Privacy Policy

1. Introduction

Opptunity Studio ("we," "our," or "us") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services, including our innovation studio platform, BrainVault application, and related products and services.

We operate globally with a focus on the United Kingdom and Indonesia. This policy complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and Indonesia's Personal Data Protection Law (UU PDP) No. 27 of 2022.

By using our services, you consent to the data practices described in this policy. If you do not agree with our policies and practices, please do not use our services.

2. Legal Basis and Jurisdiction

2.1 UK Data Protection

For users in the United Kingdom, we process your personal data in accordance with the UK GDPR and the Data Protection Act 2018. Our legal basis for processing includes:

• Consent - when you explicitly agree to data processing
• Contract performance - to provide our services
• Legitimate interests - to improve our services and prevent fraud
• Legal obligations - to comply with applicable laws

2.2 Indonesia Data Protection

For users in Indonesia, we process your personal data in accordance with the Personal Data Protection Law (UU PDP) No. 27 of 2022. Our legal basis includes:

• Explicit consent - clear and specific permission
• Contract fulfillment - to deliver our services
• Vital interests - to protect life and safety
• Public interest - for legal compliance

2.3 Cross-Border Data Transfers

As we operate in both the UK and Indonesia, your data may be transferred between these jurisdictions. We ensure all transfers comply with:

• UK adequacy decisions and standard contractual clauses
• Indonesia's data localization requirements where applicable
• Appropriate safeguards and security measures
• Local data protection authority requirements

3. Information We Collect

3.1 Personal Information

We may collect personal information that you provide directly to us, including:

• Name, email address, and contact information
• Professional information and company details
• Project requirements and innovation goals
• Communication preferences and feedback
• Payment and billing information
• Nationality and residency information for compliance

3.2 Usage Information

We automatically collect certain information about your use of our services, including:

• Device information and IP addresses
• Usage patterns and feature interactions
• Performance data and error logs
• Cookies and similar tracking technologies
• Geographic location data for service optimization

3.3 BrainVault Specific Data

When using BrainVault or our innovation tools, we may collect:

• Project data and innovation concepts
• Collaboration and team information
• Analytics and performance metrics
• User-generated content and feedback
• Intellectual property and innovation data

4. How We Use Your Information

We use the information we collect for various purposes, including:

• Providing and improving our innovation studio services
• Developing and enhancing BrainVault and related products
• Personalizing your experience and recommendations
• Processing payments and managing accounts
• Communicating with you about services and updates
• Ensuring security and preventing fraud
• Complying with legal obligations

5. Information Sharing and Disclosure

We do not sell, trade, or otherwise transfer your personal information to third parties without your consent, except in the following circumstances:

• With your explicit consent and permission
• To trusted service providers who assist in our operations
• To comply with legal requirements or court orders
• To protect our rights, property, or safety
• In connection with business transfers or acquisitions

6. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication measures
• Employee training on data protection
• Incident response and breach notification procedures

7. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. We will delete or anonymize your information when it is no longer needed.

8. Your Rights and Choices

You have certain rights regarding your personal information, including:

8.1 UK Data Protection Rights

Under the UK GDPR and Data Protection Act 2018, you have the following rights:

• Right of access - to obtain a copy of your personal data
• Right to rectification - to correct inaccurate data
• Right to erasure - to request deletion of your data
• Right to restrict processing - to limit how we use your data
• Right to data portability - to receive your data in a structured format
• Right to object - to object to processing based on legitimate interests
• Rights related to automated decision making and profiling

8.2 Indonesia Data Protection Rights

Under Indonesia's Personal Data Protection Law (UU PDP), you have the following rights:

• Right to information - to know the purpose and legal basis of processing
• Right to access - to obtain and receive personal data
• Right to correction - to update and complete personal data
• Right to deletion - to request removal of personal data
• Right to withdraw consent - to revoke previously given consent
• Right to data portability - to transfer data to other controllers
• Right to object - to object to processing activities

8.3 Exercising Your Rights

To exercise these rights, please contact us using the information provided below. We will respond to your request within:

• UK: 30 days as required by UK GDPR
• Indonesia: 3x24 hours (72 hours) as required by UU PDP

We may request additional information to verify your identity before processing your request.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience, analyze usage patterns, and improve our services. You can control cookie settings through your browser preferences, though disabling certain cookies may affect service functionality.

10. Third-Party Services

Our services may contain links to third-party websites or integrate with third-party services. We are not responsible for the privacy practices of these external services. We encourage you to review their privacy policies before providing any personal information.

11. International Data Transfers

Your personal information may be transferred to and processed in countries other than your own. We ensure that such transfers comply with applicable data protection laws and implement appropriate safeguards to protect your information.

12. Children's Privacy

Our services are not intended for children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe we have collected such information, please contact us immediately.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of any material changes by posting the updated policy on our website and updating the "Last updated" date. Your continued use of our services after such changes constitutes acceptance of the updated policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

15. Data Protection Authorities

If you have concerns about how we handle your personal data, you have the right to lodge a complaint with the relevant data protection authority:

15.1 UK Information Commissioner's Office (ICO)

For users in the United Kingdom, you can contact the ICO:

15.2 Indonesia Personal Data Protection Authority

For users in Indonesia, you can contact the Personal Data Protection Authority:

We encourage you to contact us first to resolve any concerns before lodging a complaint with the authorities.

16. Legal Basis for Processing (UK Users)

For users in the United Kingdom, we process your personal information based on the following legal grounds:

• Consent for specific processing activities
• Contract performance and service delivery
• Legitimate interests in business operations
• Legal obligations and compliance requirements

17. Legal Basis for Processing (Indonesia Users)

For users in Indonesia, we process your personal information based on the following legal grounds under UU PDP:

• Explicit consent for specific processing activities
• Contract fulfillment and service delivery
• Vital interests for life and safety protection
• Public interest and legal compliance
• Legitimate interests with appropriate safeguards

18. California Privacy Rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to delete personal information, and the right to opt-out of the sale of personal information. Contact us to exercise these rights.

19. Conclusion

At Opptunity Studio, we are committed to protecting your privacy and maintaining the trust you place in us. This Privacy Policy reflects our dedication to transparency and responsible data handling in compliance with UK and Indonesia data protection laws. We encourage you to review this policy regularly and contact us with any questions or concerns.