This Privacy Policy on Personal Data Processing (hereinafter referred to as the «Policy») is designed to ensure compliance with applicable data protection laws, including the General Data Protection Regulation (GDPR) of the European Union and the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), as well as other relevant U.S. state privacy laws where applicable. It outlines how PT ECO PARK INVESTMENT (Address: Perum Graha Mawasaka no2, Jl. Tukad Mawa, Denpasar, Indonesia) (hereinafter referred to as the «Controller» or «Operator») processes personal data and implements measures to ensure its security.
By using our Website, you accept the terms of this Policy. If you disagree, please refrain from using https://ecoinvest.group.
PT ECO PARK INVESTMENT respects the rights and freedoms of all individuals and takes necessary legal, organizational, and technical measures to ensure the confidentiality and security of personal data in accordance with applicable laws.
We fully comply with relevant privacy laws, including the GDPR and CCPA/CPRA, as well as the privacy laws of other countries where we operate or whose residents use our services.
1.1. The Controller’s primary goal is to protect the rights and freedoms of individuals when processing their personal data, including the right to privacy.
1.2. This Policy applies to all information that the Controller may obtain about visitors to the website https://ecoinvest.group (hereinafter the «Website»).
2.1. Automated processing of personal data — processing using computer systems.
2.2. Blocking of personal data — temporary suspension of processing (except where necessary for verification).
2.3. Website — graphic and informational materials, programs, and databases available at https://ecoinvest.group.
2.4. Personal data information system — personal data contained in databases and related technologies.
2.5. Depersonalization of personal data — actions making it impossible to identify the data subject without additional information.
2.6. Processing of personal data — any action performed on personal data, including collection, recording, storage, use, transfer, etc.
2.7. Controller — the entity organizing and determining the purposes of personal data processing.
2.8. Personal data — any information relating to an identifiable User of the Website.
2.9. Personal data permitted for dissemination — data to which unlimited access is granted by the data subject.
2.10. User — any visitor to the Website.
2.11. Provision of personal data — disclosing data to a specific person or group.
2.12. Dissemination of personal data — disclosing data to an indefinite circle of persons.
2.13. Cross-border transfer — transfer of data to a foreign state.
2.14. Destruction of personal data — irreversible destruction of data.
3.1. The Controller has the right to:
— Obtain accurate information and documents containing personal data;
— Continue processing personal data without consent where permitted by law (legal obligations, legitimate interests, contractual necessity);
— Determine measures necessary to fulfill obligations under data protection laws.
3.2. The Controller is obliged to:
— Provide information about data processing upon request;
— Process personal data in accordance with applicable laws;
— Respond to inquiries from data subjects and their representatives;
— Provide information to supervisory authorities within legal timelines;
— Ensure access to this Policy;
— Implement measures to protect personal data from unlawful actions;
— Cease processing and destroy data as required by law;
— Fulfill other legal obligations.
4.1. Data subjects have the right to:
— GDPR Rights: Access, Rectification, Erasure («right to be forgotten»), Restriction of Processing, Data Portability, Objection to Processing.
— CCPA/CPRA Rights: Know, Delete, Correct, Opt-Out of Sale/Sharing, Limit Use of Sensitive Personal Information, Non-Discrimination.
— Require the Controller to clarify, block, or destroy inaccurate or unlawfully obtained data;
— Withdraw consent to processing;
— Lodge complaints with supervisory authorities (e.g., Data Protection Authorities or California Privacy Protection Agency);
— Exercise other rights provided by applicable laws.
4.2. Data subjects are obliged to:
— Provide accurate personal data;
— Notify the Controller of updates to their personal data.
4.3. Persons providing inaccurate information without consent bear liability under applicable laws.
5.1. Processing is lawful and fair.
5.2. Processing is limited to specific, predetermined purposes.
5.3. Combining databases for incompatible purposes is prohibited.
5.4. Only relevant personal data is processed.
5.5. Processed data corresponds to stated purposes without excessiveness.
5.6. Accuracy, sufficiency, and relevance of data are ensured.
5.7. Data is stored only as long as necessary and destroyed when no longer needed.
Purpose of Processing | Personal Data | Legal Bases | Types of Processing |
Providing access to services, information, and materials | Name, email, phone | Contract performance (GDPR Art. 6(1)(b)), Legitimate interests (GDPR Art. 6(1)(f)) | Collection, storage, destruction, depersonalization |
Marketing communications | Email, name | Consent (GDPR Art. 6(1)(a)) | Sending promotional emails |
Security and fraud prevention | IP address, technical logs | Legitimate interests (GDPR Art. 6(1)(f)) | Collection, recording, analysis |
7.1. We use cookies to enhance user experience, analyze traffic, and for marketing purposes.
7.2. Types of cookies:
— Essential (necessary for website functionality)
— Analytical (help us understand user behavior)
— Marketing (used for advertising purposes)
7.3. Users can manage cookie preferences through browser settings or our cookie consent banner.
8.1. Personal data is retained only as long as necessary:
— Contact information for marketing: until consent withdrawal
— Transaction data: as required by applicable laws (typically 5-7 years)
— Website logs: 30 days
— Inactive user accounts: 24 months
8.2. Data is securely deleted or anonymized upon expiration of retention periods.
9.1. With consent of the data subject.
9.2. Necessary for legal obligations or public interest.
9.3. Required for contract performance.
9.4. Necessary for legitimate interests (unless overridden by individual’s rights).
9.5. Processing of publicly available data.
9.6. Required for legal claims or judicial proceedings.
10.1. The Controller implements security measures to protect personal data.
10.2. Personal data is not transferred to third parties except:
— As required by law
— With explicit consent for specific purposes
— To service providers under strict contractual safeguards
10.3. For EU users, international transfers use appropriate safeguards (Standard Contractual Clauses).
10.4. We do not sell personal information as defined under CCPA. California residents can opt-out via the «Do Not Sell or Share My Personal Information» link on our Website.
11.1. To exercise your rights, contact: PT ECO PARK INVESTMENT, Perum Graha Mawasaka no2, Jl. Tukad Mawa, Denpasar, Indonesia.
Email: reg@ecoinvest.group
11.2. We will verify your identity before processing requests.
11.3. Response timelines:
— GDPR requests: Within one month (extendable to three for complex cases)
— CCPA requests: Within 45 days (extendable to 90 with notice)
11.4. Right to lodge complaints with supervisory authorities remains unaffected.
12.1. For questions about this Policy, email reg@ecoinvest.group.
12.2. This Policy is effective indefinitely upon publication.
12.3. Changes take effect upon publication on the Website.
12.4. Current version always available at: https://ecoinvest.group/privacy-policy-en/
12.5. We regularly review and update this Policy to ensure compliance.
We respect your rights and freedoms, in particular those related to the processing of your personal data.
For more detailed information about personal data processing, please contact us by email: reg@ecoinvest.group
Date of last update: December 11, 2025.
Perum Graha Mawasaka no2 Jl. Tukad Mawa, Denpasar, Indonesia, Bali
PT ECO PARK INVESTMENT