01 About this Privacy Notice
This Privacy Policy ("Notice") explains how 360energy (PT. Pionir Energi Hijau) ("360energy," "360eDash," "we," "us," or "our") collects, uses, discloses, retains, and protects personal data through the 360eDash Smart Solar Planner and related public pages (the "Site"). It is written to identify the purposes of processing, be clear and easy to find, and be understandable to a lay reader. Our primary legal obligation is Indonesia's Personal Data Protection Law (UU PDP, Law No. 27 of 2022), because that is where our business and most of our facility owners are located. By using the Site, you agree to the practices described below.
02 Personal Data Controller
PT. Pionir Energi Hijau (360energy) is the Personal Data Controller (Pengendali Data Pribadi) for the processing described in this Notice. For any question or request concerning your personal data, contact us at admin@360energy.io.
03 Collection of Personal Data
Under the principle of collection limitation, we collect personal data only where relevant to a stated purpose. The following is what the Site collects today.
When you use the Smart Solar Planner, you provide country, province/state, city, and facility type, together with usage details used to calculate your indicative solar potential and savings.
To view the full breakdown (payback period, investment estimate, and downloadable report), you submit your email address through the "Unlock Details & Report" form. This is used to send you that estimate and related solar quotation information.
The "Continue to Official Quote" button and the floating chat widget open a pre-filled conversation via a wa.me link. We do not collect your phone number through that redirect — WhatsApp handles it. Anything you share inside that chat afterwards is governed by WhatsApp's own privacy policy, not this Notice.
A Meta (Facebook) Pixel runs on Site pages and records page views and on-site actions, used for advertising and analytics on Meta's platforms.
Your selected display language is remembered so it does not reset on your next visit.
The estimate report is generated in your browser; the figures used to build it are the project inputs and calculation results described above.
Staff and partners with a 360eDash account sign in to the dashboard with a username, password, and role. Your username, role, and login time are then kept in your browser for the session to keep you signed in.
Once signed in, actions you take in the dashboard — login attempts (including failed ones), language changes, calculator use, viewing a project's detail page, changing settings, and exporting reports — are recorded on our own backend against your username, so administrators can review account activity and troubleshoot issues.
When an Activity Log entry or a marketing event is recorded, our backend resolves the visitor's IP address to a country using the third-party lookup service ipwho.is. Your IP address itself is used only for that lookup and is not stored alongside the resulting country.
Every event sent to the Meta Pixel described above is also copied to our own backend, so the dashboard's "Marketing Analytics" section can show real figures. This internal copy is stored separately from the Activity Log and is not shared with Meta or any other third party beyond what the Pixel itself already sends.
04 Legal Bases for Processing
Under Article 20 of UU PDP, every processing of personal data must rest on one of six legal bases. The bases relevant to 360eDash are:
- Performance of a contract, or steps taken at your request before entering one — the basis for handling your email address and project inputs, since these are required to give you the estimate and follow-up quotation you requested.
- Consent — freely given, specific, and withdrawable at any time. We rely on consent where the EU/EEA/UK banner described in Section 12 applies to the Meta Pixel.
- Legitimate interests, balanced against your interests and rights — the basis for the Meta Pixel outside those regions, kept narrow to what is described in Section 3.
- Compliance with a legal obligation — for example, retaining certain records where Indonesian law requires it.
05 Retention of Personal Data
Personal data is not retained longer than necessary for the purposes of processing (storage limitation).
- Your email address and project inputs are retained for as long as reasonably necessary to provide your estimate, follow up on your enquiry, and meet our legal and accounting obligations.
- Your saved language preference remains in your browser until you clear its storage.
- Meta Pixel events are retained in accordance with Meta's own retention practices; see Meta's privacy policy for details.
- Dashboard account data (username, role, session) is retained while your account is active. Session identifiers kept in your browser clear when your browser session ends.
- Activity Log entries and the internal Marketing Pixel mirror are retained on our backend for as long as reasonably necessary for account oversight, troubleshooting, and internal reporting.
You may request earlier deletion of your data at any time — see Section 10.
07 Cookies and Local Storage
Besides cookies and identifiers set by the Meta Pixel, the Site and dashboard use a small number of browser storage items directly:
- Language preference (local storage) — remembers your selected display language across visits.
- Solar Planner lead email (session storage) — set after you submit the "Unlock Details & Report" form, so the unlocked view stays open for the rest of that browser session.
