Privacy Policy

This Privacy Policy explains how PT Aussie Core Builders ("we", "us") handles personal data collected through the marketing website solbyicg.com (the "Site"). The Site does not sell securities, take payments, or operate any user account; its sole purpose is to inform prospective buyers about the SOL Nusa Dua villa development and to forward inquiries to our sales team.

Who we are

We act as the data controller for personal data submitted through the Site.

What data we collect

We collect only what we need to answer inquiries and run the Site. Specifically:

• Contact-form submissions. Name and phone are required. Email, investment amount, timeframe, message, and (when you ask about a specific villa from the gallery) villa type, price, and area are optional. A hidden honeypot field and the timestamp at which the form was rendered are also captured solely to detect automated submissions.
• Local browser storage. Your language preference (`language`) and your cookie-consent choice (`sol-consent-v1`). These are stored in your browser only and never sent to us.
• Server logs. Standard hosting logs (IP address, user-agent, timestamp, requested path) are processed by our hosting provider Vercel for operational and security purposes.
• Analytics — only with your consent. If you opt in to analytics we may load Google Analytics 4 (with IP-anonymisation enabled), Vercel Analytics / Speed Insights, and Microsoft Clarity (heatmaps + session recordings — Clarity automatically masks form inputs and other sensitive content). They collect page views, referrer, approximate location derived from IP, device and browser characteristics, scroll/click interactions, and Web Vitals. None of this loads before you consent.
• Marketing — only with your consent. If you opt in to marketing we may load advertising and remarketing pixels — currently Google Ads conversion tracking and the Meta (Facebook) Pixel — to measure campaign performance and serve relevant ads on partner platforms. None of this loads before you consent. We also honor the Global Privacy Control browser signal: if your browser sends GPC, we treat marketing as refused and ignore any UI choice that would enable it.
• Marketing UTM and click identifiers. When you arrive from an ad, link, or search engine we may capture standard UTM parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and click identifiers (gclid, fbclid) from the URL, plus the referrer and landing path, into the browser session. If you submit the contact form within that session, we attach those values to your inquiry so the sales team knows where you came from. They are not stored on our servers beyond the Telegram message and are cleared when you close the tab.
• Anti-bot verification — Cloudflare Turnstile. When the contact form is loaded, Cloudflare's Turnstile widget collects a small set of behavioural signals (mouse movement timing, browser characteristics) to issue a one-time token proving you are not a bot. We submit this token along with your form, and Cloudflare verifies it server-side. Turnstile is privacy-friendly (no tracking cookies, no fingerprinting for advertising) and is treated as strictly necessary for form security.

Why we use it and our legal bases (GDPR Art. 6)

• Responding to inquiries, scheduling consultations, and preparing offers — pre-contractual measures and our legitimate interest in running a sales process (Art. 6(1)(b) and (f)).
• Detecting automated/spam submissions via the honeypot and timing fields — legitimate interest in protecting the Site (Art. 6(1)(f)).
• Operating, securing, and debugging the Site (server logs) — legitimate interest (Art. 6(1)(f)).
• Analytics — your consent (Art. 6(1)(a)).
• Future marketing communications — your consent (Art. 6(1)(a)).

Cookies and similar technologies

We use the minimum tracking required, organised into three categories:

• Strictly necessary. Stores your language preference and your consent choice in localStorage, plus per-session UTM/referrer in sessionStorage and the Cloudflare Turnstile anti-bot challenge. Always on; cannot be disabled because the Site cannot function without them.
• Analytics (opt-in). Google Analytics sets `_ga` and `_ga_<container>` cookies and reports events to Google. Vercel Analytics and Speed Insights use cookieless beacons. Microsoft Clarity sets first-party `_clck` and `_clsk` cookies for session continuity in heatmaps/recordings. Loaded only after you click "Accept all" or enable Analytics in Customize.
• Marketing (opt-in). Google Ads conversion tracking (via gtag.js, may set `_gcl_*` cookies). Meta (Facebook) Pixel sets `_fbp` cookie and may use `_fbc` when arriving via a Meta ad. Loaded only after you opt in to Marketing — and never if your browser sends a Global Privacy Control signal.

