GDPR Compliance

PT Wastu Peladen Nusantara ("Company", "we", "us") is committed to protecting the personal data of users in the European Economic Area (EEA) and the United Kingdom in compliance with the General Data Protection Regulation (GDPR) and UK GDPR. This page describes how we meet those obligations.

1. Data Controller

PT Wastu Peladen Nusantara, trading as Cloudnan, is the data controller for personal data collected through the Cloudnan platform. For data-related inquiries, contact us at [email protected].

2. Legal Bases for Processing

We process personal data only where we have a valid legal basis under GDPR Article 6:

• Contract performance — processing your account details, billing information, and service delivery data to fulfil the subscription agreement.
• Legitimate interests — security logging, fraud prevention, and service reliability monitoring.
• Legal obligation — retaining transaction records as required by Indonesian financial regulation.
• Consent — optional analytics and marketing communications, where you have explicitly opted in.

3. Your Rights

Under GDPR you have the following rights with respect to your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — ask us to correct inaccurate or incomplete data.
• Right to erasure — request deletion of your data where there is no overriding legal basis to retain it.
• Right to restriction — ask us to restrict processing in certain circumstances.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests.
• Right to withdraw consent — withdraw any consent given at any time without affecting prior processing.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

4. Data Retention

We retain personal data only as long as necessary for the purposes it was collected, or as required by law. Account data is deleted within 90 days of account closure. Billing records are retained for 5 years as required by Indonesian financial regulations. Aggregated, anonymised operational metrics may be retained indefinitely.

5. International Data Transfers

Our services are operated from Indonesia. If you are accessing Cloudnan from the EEA or UK, your data is transferred to a third country. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission as the transfer mechanism where applicable. Our Data Processing Agreement (DPA) includes SCCs — see our DPA page for details.

6. Sub-processors

We use a limited set of trusted sub-processors to deliver the service:

• Payment processors — for billing transactions
• Cloud infrastructure providers — for hosting and data storage
• AI model providers (Anthropic, OpenAI) — solely to process prompts you submit to the AI Assistant feature

All sub-processors are bound by data processing agreements and are required to implement appropriate technical and organisational security measures.

7. Supervisory Authority

If you are in the EEA and believe we have not addressed your concerns satisfactorily, you have the right to lodge a complaint with your local data protection supervisory authority.

8. Contact

For all GDPR-related enquiries, contact our privacy team at [email protected].