Not sold or rented
We do not sell or rent personal data for advertising or data brokerage.
PRIVACY POLICY
Trust is part of conservation.
This policy explains the personal data we process, why we use it, who may receive it, how we protect it, and the choices and rights available to you.
Effective and last updated12 August 2026
Our commitment at a glance
Used for defined purposes
Data is used for services, security, conservation operations, and applicable obligations.
You remain in control
You may request access, correction, restriction, consent withdrawal, or deletion as permitted by law.
1. Who controls your data
PT. Nusantara Carbon Lestari (“Nusantara Carbon”, “we”, “us”) acts as the Personal Data Controller when it determines the purposes and means of processing through our services.
Correspondence address: STC Senayan Building, 3rd Floor, Jl. Asia Afrika Pintu IX, Gelora Senayan, Central Jakarta, Indonesia. Privacy contact: info@nusantaracarbon.id.
2. Scope of this policy
This policy applies when you use nusantaracarbon.id and its official subdomains, NCDE Enterprise Identity and Workspace, NCIS Spatial Intelligence and Field Operating System, NC-AI, Knowledge & Impact, the SEAL Team portal, forms, support services, and WhatsApp communications managed by us.
Third-party websites or services opened through links from our services are governed by their own privacy policies.
3. Data we may process
The data involved depends on the service you use and your role within the Nusantara Carbon ecosystem.
- Identity and contact data: name, email address, WhatsApp number, organisation or group, user classification, programme, operational area, role, rank, and application notes.
- Account and verification data: password hashes, session tokens, registration status, temporary verification codes, verification times, message identifiers, and sent, delivered, or read statuses.
- Technical and security data: IP address, device and browser type, access time, login activity, audit logs, error records, and abuse-prevention indicators.
- Conservation operations data: locations, coordinates, photographs, video, voice recordings, field reports, missions, observations, activity evidence, habitat or biodiversity data, and related metadata.
- Content you submit: questions to NC-AI, articles, documents, comments, feedback, correspondence, and other materials you choose to provide.
- Data from authorised sources: information provided by programme partners, coordinators, communities, agencies, or lawful public sources for service and verification purposes.
4. Why we use data
- To receive and process registrations, verify identity, activate accounts, and manage role-based access.
- To send OTP codes, service notices, application updates, mission information, and relevant operational communications.
- To run conservation programmes, field coordination, SATOR Square, reporting, monitoring, measurement, verification, audits, and impact documentation.
- To provide search, publication, knowledge support, analysis, and AI-assisted services with appropriate oversight.
- To secure our services, prevent fraud or abuse, investigate incidents, and enforce access requirements.
- To comply with legal, accounting, contractual, governance, community-safeguard, and lawful authority requirements.
- To improve service reliability, accessibility, and quality using minimised or aggregated data where possible.
5. Lawful bases for processing
Depending on the context, we rely on one or more lawful bases, including your consent; performance of an agreement or steps requested before an agreement; compliance with legal obligations; protection of vital interests; tasks carried out in the public interest; and legitimate interests assessed for proportionality.
Where processing relies on consent, you may withdraw that consent. Withdrawal does not affect processing already carried out lawfully and may limit features that require the relevant data.
6. WhatsApp, OTP, and Meta
We use the WhatsApp Business Platform for account verification and selected service messages. Your WhatsApp number, required message-template content, temporary OTP, and delivery metadata may be processed through Meta/WhatsApp and their infrastructure providers under their applicable terms and policies.
OTP codes are intended only for you. Do not share them with anyone. Nusantara Carbon personnel will not ask you to disclose an OTP by phone, private message, or email.
We use statuses such as sent, delivered, or read to confirm verification and service reliability. We do not use your WhatsApp number for cross-site behavioural advertising and do not sell communications data.
OTP and security notices are part of the process you request. Non-essential communications will be managed according to applicable choices and consent.
7. NC-AI and automated processing
NC-AI may assist with summarising, classifying, reviewing, or recommending based on available data. Do not enter unnecessary sensitive personal data into public conversations with NC-AI.
Material decisions affecting membership status, access rights, roles, benefits, sanctions, or community interests are not intended to be made solely by AI without review by an authorised person.
9. Cross-border processing
Some technology or communications providers may process data on infrastructure outside Indonesia. Where cross-border processing occurs, we will apply relevant mechanisms and safeguards based on applicable law, the nature of the data, and processing risk.
10. How long we retain data
We retain data only for as long as needed for its collection purpose, security, agreements, programme management, audits, dispute resolution, and legal obligations. Retention periods vary by data category.
- OTP codes are temporary and are not used after expiry or completion of verification; security metadata may be retained longer for abuse prevention and audits.
- Account data is retained while the account or service relationship remains active and for any additional period needed for obligations, claims, audits, or security.
- Conservation evidence and field records may be retained for programme, monitoring, reporting and verification, contractual, funding, scientific-integrity, or audit needs.
- Data in backups is deleted or overwritten through reasonable backup cycles unless retention is required for legal obligations or investigations.
11. Data security
We apply proportionate technical and organisational measures, including encryption in transit, role-based access restrictions, password hashing, session protection, form safeguards, audit logging, credential separation, backups, and incident monitoring.
No system can be guaranteed completely risk-free. If an incident affects personal data, we will respond and provide notifications as required by applicable obligations.
12. Your rights and choices
Under Indonesia’s Law No. 27 of 2022 on Personal Data Protection and other applicable requirements, you may have rights to:
- Receive information about the controller’s identity, purposes, lawful bases, and accountability.
- Access and obtain a copy of your personal data.
- Complete, update, or correct inaccurate data.
- Withdraw consent and, where applicable, stop, restrict, or postpone processing.
- Request deletion or destruction of data when legal requirements are met.
- Object to decisions based solely on automated processing that produce significant effects.
- Request data portability where applicable and lodge a complaint or pursue available remedies.
We may request reasonable identity verification before acting on a request to prevent unauthorised access or deletion.
13. Children, students, and young volunteers
Our services are not intended for independent use by children without supervision. Students or volunteers below the applicable age must participate through a parent or guardian, school, community, or authorised institution with appropriate consent and safeguards.
We prioritise data minimisation and additional safeguards when activities involve children or vulnerable groups.
15. Data deletion requests
To request deletion of an account or personal data, email info@nusantaracarbon.id with the subject “Data Deletion Request”. Include your name, registered WhatsApp number or email, the service used, and a description of the data you want deleted.
We will verify your identity proportionately, assess the request, and confirm when action is completed. Some data may be retained where required by law or needed for security, audits, fraud prevention, legal claims, or dispute resolution.
Deleting an account may end access to NCDE, NCIS, NC-AI, Knowledge & Impact, or related services that require that identity.
Direct link to these instructions: https://nusantaracarbon.id/privacy-policy/?lang=en#data-deletion
16. Changes to this policy
We may update this policy when services, technology, programmes, or legal requirements change. The latest version will always show its update date. For material changes, we will provide notice through the service or another appropriate communications channel.
17. Contact
Questions, complaints, correction or access requests, consent withdrawals, restrictions, or other personal-data requests may be sent to info@nusantaracarbon.id.
PT. Nusantara Carbon Lestari — STC Senayan Building, 3rd Floor, Jl. Asia Afrika Pintu IX, Gelora Senayan, Central Jakarta, Indonesia.