Privacy Policy

01 About this Privacy Notice

This Privacy Policy ("Notice") explains how 360energy (PT. Pionir Energi Hijau) ("360energy," "360eDash," "we," "us," or "our") collects, uses, discloses, retains, and protects personal data through the 360eDash Smart Solar Planner and related public pages (the "Site"). It is written to identify the purposes of processing, be clear and easy to find, and be understandable to a lay reader. Our primary legal obligation is Indonesia's Personal Data Protection Law (UU PDP, Law No. 27 of 2022), because that is where our business and most of our facility owners are located. By using the Site, you agree to the practices described below.

02 Personal Data Controller

PT. Pionir Energi Hijau (360energy) is the Personal Data Controller (Pengendali Data Pribadi) for the processing described in this Notice. For any question or request concerning your personal data, contact us at admin@360energy.io.

03 Collection of Personal Data

Under the principle of collection limitation, we collect personal data only where relevant to a stated purpose. The following is what the Site collects today.

04 Legal Bases for Processing

Under Article 20 of UU PDP, every processing of personal data must rest on one of six legal bases. The bases relevant to 360eDash are:

• Performance of a contract, or steps taken at your request before entering one — the basis for handling your email address and project inputs, since these are required to give you the estimate and follow-up quotation you requested.
• Legitimate interests, balanced against your interests and rights, for our first-party analytics and for advertising measurement with the Meta Pixel and the Conversions API (Section 8). You can object at any time (Section 11).
• Consent, where you give it, for example when you send us a data file to review.
• Compliance with a legal obligation — for example, retaining certain records where Indonesian law requires it.

05 Retention of Personal Data

Personal data is not retained longer than necessary for the purposes of processing (storage limitation).

• Your email address and project inputs are retained for as long as reasonably necessary to provide your estimate, follow up on your enquiry, and meet our legal and accounting obligations.
• Your saved language preference remains in your browser until you clear its storage.
• Meta Pixel events are retained in accordance with Meta's own retention practices; see Meta's privacy policy for details.
• Dashboard account data (username, role, session) is retained while your account is active. Session identifiers kept in your browser clear when your browser session ends.
• Activity Log entries and the internal Marketing Pixel mirror are retained on our backend for as long as reasonably necessary for account oversight, troubleshooting, and internal reporting.

You may request earlier deletion of your data at any time — see Section 11.

06 Disclosure to Third Parties

We do not sell personal data. Disclosure of personal data to third parties occurs only as described below, consistent with the purposes stated in this Notice:

• Meta Platforms receives Pixel events from the Site and, for each enquiry, a Conversions API event with your email address and phone number hashed (Section 8).
• WhatsApp (Meta) — involved only if you choose to open a chat through one of our WhatsApp buttons.
• Cloudflare (cdnjs) — used to load the icon library that renders this Site; loading it causes your browser to connect to that provider's servers. Fonts are self-hosted and make no third-party request.

We may also disclose personal data where required by law — for example, in response to a valid order from an Indonesian court or competent authority.

07 Cookies and Local Storage

Besides cookies and identifiers set by the Meta Pixel, the Site and dashboard use a small number of browser storage items directly:

• Language preference (local storage) — remembers your selected display language across visits.
• Solar Planner lead email (session storage) — set after you submit the "Unlock Details & Report" form, so the unlocked view stays open for the rest of that browser session.
• Marketing session ID (session storage) — a random identifier used only to group calculator events from the same browser tab for the "Marketing Analytics" dashboard; it is not linked to your name or email and is never sent to Meta.
• Meta cookies (_fbp, _fbc): set by the Meta Pixel on every visit to identify the browser to Meta for advertising measurement. Meta controls how long they last.
• Campaign source (local storage): the campaign tags of the link you arrived from, kept for 30 days so an enquiry can be credited to the post that brought you.
• Dashboard session (session storage) — your username, role, and login time, set after you sign in, so the dashboard recognises you as logged in for that browser session.

None of this storage is used to store your name or account details on Meta's side. You can control or disable cookies through your browser settings; doing so may affect some Site functionality, including the Meta Pixel, the "remember my language" behaviour, and staying signed in to the dashboard.

08 Analytics and Advertising

We measure how people find and use the Site so we can improve it and see which posts and campaigns bring visitors. Both tools below run for every visitor. There is no banner, and they load after the page has finished loading, so they do not slow it down.

• First-party analytics, on our own servers. Each visit to the landing page, the Solar Calculator and the dashboard sends a short record to our backend: the page, the time, your browser and device type, a screen size class, your language, your IP address with the country and city worked out from it, the website you came from (its host name only) and the campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_content, utm_term). On the Solar Calculator we also record the interactions: changed fields, the battery scenario, "Calculate Estimate" and the email unlock. No cookie is set. A random ID in session storage groups the events of one browser tab, and the campaign tags are kept in local storage for 30 days so an enquiry can be credited to the post that brought you.
• Meta Pixel (pixel ID 28691473423844765) on the landing page, the Solar Calculator and this page. It sends Meta your page views, the calculator interactions listed above, enquiries (Lead) and booking clicks (Schedule), with the campaign tags. Meta sets its own cookies (_fbp, _fbc) and may link these events to a Meta account. Your name, email address and phone number are never given to the Pixel in your browser.
• Meta Conversions API. When you send an enquiry, our server reports it to Meta with your email address and phone number hashed (SHA-256), your IP address and browser, Meta's _fbp and _fbc IDs and the campaign tags. It uses the same event ID as the browser, so Meta counts the enquiry once.
• Lead form data. The enquiry form collects your name, email address, company, role, phone number, number of sites, your message and, for a data review, the CSV file you upload. We use it to reply to you, prepare the review and follow up.

