Privacy Policy

1. Data Controller

The data controller for information collected through this website is Fornex, with correspondence address at Jl. Bangka Raya No. 117, Jakarta 12720, Indonesia. Enquiries regarding this privacy policy may be directed to [email protected].

2. Personal Data Collected

This website collects personal data through the contact form on the contact page. The data fields collected are: full name, email address, and the content of the message submitted. An optional subject category may also be recorded. No other personal data is collected unless voluntarily provided in the message body.

Technical data collected automatically by the server includes: IP address, browser type and version, operating system, referring URL, page visit timestamps, and session duration. This data is held in standard server access logs and is not used for individual user profiling.

Cookie-related data is handled separately. See the Cookie Policy for details on what cookies are set, their purpose, and how to manage them.

3. Purpose and Legal Basis for Processing

Personal data submitted via the contact form is processed for the purpose of responding to the enquiry submitted. The legal basis for this processing is the legitimate interest of Fornex in handling correspondence, and the contractual interest where the enquiry relates to a product held by the correspondent.

Technical server log data is retained for security monitoring and aggregate traffic analysis. The legal basis for this processing is the legitimate interest of Fornex in maintaining the security and performance of this website.

Where cookies are used for analytics, the legal basis is consent as recorded through the cookie consent mechanism on this site. Functional cookies necessary for the operation of the website are placed on the basis of legitimate interest.

4. Data Retention

Contact form submissions are retained for a period of 24 months from the date of receipt, after which they are permanently deleted. Where a submission relates to a batch archive request, the correspondence record is retained for the same period as the batch archive itself — a minimum of five years from the batch release date.

Server access logs are retained for 90 days and then deleted. Analytics data, where collected with consent, is retained in aggregate form for up to 26 months before deletion.

5. Data Sharing and Third Parties

Fornex does not sell, rent, or trade personal data to any third party. Personal data submitted via the contact form is accessible only to the Fornex team responsible for correspondence.

This website loads external resources from the following third-party services, which may set cookies or receive limited technical data (IP address, browser data) via standard browser requests: Google Fonts (typography), jsDelivr CDN (open-source library delivery), CDNJS (open-source library delivery), unpkg (open-source library delivery), jQuery CDN, and Google Maps (on the contact page only, for location display). Each of these services operates under its own data protection practices.

Where analytics cookies are accepted, aggregate usage data may be processed by the analytics provider under a data processing agreement with Fornex. No individually identifiable data is shared in this context.

6. Your Rights

Under applicable data protection regulation, you hold the following rights with respect to personal data held by Fornex:

• The right to access personal data held about you
• The right to correction of inaccurate personal data
• The right to deletion of personal data (subject to retention obligations)
• The right to restrict processing of your personal data
• The right to data portability where processing is automated
• The right to withdraw consent where consent is the legal basis for processing
• The right to lodge a complaint with the relevant supervisory authority

To exercise any of these rights, submit a written request to [email protected]. Requests will be acknowledged within five business days and actioned within 30 days of receipt.

7. Data Security

This website is served over HTTPS exclusively. All data transmission between your browser and this server is encrypted. Contact form submissions are transmitted securely and stored with access restricted to authorised Fornex personnel. Password-protected access controls and access logging are applied to any system holding personal data.

No system can guarantee absolute security. In the event of a data breach affecting personal data held by Fornex, affected correspondents will be notified in accordance with applicable regulatory requirements.

8. Product Classification Note

Fornex products are nutritional food-supplements registered with the applicable local regulatory authority under food-supplement classification. Products meet compositional and labelling requirements for nutritional supplement categories.

9. Changes to this Policy

This privacy policy is reviewed periodically and updated when changes to data processing practices occur or when regulatory requirements change. The date of the most recent revision is displayed at the top of this page. Material changes will be indicated with a version note.

Continued use of this website after a policy update constitutes acknowledgement of the updated policy. Where consent is required for specific processing activities, renewed consent will be requested separately.