Privacy Policy — PT Makuta Loka Sampurna

This policy explains how PT Makuta Loka Sampurna ("we", "us"), an Indonesian company with its registered office at Karangjati RT 1 RW 7, Desa Kecila, Kec. Kemranjen, Kab. Banyumas, Jawa Tengah 53194, Indonesia, handles data — both on this website and in the course of operating advertising and marketplace accounts for our clients.

1. This website

This site is a set of static pages. It sets no cookies, runs no advertising or analytics trackers, embeds no third-party scripts, and does not profile visitors. Our hosting provider processes standard server logs (IP address, user agent, requested page, timestamp) to deliver the site and protect it from abuse. We do not use those logs to identify individuals.

If you contact us by email, phone or WhatsApp, we hold what you send us — your name, contact details and the content of your message — in order to reply and, if we go on to work together, to manage the engagement.

2. Data we handle for clients

Our services involve operating advertising and marketplace accounts that belong to our clients. In relation to that data our client is the controller and we act on their instructions. This typically includes:

Advertising performance data — spend, impressions, clicks, conversions, orders, revenue and return on ad spend, at advertiser, campaign, ad group, ad and creative level
Account and campaign metadata — account, campaign and creative names, settings and status, used to label and organize the reported metrics
Marketplace order and settlement data — order, revenue, return and payout records from the seller accounts we operate
Creator and affiliate data — collaboration status and commission performance for creators working with the brand

Where any of this includes personal data — for example a customer name or contact detail in an order record — we process it only to carry out the operational task the client engaged us for, such as fulfilling or following up an order.

3. How we obtain it

We access an account only where its owner has granted us access, through the relevant platform's own authorization mechanism or by adding us as an authorized user. We use official platform APIs and interfaces for the accounts we are authorized to operate. We do not scrape data belonging to advertisers or sellers who have not engaged us, and we do not purchase personal data from data brokers.

4. Why we use it

To operate, optimize and report on the accounts our clients have engaged us to run
To reconcile advertising spend against marketplace revenue and produce daily reporting
To detect problems — pacing drift, stock issues, campaign failures — and act on them
To meet our contractual, tax and accounting obligations

The legal basis is the performance of our contract with the client, our and our client's legitimate interest in running their commercial operations effectively, and, where required, consent obtained by the client.

5. What we do not do

We do not sell, rent or broker data, in any form, to anyone
We do not pool one client's data with another's, or use it to benefit a competing brand
We do not use platform-derived data for advertising unrelated to the account it came from
We do not build or share cross-platform profiles of individual consumers

6. Sharing

We disclose data only in these situations:

To the client it belongs to, and to people they authorize to see their accounts
To service providers that host or support our systems, bound by confidentiality and permitted to process data only on our instructions
Where the law requires it, or to establish, exercise or defend legal claims

7. Storage, security and retention

Data is held in access-controlled systems on established cloud infrastructure. Access is limited to the members of our team who need it for the account in question. Platform credentials and API tokens are stored as encrypted secrets, separate from application data, and are never included in reports or exports. Client data is segregated per brand.

We keep operational and reporting data for the duration of the engagement and for up to twenty-four months afterwards, to support year-on-year comparison and to meet accounting obligations, unless the client asks us to delete it sooner. Website enquiry correspondence is kept for up to twelve months if it does not lead to an engagement.

8. Withdrawal of access

A client may revoke our access to their advertising or marketplace accounts at any time, directly on the platform. When access is revoked, collection for those accounts stops. On written request we will delete the data we hold for those accounts, subject to records we are legally required to retain.

9. Your rights

Subject to Indonesian data protection law, you may ask us to confirm what data we hold about you, to correct it, to delete it, or to restrict how we use it. If the data was provided to us by a brand whose accounts we operate, we will refer your request to that brand as controller and support them in answering it.

Send requests to info@loops.my.id with "Data request" in the subject line. We respond within thirty days.

10. Platform terms

Where we use a platform's advertising or commerce APIs, we do so in accordance with that platform's developer terms and data policies, including limits on how long platform-derived data may be retained and the requirement to delete it when authorization ends. Those terms apply in addition to this policy.

11. Children

Our services are business-to-business. We do not knowingly collect data from anyone under the age of eighteen.

12. International transfers

Our systems run on cloud infrastructure that may process data outside Indonesia. Where that happens we rely on providers offering appropriate contractual and technical safeguards.

13. Changes

We will update this policy when our practices change, and will revise the date at the top. The current version is always published at this address.

14. Contact

PT Makuta Loka Sampurna
Karangjati RT 1 RW 7, Desa Kecila, Kec. Kemranjen, Kab. Banyumas, Jawa Tengah 53194, Indonesia
info@loops.my.id · +62 852-2744-2552