Purpose. Analytics (how the Site is used and which pages and campaigns work) and marketing (measuring and improving our advertising on Meta, including Instagram).

Retention. First-party analytics and enquiry records are kept on our servers for as long as they are useful for reporting and follow-up. Nothing is deleted automatically today. Meta keeps Pixel and Conversions API data under its own retention rules.

Opting out or deleting. Email admin@360energy.io to opt out of analytics or advertising measurement, or to have the records linked to you deleted. Tell us the email address you used, or roughly when you visited. You can also block third-party cookies or scripts in your browser, or change your ad settings on Meta.

09 Cross-Border Transfer of Personal Data

Some of the providers listed in Section 6 operate infrastructure outside Indonesia. UU PDP (including Article 56) places conditions on the cross-border transfer of personal data, including consideration of whether the destination provides an equivalent level of protection. We are reviewing the safeguards that apply to each provider above; until that review is complete, this section should be read as identifying the issue rather than as a final statement of compliance measures.

10 Security of Personal Data

We take reasonable technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, destruction, or loss, including restricting access to the email addresses and project data submitted through the Site to personnel who need it to respond to your enquiry, and safeguarding dashboard credentials and login access. No system is completely free of risk. If a personal data protection failure occurs, we will notify affected data subjects and the relevant authority as required by law. See Section 12.

11 Rights of the Data Subject

Under Articles 6–13 of UU PDP, you have, among others, the right to:

• Information — know when personal data about you is, will be, or has been processed, and for what purposes.
• Access — obtain a description of the personal data we hold about you, its purposes, retention periods, and recipients.
• Rectification — correct or update inaccurate or incomplete personal data.
• Erasure and restriction — request that we stop processing, erase, or destroy your personal data, subject to legal retention requirements.
• Data portability — obtain your personal data in a structured, commonly used, machine-readable format.
• Object — object to processing that rests on legitimate interests, including the Meta Pixel.
• Withdraw consent — where processing rests on your consent, withdraw it at any time.

To exercise any of these rights, email admin@360energy.io, state which right you wish to exercise, and identify the relevant submission (e.g. the email address you used). We will first take reasonable steps to confirm your identity before acting on the request.

12 Notification of Personal Data Protection Failure

Where a failure of personal data protection occurs, UU PDP requires the Controller to notify both affected data subjects and the relevant supervisory authority in writing within 3×24 hours (72 hours) of becoming aware of the failure, identifying the personal data involved, when and how the failure occurred, and the measures being taken. If such an event occurs, we will meet that deadline.

13 If you are in the EU, EEA, or UK

We do not currently have EU, EEA, or UK customers, but this is a public website, and the GDPR (and the UK's UK GDPR) may apply to a visit from those regions. Everything above about what we collect, how long we retain it, and to whom we disclose it applies to you as described. GDPR's legal bases correspond closely to UU PDP's (Section 4); account and project data rest on contract, and analytics and advertising measurement (Section 8) rest on legitimate interests. You can object to them at any time by email. In addition to the rights in Section 11, GDPR also provides the right to restrict processing, and to lodge a complaint with your national data protection authority or the UK's Information Commissioner's Office (ICO).

14 If you are a California resident

California's privacy law (the CCPA, as amended by the CPRA) may apply to visitors using the Site from California. What we collect, retain, and disclose (Sections 3, 5, and 6) is the same for California residents as for other users. California residents have the right to know and access what personal information we hold, request deletion, request correction, opt out of sale or sharing, and non-discrimination for exercising these rights. We do not sell personal information for money. Our use of the Meta Pixel and the Conversions API (Section 8) may count as "sharing" for cross-context behavioural advertising under California law. To opt out of it, or to exercise any of these rights, email admin@360energy.io.

15 Children

The Site is intended for business and facility decision-makers evaluating solar projects. We do not knowingly collect personal data from children. If you believe a child's personal data has been provided to us, email admin@360energy.io and we will delete it.

16 Trademarks / Merek dagang

Brand names and logos are trademarks of their respective owners and are shown only to indicate compatibility. eDash is not affiliated with, sponsored or endorsed by these companies.

Nama dan logo merek adalah merek dagang milik pemiliknya masing-masing dan ditampilkan hanya untuk menunjukkan kompatibilitas. eDash tidak berafiliasi dengan, disponsori, atau didukung oleh perusahaan-perusahaan tersebut.

17 Changes to this Notice

This Privacy Notice may be updated as the Site, our practices, or applicable law changes. When we update it, we will revise the "Last updated" date at the top of this page.

18 Contact