- Marketing session ID (session storage) — a random identifier used only to group calculator events from the same browser tab for the "Marketing Analytics" dashboard; it is not linked to your name or email and is never sent to Meta.
- Dashboard session (session storage) — your username, role, and login time, set after you sign in, so the dashboard recognises you as logged in for that browser session.
None of this storage is used to store your name or account details on Meta's side. You can control or disable cookies through your browser settings; doing so may affect some Site functionality, including the Meta Pixel, the "remember my language" behaviour, and staying signed in to the dashboard.
08 Cross-Border Transfer of Personal Data
Some of the providers listed in Section 6 operate infrastructure outside Indonesia. UU PDP (including Article 56) places conditions on the cross-border transfer of personal data, including consideration of whether the destination provides an equivalent level of protection. We are reviewing the safeguards that apply to each provider above; until that review is complete, this section should be read as identifying the issue rather than as a final statement of compliance measures.
09 Security of Personal Data
We take reasonable technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, destruction, or loss, including restricting access to the email addresses and project data submitted through the Site to personnel who need it to respond to your enquiry, and safeguarding dashboard credentials and login access. No system is completely free of risk. If a personal data protection failure occurs, we will notify affected data subjects and the relevant authority as required by law — see Section 11.
10 Rights of the Data Subject
Under Articles 6–13 of UU PDP, you have, among others, the right to:
- Information — know when personal data about you is, will be, or has been processed, and for what purposes.
- Access — obtain a description of the personal data we hold about you, its purposes, retention periods, and recipients.
- Rectification — correct or update inaccurate or incomplete personal data.
- Erasure and restriction — request that we stop processing, erase, or destroy your personal data, subject to legal retention requirements.
- Data portability — obtain your personal data in a structured, commonly used, machine-readable format.
- Object — object to processing that rests on legitimate interests, including the Meta Pixel.
- Withdraw consent — where processing rests on your consent, withdraw it at any time.
To exercise any of these rights, email admin@360energy.io, state which right you wish to exercise, and identify the relevant submission (e.g. the email address you used). We will first take reasonable steps to confirm your identity before acting on the request.
11 Notification of Personal Data Protection Failure
Where a failure of personal data protection occurs, UU PDP requires the Controller to notify both affected data subjects and the relevant supervisory authority in writing within 3×24 hours (72 hours) of becoming aware of the failure, identifying the personal data involved, when and how the failure occurred, and the measures being taken. If such an event occurs, we will meet that deadline.
12 If you are in the EU, EEA, or UK
We do not currently have EU, EEA, or UK customers, but this is a public website, and the GDPR (and the UK's UK GDPR) may apply to a visit from those regions. Everything above about what we collect, how long we retain it, and to whom we disclose it applies to you as described. GDPR's legal bases correspond closely to UU PDP's (Section 4); account and project data rest on contract, and the Meta Pixel runs only after consent for visitors from these regions specifically, via an on-Site consent banner where applicable. In addition to the rights in Section 10, GDPR also provides the right to restrict processing, and to lodge a complaint with your national data protection authority or the UK's Information Commissioner's Office (ICO).
13 If you are a California resident
California's privacy law (the CCPA, as amended by the CPRA) may apply to visitors using the Site from California. What we collect, retain, and disclose (Sections 3, 5, and 6) is the same for California residents as for other users. California residents have the right to know and access what personal information we hold, request deletion, request correction, opt out of sale or sharing (we do not sell or share personal information for cross-context behavioural advertising), and non-discrimination for exercising these rights. To exercise these rights, email admin@360energy.io.
14 Children
The Site is intended for business and facility decision-makers evaluating solar projects. We do not knowingly collect personal data from children. If you believe a child's personal data has been provided to us, email admin@360energy.io and we will delete it.
15 Trademarks / Merek dagang
Brand names and logos are trademarks of their respective owners and are shown only to indicate compatibility. eDash is not affiliated with, sponsored or endorsed by these companies.
Nama dan logo merek adalah merek dagang milik pemiliknya masing-masing dan ditampilkan hanya untuk menunjukkan kompatibilitas. eDash tidak berafiliasi dengan, disponsori, atau didukung oleh perusahaan-perusahaan tersebut.
16 Changes to this Notice
This Privacy Notice may be updated as the Site, our practices, or applicable law changes. When we update it, we will revise the "Last updated" date at the top of this page.
17 Contact
Questions about this Privacy Notice, or requests concerning your personal data? The Personal Data Controller is PT. Pionir Energi Hijau (360energy).
admin@360energy.io