Manage your preferences

You can change or withdraw your consent at any time below. Changes take effect immediately.

Third parties we share data with

We rely on a small number of processors. We share only what each processor needs.

• Telegram FZ-LLC (UAE). Inquiry forwarding. When you submit the contact form, the message is delivered to a private Telegram chat we monitor. Telegram processes the message under its own privacy policy.
• Vercel Inc. (USA / EU edge). Hosting, content delivery, server logs, and (with your consent) Vercel Analytics and Speed Insights.
• Cloudflare Inc. (USA / global edge). Turnstile anti-bot verification on the contact form. Cloudflare receives the Turnstile signals (browser characteristics, interaction timing) needed to issue and verify the challenge token; it does not use them for advertising.
• Google LLC / Google Ireland Limited. Google Analytics (with Analytics consent only) and Google Ads conversion tracking (with Marketing consent only). For visitors in the EU/EEA, Google Ireland is the data importer.
• Microsoft Corporation (USA). Microsoft Clarity heatmaps and session recordings (with Analytics consent only). Clarity automatically masks form inputs, password fields, and other sensitive content before recording.
• Meta Platforms Ireland Limited / Meta Platforms, Inc.. Meta (Facebook) Pixel for measuring ad-campaign performance and remarketing (with Marketing consent only). For visitors in the EU/EEA, Meta Platforms Ireland is the data importer.

International transfers

Personal data may be transferred to Indonesia (where we are established), the United States (Telegram, Google, Vercel infrastructure), and the European Union (Vercel EU edge). For transfers from the EU/EEA, UK, or Switzerland to recipients in countries without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (SCC) and apply data minimisation.

How long we keep data

• Inquiry messages forwarded to Telegram remain in the Telegram chat history for up to 24 months from the date of contact, unless a longer period is required for an active sales process or by law.
• Hosting and security logs follow Vercel's retention.
• Analytics data is retained per the Google Analytics retention setting we have configured (default 14 months) and Vercel's policies.
• After these periods data is deleted or anonymised.

Your rights

Depending on where you live, you have some or all of the following rights:

• Access — request a copy of your data.
• Rectification — correct inaccurate data.
• Erasure ("right to be forgotten") — ask us to delete your data.
• Restriction — limit how we use your data.
• Data portability — receive your data in a portable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent at any time, where processing is based on consent (this does not affect the lawfulness of processing before withdrawal).
• Lodge a complaint with your supervisory authority (e.g. your EU member-state DPA, the OAIC in Australia, or Kominfo in Indonesia).

California residents have additional rights under the CCPA/CPRA, including the right to know what we collect, to delete it, and to opt out of any "sale" or "sharing" of personal information for cross-context behavioural advertising. We provide a "Do Not Sell or Share My Personal Information" link in the site footer that immediately turns off all marketing pixels for your browser. We also automatically honor the Global Privacy Control browser signal (`navigator.globalPrivacyControl === true`) as a do-not-sell-or-share request: when GPC is detected, the marketing category stays off regardless of UI choices.

How to exercise your rights

Email info@solbyicg.com from the address you used to contact us, or call +62 813 3704 3467. We aim to respond within 30 days.

Security

All traffic is served over HTTPS. The contact form is validated server-side, protected by an origin allow-list, a hidden honeypot, and a minimum-fill-time check. We apply security headers (CSP, HSTS, Permissions-Policy, COOP/CORP) and minimise the data we collect. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

The Site is intended for an adult audience. We do not knowingly collect data from persons under 18.

Changes to this Policy

We may update this Policy as the Site or applicable law changes. The current version date is shown at the top. Material changes will be flagged on the Site.

Contact