat it as agreement for us to read the message and reply to the address you provided. If we ever wished to use your message for another purpose, such as quoting it in an article, we would ask for your permission first and would remove identifying details by default.
- (a) Consent: optional cookies and voluntary contact messages.
- (b) Legitimate operational interest: security logs, spam filtering and basic administration of the site.
- (c) Legal obligation: retention or disclosure that Indonesian law specifically requires.
- (d) We aim to act on a withdrawal of consent within three calendar days, although browser-held cookie choices can be cleared by you immediately.
5. Retention
Contact enquiries are normally retained for 24 months after the last meaningful exchange, unless a longer period is needed to resolve a correction or legal matter. Security logs are generally retained for 90 days. Cookie choices may remain in your browser for up to 12 months. Aggregated statistics that cannot reasonably identify a person may be kept for longer because they are not personal profiles. When a retention period ends, messages are deleted from the mailbox and from routine backups, which are overwritten on a rolling cycle of about 35 days. If you ask us to delete a message earlier, we will do so unless we must keep a limited record to show that a correction or complaint was handled.
- (a) Contact messages and replies: 24 months after the last exchange.
- (b) Correction case notes: up to 36 months, stripped of unnecessary personal detail.
- (c) Telephone notes: up to 6 months.
- (d) Security and access logs: 90 days.
- (e) cookieChoice: up to 12 months; optional analytics identifier: up to 13 months.
6. Service providers
We may use hosting, security, email delivery and aggregated analytics providers acting on our instructions. The processors named in this edition are Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (web hosting and backups); Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, United States (content delivery and security filtering); Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States (email handling for the [email protected] mailbox); and a self-hosted Matomo analytics installation that runs on the same hosting account and does not pass data to advertising networks. Providers receive only the data needed for their function and are expected to apply confidentiality and security controls. We do not permit advertising partners to use contact form content for audience targeting. A current provider list can be requested through the contact page. At present the categories in use are a cloud hosting provider, a content delivery and security filtering operator, a business email host and, only where optional analytics is enabled, an aggregated measurement service. Each relationship is covered by written terms that restrict use of the data to our purposes and require prompt notice of any security incident.
7. Cookies
Essential session mechanisms support navigation and security. The optional cookie named cookieChoice records whether you selected accept or reject and lasts for up to 12 months. If analytics is enabled, it uses an aggregated measurement identifier with a maximum 13-month retention setting and no direct health profiling. More detail appears in the cookie policy, including how to change browser settings. The cookies relevant to this page are summarised below, and the cookie policy describes each one in more depth.
- (a) palmus_session: essential session identifier, removed when you close the browser.
- (b) cookieChoice: your accept or reject decision, up to 12 months.
- (c) palmus_ma: optional aggregated analytics identifier, up to 13 months, set only after you accept.
8. International transfers
Some hosting or technical providers may process information outside Indonesia. When that occurs, Palmus seeks contractual confidentiality, access controls and an appropriate legal mechanism or comparable safeguard. We do not intentionally publish contact submissions. Readers should understand that internet transmission can involve routing through more than one jurisdiction. Data centre regions in Singapore or elsewhere in the Asia-Pacific are the most likely locations for processing outside Indonesia. We prefer providers that let us choose a region, and we avoid transferring contact messages to a country where we cannot obtain an equivalent level of protection through contract. If you would like to know where a specific message was processed, you can ask through the contact page.
9. Your choices and rights
You may ask for access, correction, deletion, restriction or an explanation of processing, subject to lawful exceptions. Requests may be addressed directly to the Data Protection Officer, Maya Kusumawardani, by email at [email protected], by telephone on +62 813 9587 4123 on weekdays between 09:00 and 17:00 Western Indonesia Time, or by post to Palmus, Data Protection Officer, Jl. Raya Cilandak KKO No.17, RT.1/RW.5, Ragunan, Ps. Minggu, Kota Jakarta Selatan, Daerah Khusus Ibukota Jakarta 12560, Indonesia. You may also object to optional measurement or withdraw a consent choice. Send a request through contact.php with enough detail for us to identify the relevant message, but do not include unnecessary identity documents. We aim to respond within 30 calendar days and may request reasonable verification. We acknowledge each request within five business days so you know it has been received. Verification normally means replying from the same email address used in the original message. If a request is complex or we need more time, we will tell you the reason and the new date in writing, and if we decline part of a request we will explain which lawful exception applies.
- (a) Access: a copy or summary of the messages and notes we hold under your email address.
- (b) Correction: updating inaccurate contact details or a mis-recorded message.
- (c) Deletion: removal of correspondence, except a minimal record where a legal reason applies.
- (d) Restriction and objection: pausing optional measurement or limiting how a message is used.
- (e) How to ask: use the contact page, choose the subject Privacy request, or telephone +62 813 9587 4123 during office hours.
10. Security
We use access limitation, ordinary platform security controls, encrypted transport where supported and periodic review of administrative access. No online service can promise absolute security. If you believe you sent sensitive information accidentally, contact us promptly so we can assess the issue. We do not ask for passwords by email. Only the team members who handle correspondence can read contact messages, and access is removed when a role changes. If we discover an incident that affects personal data, we will assess its scope, take steps to contain it and notify affected individuals and the relevant authority within the time that Indonesian law requires.
- (a) Encrypted connections are used for the website and the contact form where the browser supports them.
- (b) Administrative access is limited, reviewed at least every quarter and removed on departure.
- (c) Mailboxes are protected with unique credentials and a second verification step.
11. Complaints and contact
Questions or complaints may be sent to the address and phone number in the footer, including +62 813 9587 4123. We will acknowledge a privacy request and investigate it fairly. If the concern cannot be resolved directly, you may contact the relevant Indonesian authority or seek independent legal advice. A complaint will not affect your ability to read Palmus. Office hours for telephone enquiries are Monday to Friday, 09:00 to 17:00 Western Indonesia Time, and messages left outside those hours are answered on the next working day. We acknowledge a written complaint within five business days and aim to send a reasoned reply within 30 calendar days. The reply will describe what we checked, what we changed if anything, and the options available to you if you remain unsatisfied, including the Ministry of Communication and Digital Affairs.
12. Changes
The current edition was reviewed on 5 October 2026. Earlier material was consolidated into this edition on 1 July 2026, when the cookie explanation and retention schedule were clarified. Future changes will be dated at the top of this page and will not quietly expand collection beyond the described purposes. Continued use after a material notice indicates awareness, while consent-based processing will request consent where required. Minor wording corrections that do not change meaning are recorded in the log below without a separate notice. Where a change affects how long data is kept or who receives it, we will show the notice on the home page for at least 30 days.
- (a) 1 July 2026: cookie explanation and retention schedule consolidated.
- (b) 17 August 2026: wording on international transfers and provider categories clarified.
- (c) 5 October 2026: full review, rights procedure and response times described in more detail.