In short: we only collect what we need to run your tenders and projects. We don't sell your data. Company legal documents are stored privately. Bid prices are visible only to the project owner. You can ask for a copy of your data, a correction or deletion at any time.
Who we are
ICEMAN ("we", "us") is the controller of the personal data processed through the ICEMAN website and app (the "Platform"). This policy follows Law No. 27 of 2022 on Personal Data Protection (the "PDP Law") and related regulations. For questions or requests about personal data, contact admin@iceman.id.
Data we collect
| Type | Examples | Source |
|---|---|---|
| Account | Name, email, phone number, password (stored encrypted by our authentication provider), profile photo | You |
| Company | Name, address, industry, contacts, NIB, NPWP, deed of establishment, other supporting documents | You or your colleagues |
| Business activity | Tenders, bids, questions and answers, messages, orders, project stages, payment proofs, tax invoices, reviews, disputes | You and the parties you do business with |
| Ecosystem requests | Financing, guarantee, insurance or legal-service details, including the business financials and collateral you enter | You |
| Technical | IP address and the approximate location (city) derived from it, device and browser type, sign-in history, notification tokens, access and error logs | Collected automatically when you use the Platform |
We don't ask for specific (sensitive) personal data such as health, biometric or criminal-record data. Please don't upload it. Company documents can contain directors' personal data, such as names and ID numbers in a deed. We process this only for verification.
Purposes and legal bases
| Purpose | Legal basis (PDP Law, Article 20) |
|---|---|
| Creating and running your account, tenders, bids, orders and projects | Performance of our agreement with you |
| Verifying companies and preventing fraud | Legitimate interest in keeping users able to trust each other, and legal obligation |
| Sending important notifications about tenders, bids, messages and account security, in the app and by email | Performance of our agreement |
| Sending notifications on WhatsApp | Your consent, which you can withdraw at any time in settings |
| Passing your request to the bank, insurer or law firm you choose | Consent and performance of our agreement |
| Keeping the Platform and your account secure (including the sign-in history our admins check for unauthorised access), fixing errors and improving it | Legitimate interest |
| Responding to lawful requests from law enforcement or regulators | Legal obligation |
We don't use your data for third-party advertising, and we don't sell personal data.
Who can see your data
- The public: company profiles, open tenders, catalogs and reviews.
- Project owners: the bids submitted on their tender. If the tender has a bid deadline, bids become visible only after it passes.
- All bidders on a tender: clarification questions that have been answered, with their answers, without the asker's identity.
- Parties to a project or order: the related messages, stages, documents, payment proofs and invoices.
- Ecosystem partners you choose: the data and documents you attach to a financing, insurance or legal request.
- The ICEMAN team: authorised staff, only as their role requires, for example to review verification or help with a dispute.
Company legal documents, such as the NIB, NPWP and deed, can be accessed only by your company and our admin team.
Processors and international transfers
We use service providers that process data on our behalf:
- Google Firebase / Google Cloud: authentication, database, file storage, hosting, server functions, push notifications and app crash reports;
- Email provider (Namecheap Private Email): sending notification emails and verification codes;
- WhatsApp Business provider: only if you turn on WhatsApp notifications;
- Google Fonts: loads the website's fonts, so Google receives your IP address.
These providers' servers may be outside Indonesia. We transfer data abroad only as allowed by Article 56 of the PDP Law: to providers with an equal or higher level of data protection, or with adequate contractual safeguards.
How long we keep data
- Account and company data is kept while your account is active.
- Once an account deletion is approved, we delete or anonymise your personal data within 30 days. Exceptions are data we must keep by law, or that we need to resolve a dispute or prevent fraud.
- Records that also belong to other parties may be kept without identifying you. Examples are your bid on someone else's tender, messages in a shared project, or reviews you received.
- Technical logs are kept according to our providers' policies, generally for no more than 12 months. Sign-in history (time, IP address, approximate location and device of each sign-in) is deleted automatically after 12 months.
Security
We use encryption in transit (HTTPS), role-based access rules on our database and file storage, email and phone verification, and limited staff access. No system is completely secure. If a personal data protection failure occurs, we will notify you and the competent authority within 3 × 24 hours, as required by Article 46 of the PDP Law.
Your rights
Under the PDP Law you have the right to:
- be informed about how your data is processed;
- access your personal data and get a copy of it;
- correct inaccurate data, most of which you can do yourself on your Profile;
- have your personal data deleted or destroyed;
- withdraw consent you have given, for example for WhatsApp notifications;
- delay or restrict processing;
- object to decisions based solely on automated processing;
- receive your data in a commonly used format, so you can move it to another controller.
To make a deletion request, use Profile → Delete account in the app. For any other request, email admin@iceman.id from your account's email address. We may ask you to confirm your identity first, and we will respond within the time limits set by the PDP Law. You also have the right to complain to the personal data protection authority.
Cookies and local storage
Our website doesn't use advertising cookies or third-party trackers. The app uses your browser's local storage to keep you signed in and to remember your language. If you clear it, you will be signed out.
Children
The Platform is for business use and is not intended for anyone under 18. We don't knowingly collect children's data.
Changes to this policy
We may update this policy. We will tell you about material changes through the Platform or by email before they take effect. The effective date is shown at the top of this page.
Contact
Send questions, requests or complaints about personal data to admin@iceman.id with the subject "Personal Data".